Chapman Schleiss

**Name of the Vulnerable Software and Affected Versions** Uniview NVR301-04S2-P4 **Description** The issue is related to a reflected cross-site scripting attack (XSS), where an attacker could send a user a URL that, if clicked, could execute malicious JavaScript in their browser. This issue requires authentication before it can be exploited, limiting its scope and severity. Even if JavaScript is executed, no additional benefits are obtained for the attacker. **Recommendations** For Uniview NVR301-04S2-P4, consider disabling access to potentially vulnerable API endpoints until a patch is available. Restrict access to sensitive areas of the application that may be susceptible to XSS attacks. Avoid using links from untrusted sources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CRK Business Platform versions <= 2019.1 **Description** The issue allows reflected XSS via the erro.aspx page, specifically through the `CRK`, `IDContratante`, `Erro`, or `Mod` parameters. This vulnerability is path-independent. **Recommendations** For CRK Business Platform versions <= 2019.1, consider restricting access to the erro.aspx page or disabling the `CRK`, `IDContratante`, `Erro`, and `Mod` parameters to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Concrete5 versions prior to 8.3.0 Description: An issue was discovered in tools/conversations/view ajax.php. An unauthenticated user can enumerate comments from all blog posts by POSTing requests to "/index.php/tools/required/conversations/view ajax" with incremental `cnvID` integers. Recommendations: For versions prior to 8.3.0, update to version 8.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/index.php/tools/required/conversations/view ajax" endpoint to prevent unauthorized comment enumeration.