Brian

**Name of the Vulnerable Software and Affected Versions** Firefox ESR version 115.34 Firefox ESR version 140.9 Thunderbird ESR version 140.9 Firefox version 149 Thunderbird version 149 **Description** Memory safety bugs involving memory corruption could allow an attacker to run arbitrary code. **Recommendations** Update Firefox ESR 115.34 to version 115.35. Update Firefox ESR 140.9 to version 140.10. Update Thunderbird ESR 140.9 to version 140.10. Update Firefox 149 to version 150. Update Thunderbird 149 to version 150.

**Name of the Vulnerable Software and Affected Versions** Thales Imperva SecureSphere WAF versions 14.7.0.40 and earlier, without the February 2024 update from the Application Delivery Controller (ADC) Thales Imperva SecureSphere versions prior to the February 2024 update **Description** The issue is related to inadequate access control in the Thales Imperva SecureSphere WAF, allowing remote attackers to bypass WAF rules via crafted POST requests. This could lead to devastating breaches, including SQL injection and cross-site scripting (XSS) attacks. The vulnerability can be exploited by sending a request with specially crafted Content-Encoding headers, such as multiple headers or specific combinations like gzip and deflate. The estimated number of potentially affected devices is not specified. **Recommendations** For Thales Imperva SecureSphere WAF versions 14.7.0.40 and earlier, without the February 2024 update from the Application Delivery Controller (ADC), update to a version that includes the February 2024 ADC update to fix the vulnerability. For Thales Imperva SecureSphere versions prior to the February 2024 update, apply the February 2024 update to resolve the issue. As a temporary workaround, consider restricting access to the WAF and limiting the use of HTTP requests with multiple Content-Encoding headers until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Masa CMS versions 7.2 through 7.4-beta **Description** A vulnerability in the Remember Me function of Masa CMS allows attackers to bypass authentication via a crafted web request. **Recommendations** For versions 7.2 through 7.4-beta, consider disabling the Remember Me function as a temporary workaround until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Mura CMS versions prior to 10.0.580 **Description** A vulnerability in the Remember Me function allows attackers to bypass authentication via a crafted web request. **Recommendations** For versions prior to 10.0.580, update to version 10.0.580 or later to resolve the issue. As a temporary workaround, consider disabling the Remember Me function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Apache Tika versions 0.1 through 1.18 **Description** The issue is related to the XML parsers in Apache Tika not being configured to limit entity expansion, making them vulnerable to an entity expansion vulnerability. This can lead to a denial of service attack. The vulnerability is also associated with incorrect restriction of XML links to external objects, which can be exploited by a remote attacker to cause a denial of service. **Recommendations** For Apache Tika versions 0.1 through 1.18, consider configuring the XML parsers to limit entity expansion as a temporary workaround to mitigate the risk of a denial of service attack. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Jamroom versions prior to 4.1.9 **Description** A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the `post id` parameter in a modify action in the "forum.php" file. **Recommendations** For versions prior to 4.1.9, update to version 4.1.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the modify action in "forum.php" to minimize the risk of exploitation. Avoid using the `post id` parameter in the affected API endpoint until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Oracle Portal versions prior to 10g Description: The issue allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the `enc` parameter in the `/webapp/jsp/calendar.jsp` endpoint. Recommendations: For Oracle Portal versions prior to 10g, update to a version that is not affected by this issue to prevent HTTP response splitting attacks.