Fenglin-1

**Name of the Vulnerable Software and Affected Versions** Ganglia-web versions 3.73 through 3.76 **Description** A cross-site scripting (XSS) issue exists in the /master/header.php component, allowing attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `tz` parameter. This enables attackers to potentially manipulate the web application's behavior. **Recommendations** For Ganglia-web versions 3.73 through 3.76, as a temporary workaround, consider restricting access to the vulnerable /master/header.php component until a patch is available. Avoid using the `tz` parameter in the affected component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Ganglia-web versions 3.73 through 3.75 **Description** A cross-site scripting (XSS) issue exists in the /graph all periods.php component, allowing attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `g` parameter. This enables attackers to potentially manipulate the web application's behavior. **Recommendations** For Ganglia-web versions 3.73 through 3.75, as a temporary workaround, consider restricting access to the /graph all periods.php component until a patch is available. Avoid using the `g` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.