Dawid

**Name of the Vulnerable Software and Affected Versions** CKEditor 4 LTS - WYSIWYG HTML editor versions 1.0.0 through 1.0.0 **Description** The issue is related to improper neutralization of input during web page generation, allowing Cross-Site Scripting (XSS). This enables attackers to inject malicious scripts into websites, potentially leading to unauthorized access or control. **Recommendations** For CKEditor 4 LTS - WYSIWYG HTML editor version 1.0.0, update to version 1.0.1 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** MISP versions prior to 2.4.158 **Description** An issue was discovered in the UsersController.php file, where password confirmation can be bypassed via vectors involving an "Accept: application/json" header. **Recommendations** For versions prior to 2.4.158, update to version 2.4.158 or later to resolve the issue. As a temporary workaround, consider restricting access to the UsersController.php file or disabling the password confirmation feature until a patch is available. Avoid using the `password` and `password confirmation` variables in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Cerebrate versions through 1.4 **Description** An issue was discovered where endpoints could be open even when not enabled. **Recommendations** For versions through 1.4, consider disabling endpoints that are not in use to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Cerebrate versions through 1.4 **Description** An issue was discovered that could lead to XSS in the bookmarks component. **Recommendations** For versions through 1.4, as a temporary workaround, consider disabling the bookmarks component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.