Abbisqq

**Name of the Vulnerable Software and Affected Versions** Volmarg Personal Management System version 1.4.65 **Description** The issue allows attackers to execute arbitrary code and obtain sensitive information via the SameSite cookie attribute defaults value set to none. This is related to Cross Site Request Forgery (CSRF). **Recommendations** For Volmarg Personal Management System version 1.4.65, consider updating the SameSite cookie attribute to a more secure value, such as `Lax` or `Strict`, to mitigate the risk of CSRF attacks. As a temporary workaround, restrict access to sensitive information and functions that can be executed through CSRF attacks until a patch is available.

**Name of the Vulnerable Software and Affected Versions** slabiak Appointment Scheduler version 1.0.5 **Description** A Host Header Poisoning Open Redirect issue allows a remote attacker to redirect users to a malicious website, leading to potential credential theft, malware distribution, or other malicious activities. **Recommendations** For slabiak Appointment Scheduler version 1.0.5, consider disabling the open redirect functionality until a patch is available. Restrict access to the scheduler to minimize the risk of exploitation. Avoid using the scheduler until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NOSH version 4a5cfdb **Description** The issue allows stored XSS via the create user page. For example, a first name (of a physician, assistant, or billing user) can have a JavaScript payload that is executed upon visiting the "/users/2/1" page. This may allow attackers to steal Protected Health Information because the product is for health charting. **Recommendations** For version 4a5cfdb, consider disabling the create user page functionality until a patch is available to prevent stored XSS attacks. Restrict access to the "/users/2/1" page to minimize the risk of exploitation. Avoid using the `first name` field in the create user page until the issue is resolved.