Ilyass-Armadin

**Name of the Vulnerable Software and Affected Versions** Cleo Harmony versions prior to 5.8.1.11 **Description** An issue exists in the SAML Authentication component where manipulation of the `Email` argument within the `LocalUserUtil.getNativeUserByAssertions()` function allows for improper authentication. This flaw can be exploited remotely. **Recommendations** Update to version 5.8.1.11. Upgrade the SAML Authentication component.

**Name of the Vulnerable Software and Affected Versions** Cleo Harmony versions 5.8.1.0 through 5.8.1.10 **Description** An issue exists in the JWT (JSON Web Token) refresh token handler within the `/api/connections` endpoint. A remote attacker can manipulate the `Bearer` argument in HTTP headers to bypass authorization controls and achieve improper privilege management, potentially escalating their privileges to administrative levels. This flaw allows unauthorized access to protected functionality and integrated external systems. The vulnerability has been reproduced by researchers, and an exploit is publicly available. **Recommendations** Upgrade Cleo Harmony to version 5.8.1.11. Restrict access to the `/api/connections` endpoint to trusted networks to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ERPNext versions prior to 15.104.3 ERPNext versions prior to 16.12.0 **Description** An improper restriction of XML external entity (XXE) reference in the EDI Module allows an authenticated attacker to read files from the local file system, including sensitive configuration files. XXE is a type of attack that occurs when an XML parser improperly processes external entity references within an XML document. **Recommendations** Update to version 15.104.3. Update to version 16.12.0.

**Name of the Vulnerable Software and Affected Versions** Exiftool versions prior to 13.54 **Description** Local code injection is possible through the manipulation of the `-ee` argument. The issue resides in the `Process mrld()` function within the `lib/Image/ExifTool/GM.pm` file, specifically affecting the JPEG, QuickTime, MOV, and MP4 components. **Recommendations** Upgrade to version 13.54.