David Sopas

**Name of the Vulnerable Software and Affected Versions** PrestaShop versions prior to 1.5.2 **Description** The issue allows for cross-site scripting (XSS) attacks via the `<object data='data:text/html` substring in the message field. This enables potential attackers to inject malicious scripts into the website. **Recommendations** For PrestaShop versions prior to 1.5.2, update to version 1.5.2 or later to resolve the issue. As a temporary workaround, consider restricting user input in the message field to prevent the injection of malicious scripts.

Name of the Vulnerable Software and Affected Versions: PrestaShop version 1.5.5 Description: The issue concerns a privilege escalation vulnerability via a Salesman account using the upload module. Recommendations: For PrestaShop version 1.5.5, consider restricting access to the upload module for Salesman accounts until a fix is available.

Name of the Vulnerable Software and Affected Versions: PrestaShop versions prior to 1.4.11 Description: The issue allows for logout CSRF. Recommendations: For versions prior to 1.4.11, update to version 1.4.11 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: PrestaShop versions prior to 1.4.11 Description: The issue allows low-level profiles, such as Logistician and translators, to inject a persistent XSS vector on TinyMCE. Recommendations: For versions prior to 1.4.11, update to version 1.4.11 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: PrestaShop version 1.5.5 Description: The issue allows remote authenticated attackers to execute arbitrary code. This is achieved by uploading a crafted profile and then accessing it in the module/ directory. Recommendations: For PrestaShop version 1.5.5, consider restricting access to the module/ directory to prevent exploitation until a fix is available.

**Name of the Vulnerable Software and Affected Versions** com komento versions prior to 2.0.5 **Description** The issue allows remote attackers to inject arbitrary web script or HTML via the `img` or `url` tag of a new comment, potentially leading to cross-site scripting (XSS) attacks. **Recommendations** For versions prior to 2.0.5, update to version 2.0.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Kohana versions prior to 3.3.6 **Description** A cross-site scripting (XSS) issue exists in the Security component, allowing remote attackers to inject arbitrary web script or HTML by bypassing the `strip image tags` protection mechanism in `system/classes/Kohana/Security.php`. This could potentially affect a significant number of devices, although the exact number is not specified. **Recommendations** For versions prior to 3.3.6, update to version 3.3.6 or later to resolve the issue. As a temporary workaround, consider disabling the `strip image tags` function in `system/classes/Kohana/Security.php` until a patch is available. Restrict access to the Security component to minimize the risk of exploitation. Avoid using the `system/classes/Kohana/Security.php` file in sensitive operations until the issue is resolved.