Ilya Tsaturov

**Name of the Vulnerable Software and Affected Versions** Laravel Translation Manager versions prior to 0.6.8 **Description** The application is vulnerable to Cross-Site Scripting (XSS) attacks due to incorrect input validation and sanitization of user-input data. An attacker can inject arbitrary HTML code, including JavaScript scripts, into the page processed by the user's browser, allowing them to steal sensitive data, hijack user sessions, or conduct other malicious activities. Only authenticated users with access to the translation manager are impacted. **Recommendations** For versions prior to 0.6.8, update to version 0.6.8 to resolve the issue. As a temporary workaround, consider restricting access to the translation manager to minimize the risk of exploitation. Additionally, ensure that all user-input data is properly validated and sanitized to prevent malicious activities.

**Name of the Vulnerable Software and Affected Versions** FreeScout versions prior to 1.8.178 **Description** The issue is related to the deserialization of untrusted data due to insufficient validation, allowing arbitrary code execution. This occurs when a string with a serialized object is passed through the set function and deserialization happens when getting an option through the get method. **Recommendations** For versions prior to 1.8.178, update to version 1.8.178 to patch the vulnerability. As a temporary workaround, consider restricting access to the set and get methods to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** FreeScout versions prior to 1.8.178 **Description** The issue is related to insufficient validation of user input in the `php path` parameter, allowing code injection. This occurs because backticks characters and tabulation are not removed from user input. An administrator can create a translation for a language, which creates a folder in the file system. This folder's path can then be specified as `php path` in tools.php, leading to the execution of code in backticks. The file exists function is also used to check for the presence of such a file or folder in the file system. **Recommendations** For versions prior to 1.8.178, update to version 1.8.178 to resolve the issue. As a temporary workaround, consider restricting access to the `php path` parameter in tools.php to prevent code injection. Additionally, avoid using the `php path` parameter with untrusted input until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** FreeScout versions prior to 1.8.179 **Description** The issue concerns insufficient checking of files uploaded to the application, allowing files with `phtml` and `phar` extensions to be uploaded. This can lead to remote code execution if the Apache web server is used. **Recommendations** For versions prior to 1.8.179, update to version 1.8.179 to resolve the issue. As a temporary workaround, consider restricting file uploads or disabling the upload feature until the update is applied.

**Name of the Vulnerable Software and Affected Versions** FreeScout versions prior to 1.8.179 **Description** The issue concerns the lack of a check to ensure users can only disable notifications for mailboxes they already have access to. The code allows users to gain access to a mailbox by disabling or enabling notifications for it, even if they did not have access initially. **Recommendations** For versions prior to 1.8.179, update to version 1.8.179 to resolve the issue. As a temporary workaround, consider restricting access to the notification settings for mailboxes to minimize the risk of unauthorized access.

**Name of the Vulnerable Software and Affected Versions** FreeScout versions prior to 1.8.179 **Description** The issue allows users to view arbitrary messages from other mailboxes or conversations they do not have access to, due to a lack of checks when creating a conversation from a message in another conversation. The access restriction to conversations, implemented by the `show only assigned conversations` setting, is also not checked. **Recommendations** For versions prior to 1.8.179, update to version 1.8.179 to resolve the issue. As a temporary workaround, consider restricting access to conversations by carefully managing the `show only assigned conversations` setting until the update can be applied.

**Name of the Vulnerable Software and Affected Versions** FreeScout versions prior to 1.8.180 **Description** The application incorrectly checks user access rights for conversations. Users with `show only assigned conversations` enabled can assign themselves to an arbitrary conversation from the mailbox to which they have access, thereby bypassing the restriction on viewing conversations. **Recommendations** For versions prior to 1.8.180, update to version 1.8.180 to resolve the issue. As a temporary workaround, consider disabling the feature that allows users to assign themselves to conversations until the update is applied. Restrict access to the mailbox to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** FreeScout versions prior to 1.8.180 **Description** The system does not provide a check on which clients an authorized user can view and edit. As a result, an authorized user without access to existing mailboxes or conversations can view and edit the system's clients. The limitation of client visibility can be implemented by the `limit user customer visibility` setting, but there is no check for the presence of this setting in certain scenarios. **Recommendations** For versions prior to 1.8.180, update to version 1.8.180 to resolve the issue. As a temporary workaround, consider implementing the `limit user customer visibility` setting to restrict client visibility. Restrict access to client editing features to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** FreeScout versions prior to 1.8.180 **Description** The application's logic allows access to a functional capability without correctly completing one or more actions in the required sequence. This issue leaves the attributes of the Mailbox object able to be changed by the `fill` method. **Recommendations** For versions prior to 1.8.180, update to version 1.8.180 to resolve the issue. As a temporary workaround, consider restricting access to the Mailbox object's attributes to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** FreeScout versions prior to 1.8.180 **Description** The issue is related to insufficient input validation during user creation, resulting in a mass assignment vulnerability. This vulnerability allows an attacker to manipulate all fields of the object, which are enumerated in the `$fillable` array (the User object), when creating a new user. **Recommendations** For versions prior to 1.8.180, update to version 1.8.180 to resolve the issue. As a temporary workaround, consider restricting access to user creation functionality until the update is applied.

