Arvind Vishwakarma

**Name of the Vulnerable Software and Affected Versions** Bravo Tejari Procurement Portal (affected versions not specified) **Description** A cross-site request forgery (CSRF) issue exists due to the lack of anti-CSRF tokens, allowing remote authenticated users to hijack the authentication of application users for requests that modify their personal data. This can be achieved by leveraging the `esop/toolkit/profile/regData.do` endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Bravo Tejari Procurement Portal (affected versions not specified) **Description** The issue arises from the improper validation of uploaded files, which can be exploited by an attacker to upload malicious executable files and compromise the application. This can be achieved through a request to the "esop/evm/OPPreliminaryForms.do?formId=857" endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ZKTeco ZKTime Web version 2.0.1.12280 **Description** A cross-site request forgery (CSRF) issue allows remote authenticated users to hijack the authentication of administrators for requests that add administrators by leveraging the lack of anti-CSRF tokens. **Recommendations** For ZKTeco ZKTime Web version 2.0.1.12280, consider implementing anti-CSRF tokens to prevent unauthorized requests. As a temporary workaround, restrict access to administrator functions to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ZKTeco ZKTime Web version 2.0.1.12280 **Description** The issue allows remote attackers to obtain sensitive employee metadata by making a direct request for a PDF document. **Recommendations** For ZKTeco ZKTime Web version 2.0.1.12280, consider restricting access to sensitive PDF documents until a patch is available.