Georg Ph E Heise

**Name of the Vulnerable Software and Affected Versions** Programi Bilanc Build 007 Release 014 31.01.2020 **Description** The issue concerns hardcoded credentials in a .exe file supplied by Programi Bilanc, allowing remote attackers to gain access to the complete infrastructure, including the website, update server, and external issue tracking tools. This access could potentially lead to significant security breaches. **Recommendations** For Programi Bilanc Build 007 Release 014 31.01.2020, consider removing or securely storing the hardcoded credentials in the .exe file to prevent unauthorized access. As a temporary workaround, restrict access to the servers and infrastructure that use these credentials until a secure update is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Programi Bilanc versions build 007 release 014 31.01.2020 and below **Description** An issue was discovered where software-update packages are downloaded via cleartext HTTP, which may expose the updates to interception or tampering. **Recommendations** For versions build 007 release 014 31.01.2020 and below, consider using a secure connection, such as HTTPS, for downloading software-update packages to prevent potential interception or tampering. As a temporary workaround, restrict access to the update mechanism until a secure update process is implemented.

**Name of the Vulnerable Software and Affected Versions** Programi Bilanc - Build 007 Release 014 31.01.2020 **Description** An issue was discovered in Programi, which has multiple SQL injection vulnerabilities. **Recommendations** For Programi Bilanc - Build 007 Release 014 31.01.2020, consider restricting access to sensitive database queries to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Programi Bilanc versions prior to build 007 release 014 31.01.2020 **Description** An issue was discovered that relies on broken encryption with a weak and guessable static encryption key. **Recommendations** For versions prior to build 007 release 014 31.01.2020, consider updating to a newer version that addresses the broken encryption issue. As a temporary workaround, restrict access to sensitive data that may be encrypted with the weak key until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Programi Bilanc build 007 release 014 31.01.2020 and possibly below **Description** An issue was discovered in Programi Bilanc where it sets up administrative access by default with the account `admin` and password `0000` during installation. After the installation, users/admins are not prompted to change this password. **Recommendations** For Programi Bilanc build 007 release 014 31.01.2020 and possibly below, consider changing the default administrative password `0000` to a strong password after installation to prevent unauthorized access. As a temporary workaround, restrict access to the administrative account `admin` until a more secure configuration can be implemented. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Matrix42 Workspace Management versions 9.1.2.2765 and below **Description** The issue concerns the Search parameter in the Software Catalogue section, which accepts unfiltered parameters. This leads to multiple reflected XSS issues. **Recommendations** For versions 9.1.2.2765 and below, consider restricting access to the Search parameter in the Software Catalogue section until a patch is available. As a temporary workaround, avoid using unfiltered parameters in the Search function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Matrix42 Workspace Management versions 9.1.2.2765 and below **Description** The issue allows stored XSS via unfiltered description parameters, as demonstrated by the comment field of a special order for individual software. This can be exploited through the `description` parameter in the comment field. **Recommendations** For Matrix42 Workspace Management versions 9.1.2.2765 and below, consider disabling the comment field for special orders until a patch is available to prevent exploitation of the stored XSS vulnerability. Restrict access to the description parameters to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Intland codeBeamer ALM versions 9.5 and earlier **Description** The issue is related to stored XSS via the `Trackers Title` parameter. This allows for malicious code to be stored and executed when a user views the affected page. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** For Intland codeBeamer ALM versions 9.5 and earlier, update to a version later than 9.5 to resolve the issue. As a temporary workaround, consider restricting access to the `Trackers Title` parameter to minimize the risk of exploitation.