**Name of the Vulnerable Software and Affected Versions** FreeScout versions prior to 1.8.180 **Description** The issue concerns the laravel-translation-manager package in FreeScout, which does not correctly validate user input. This enables the deletion of any directory, given sufficient access rights. **Recommendations** For versions prior to 1.8.180, update to version 1.8.180 to patch the vulnerability in the laravel-translation-manager package. As a temporary workaround, consider restricting access rights to minimize the risk of unauthorized directory deletion.

**Name of the Vulnerable Software and Affected Versions** FreeScout versions prior to 1.8.178 **Description** The issue is related to insufficient validation of user-supplied data, which is used as arguments to string formatting functions. This allows an attacker to pass a string containing special symbols (`r`, ` `, `t`) to the application. The estimated number of potentially affected devices worldwide is not provided. There is no information about real-world incidents where this issue was exploited. **Recommendations** For versions prior to 1.8.178, update to version 1.8.178 to resolve the issue. As a temporary workaround, consider restricting the input of special symbols (`r`, ` `, `t`) to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** FreeScout versions prior to 1.8.180 **Description** The issue allows an attacker with an unactivated email invitation containing the `invite hash` to self-activate their account, even if it is blocked or deleted. This is achieved by leveraging the invitation link from the email to gain initial access to the account. **Recommendations** For versions prior to 1.8.180, update to version 1.8.180 to resolve the issue. As a temporary workaround, consider restricting access to the invitation link from unactivated email invitations until the update is applied.

**Name of the Vulnerable Software and Affected Versions** FreeScout versions prior to 1.8.180 **Description** The issue is related to a mass assignment vulnerability in the Customer object, which is updated using the `fill()` method. This method processes fields such as `channel` and `channel id`, but it is called with all client-provided data, including unexpected values for these fields, leading to the vulnerability. **Recommendations** For versions prior to 1.8.180, update to version 1.8.180 to resolve the issue. As a temporary workaround, consider restricting the use of the `fill()` method to prevent mass assignment until the patch is applied. Avoid using unexpected values for `channel` and `channel id` in the affected object until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** FreeScout versions prior to 1.8.180 **Description** The issue is related to Cross-Site Scripting (XSS) attacks due to incorrect input validation and sanitization of user-input data during mail signature sanitization. An attacker can inject arbitrary HTML code, including JavaScript scripts, into the page processed by the user's browser, allowing them to steal sensitive data, hijack user sessions, or conduct other malicious activities. Additionally, if an administrator accesses one of these emails with a modified signature, it could result in a subsequent Cross-Site Request Forgery (CSRF) vulnerability. **Recommendations** For versions prior to 1.8.180, update to version 1.8.180 to resolve the issue. As a temporary workaround, consider restricting access to mail signatures or disabling the feature that allows users to modify their signatures until the update is applied. Avoid using the application's mail signature feature with untrusted input until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** FreeScout versions prior to 1.8.178 **Description** The issue is related to Cross-Site Scripting (XSS) attacks due to incorrect input validation and sanitization of user-input data in the conversation POST data body. **Recommendations** For versions prior to 1.8.178, update to version 1.8.178 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** FreeScout versions prior to 1.8.180 **Description** The issue is caused by a lack of input validation and sanitization in both `Session::flash` and other areas, allowing user input to be executed without proper filtering. This results in a cross-site scripting (XSS) issue. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. **Recommendations** For versions prior to 1.8.180, update to version 1.8.180 to resolve the issue. As a temporary workaround, consider disabling the `Session::flash` function until a patch is available. Restrict access to areas where user input is not properly sanitized to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** FreeScout versions prior to 1.8.180 **Description** FreeScout is a free self-hosted help desk and shared mailbox. The issue arises when creating a translation of a phrase that appears in a flash-message after a completed action, allowing the injection of a payload to exploit an XSS vulnerability. This problem has been corrected in version 1.8.180. **Recommendations** For versions prior to 1.8.180, update to version 1.8.180 to resolve the issue. As a temporary workaround, consider restricting access to the translation feature for creating phrases that appear in flash-messages to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** FreeScout versions prior to 1.8.180 **Description** The issue is related to Cross-Site Scripting (XSS) attacks due to insufficient data validation and sanitization during data reception. This allows attackers to execute malicious scripts on the application. The problem has been patched in version 1.8.180. **Recommendations** For versions prior to 1.8.180, update to version 1.8.180 to resolve the issue. As a temporary workaround, consider implementing additional data validation and sanitization measures to minimize the risk of exploitation. Restrict access to sensitive areas of the application until the update is applied.

**Name of the Vulnerable Software and Affected Versions** FreeScout versions prior to 1.8.180 **Description** The issue allows an attacker to upload an HTML file containing malicious JavaScript code to the server, resulting in a Cross-Site Scripting (XSS) vulnerability. This occurs when the .htaccess file is deleted prior to version 1.8.180. **Recommendations** For versions prior to 1.8.180, update to version 1.8.180 to resolve the issue. As a temporary workaround, consider restricting access to the server to prevent malicious file uploads until the update is applied. Additionally, avoid deleting the .htaccess file to minimize the risk of exploitation.