J. Greil

**Name of the Vulnerable Software and Affected Versions** Limesurvey versions prior to 3.17.14 **Description** The issue allows attackers to access a cookie value via a client-side script because Limesurvey uses an anti-CSRF cookie without the HttpOnly flag. **Recommendations** For versions prior to 3.17.14, update to version 3.17.14 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Limesurvey versions prior to 3.17.14 **Description** A clickjacking issue was discovered. **Recommendations** For versions prior to 3.17.14, update to version 3.17.14 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Limesurvey versions prior to 3.17.14 **Description** A stored cross-site scripting issue was discovered that allows authenticated users with the correct permissions to inject arbitrary web script or HTML via titles of admin box buttons on the home page. **Recommendations** For versions prior to 3.17.14, update to version 3.17.14 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Limesurvey versions prior to 3.17.14 **Description** The issue is related to the lack of enforcement of SSL/TLS usage in the default configuration. **Recommendations** For versions prior to 3.17.14, update to version 3.17.14 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Limesurvey versions prior to 3.17.14 **Description** The issue allows remote attackers to bruteforce the login form and enumerate usernames when the LDAP authentication method is used. **Recommendations** For versions prior to 3.17.14, update to version 3.17.14 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Limesurvey versions prior to 3.17.14 **Description** The issue allows admin users to mark other users' notifications as read. **Recommendations** For versions prior to 3.17.14, update to version 3.17.14 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Limesurvey versions prior to 3.17.14 **Description** A reflected cross-site scripting (XSS) issue was discovered, allowing remote attackers to inject arbitrary web script or HTML via extensions of uploaded files. **Recommendations** For versions prior to 3.17.14, update to version 3.17.14 or later to resolve the issue. As a temporary workaround, consider restricting the upload of files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Limesurvey versions prior to 3.17.14 **Description** The issue allows admin users to view, update, or delete reserved menu entries without having the proper permissions. **Recommendations** For versions prior to 3.17.14, update to version 3.17.14 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Limesurvey versions prior to 3.17.14 **Description** The issue allows admin users to access the plugin manager without having the proper permissions. **Recommendations** For versions prior to 3.17.14, update to version 3.17.14 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Typo3 versions 3.7, 3.8, 4.0.0 through 4.0.3, and 4.1 beta with the rtehtmlarea extension Description: The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in the `userUid` parameter to "rtehtmlarea/htmlarea/plugins/SpellChecker/spell-check-logic.php". Recommendations: For Typo3 versions 3.7, 3.8, 4.0.0 through 4.0.3, and 4.1 beta with the rtehtmlarea extension, avoid using the `userUid` parameter in the affected API endpoint until the issue is resolved. As a temporary workaround, consider restricting access to the rtehtmlarea extension to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.