Charalampos Maraziaris

**Name of the Vulnerable Software and Affected Versions** Squidex versions prior to 7.9.0 **Description** The issue allows for XSS via an SVG document to the Upload Assets feature. This occurs because there is an incomplete blacklist in the SVG inspection, allowing JavaScript in the `SRC` attribute of an `IFRAME` element. An authenticated attack with `assets.create` permission is required for exploitation. **Recommendations** For versions prior to 7.9.0, update to version 7.9.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Upload Assets feature or disabling the SVG inspection to minimize the risk of exploitation. Restrict access to the `assets.create` permission to prevent authenticated attacks.

**Name of the Vulnerable Software and Affected Versions** Snipe-IT versions prior to 6.0.14 **Description** The issue is related to Cross Site Scripting (XSS) for View Assigned Assets. This means an attacker could potentially inject malicious scripts into the website, which would then be executed by the user's browser. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** For versions prior to 6.0.14, update to version 6.0.14 or later to resolve the issue. As a temporary workaround, consider restricting access to the View Assigned Assets feature until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Snipe-IT versions 6.0.14 and earlier **Description** The issue allows attackers to determine whether a user account exists due to variations in responses to a "/password/reset" request. This can be exploited by analyzing the different responses received from the system. **Recommendations** For Snipe-IT versions 6.0.14 and earlier, as a temporary workaround, consider restricting access to the "/password/reset" endpoint until a patch is available. Additionally, monitor user account activity closely to detect any potential exploitation attempts. At the moment, there is no information about a newer version that contains a fix for this vulnerability.