Dr. Adrian Vollmer

**Name of the Vulnerable Software and Affected Versions** Simplessus version 3.7.7 **Description** A critical issue affects the Cookie Handler component, where manipulation of the `UWA SID` argument leads to sql injection. This can be initiated remotely. The issue has been publicly disclosed and may be exploited. **Recommendations** For Simplessus version 3.7.7, upgrade to version 3.8.3 to address this issue. As a temporary workaround, consider restricting access to the Cookie Handler component until the upgrade is applied.

**Name of the Vulnerable Software and Affected Versions** Simplessus versions 3.7.7 **Description** A critical issue affects some unknown processing in the software. The manipulation of the `path` argument with a specific input leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed publicly. **Recommendations** For Simplessus version 3.7.7, upgrade to version 3.8.3 to address this issue. As a temporary workaround, consider restricting access to the vulnerable component until the upgrade is applied.

**Name of the Vulnerable Software and Affected Versions** OpenText Secure MFT versions 2013 before 2013 R3 P6 OpenText Secure MFT versions 2014 before 2014 R2 P2 **Description** A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `querytext` parameter to the "userdashboard.jsp" endpoint. **Recommendations** For OpenText Secure MFT versions 2013 before 2013 R3 P6, update to version 2013 R3 P6 or later. For OpenText Secure MFT versions 2014 before 2014 R2 P2, update to version 2014 R2 P2 or later.