Emanuele Barbeno

**Name of the Vulnerable Software and Affected Versions** Power BI Report Server (affected versions not specified) **Description** The issue is related to errors in the user interface's representation of information. It involves a Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability that occurs when a Power BI Report Server Template file (pbix) containing HTML files is uploaded to the server and the HTML files are accessed directly by the victim. This allows an attacker to upload malicious Power BI template files to the server using the victim's session, run scripts in the security context of the user, and potentially perform privilege escalation if the victim has admin privileges. The security update addresses the issue by ensuring that Power BI Report Server properly sanitizes file uploads. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Intland codeBeamer ALM versions 10.x through 10.1.SP4 Description: An issue with insufficiently protected credentials was found. The `CB LOGIN` remember-me cookie contains encrypted user credentials, but due to a bug, these credentials are encrypted using a NULL encryption key. Recommendations: For versions 10.x through 10.1.SP4, consider disabling the use of the remember-me cookie feature until a patch is available. Restrict access to sensitive areas of the application to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Intland codeBeamer ALM versions 10.x through 10.1.SP4 Description: A cross-site scripting (XSS) issue was discovered. It is possible to perform XSS attacks through using the WebDAV functionality to upload files to a project, using the users import functionality, and changing the login text in the application configuration. Recommendations: For versions 10.x through 10.1.SP4, consider disabling the WebDAV functionality, restricting the use of the users import functionality to necessary admin tasks, and avoiding changes to the login text in the application configuration until a patch is available.

Name of the Vulnerable Software and Affected Versions: Pi-hole core version 5.2.4 Description: Multiple privilege escalation issues were discovered in Pi-hole core. Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Recommendations: For version 5.2.4, update to a newer version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Perforce Helix ALM version 2020.3.1 Build 22 Description: The XML Import functionality of the Administration console in Perforce Helix ALM is vulnerable to XXE attacks due to insecurely configured software components that parse XML input data. Recommendations: For Perforce Helix ALM version 2020.3.1 Build 22, consider disabling the XML Import functionality in the Administration console until a patch is available to prevent potential XXE attacks.

**Name of the Vulnerable Software and Affected Versions** Intland codeBeamer ALM versions 10.x through 10.1.SP4 **Description** An issue was discovered in the way Intland codeBeamer ALM parses ReqIF XML data used for importing projects. The software components are insecurely configured, allowing for XML External Entity Attacks. **Recommendations** For versions 10.x through 10.1.SP4, consider disabling the import of ReqIF XML data until a patch is available to prevent potential XML External Entity Attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.