Brpsd

**Name of the Vulnerable Software and Affected Versions** Welcart e-Commerce versions prior to 2.12.1 **Description** This issue occurs because the software fails to regenerate the session identifier during authentication and accepts a session identifier provided via a user-supplied request parameter. This allows an unauthenticated attacker to perform session fixation, which involves pre-setting a user's session ID, enabling the attacker to take over a customer account once the victim authenticates through a specially crafted request. The vulnerable parameter is `uscesid`. **Recommendations** Update to version 2.12.1 or later.

**Name of the Vulnerable Software and Affected Versions** RegistrationMagic WordPress plugin versions prior to 6.0.7.2 **Description** The RegistrationMagic WordPress plugin does not have sufficient capability checks. This allows users with subscriber privileges or higher to create forms on the site. **Recommendations** Update the RegistrationMagic WordPress plugin to version 6.0.7.2 or later.

**Name of the Vulnerable Software and Affected Versions** RegistrationMagic WordPress plugin versions prior to 6.0.7.2 **Description** The RegistrationMagic WordPress plugin does not properly validate capabilities when checking nonces, which can lead to the disclosure of sensitive data to users with subscriber-level access or higher. **Recommendations** Update RegistrationMagic WordPress plugin to version 6.0.7.2 or later.

**Name of the Vulnerable Software and Affected Versions** HelloWeb version 2.0 **Description** The software contains an arbitrary file download issue that enables remote attackers to download system files. This is achieved by manipulating the `filepath` and `filename` parameters within crafted GET requests sent to the ''download.asp'' endpoint. Attackers can leverage directory traversal techniques to access sensitive configuration and system files. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Timetable and Event Schedule by MotoPress WordPress plugin versions prior to 2.4.16 **Description** The Timetable and Event Schedule by MotoPress WordPress plugin does not properly verify user access to specific events during the duplication process. This can lead to unauthorized disclosure of event information to users with a Contributor role or higher. The issue allows arbitrary event disclosure. **Recommendations** Update the Timetable and Event Schedule by MotoPress WordPress plugin to version 2.4.16 or later.

**Name of the Vulnerable Software and Affected Versions** Cargotec Navis WebAccess versions prior to 2016-08-10 **Description** A SQL injection issue exists in the news pages of the software, allowing remote attackers to execute arbitrary SQL commands. The exact vectors used for the attack are not specified. **Recommendations** For versions prior to 2016-08-10, update to a version released after 2016-08-10 to resolve the issue.