Jakob Hagl

**Name of the Vulnerable Software and Affected Versions** Suprema BioStar 2 version 2.9.11.6 **Description** BioStar 2 version 2.9.11.6 allows users to set a new password without providing the current password. Exploiting this flaw, in combination with other vulnerabilities, can lead to unauthorized account access and potential system compromise. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MOKOSmart MKGW1 BLE Gateway versions 1.1.1 and before **Description** An issue in the session management component of the administrative web interface allows a remote attacker to escalate privileges. **Recommendations** For versions 1.1.1 and before, consider restricting access to the administrative web interface until a fix is available. As a temporary workaround, consider disabling the session management component of the administrative web interface until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Easy FancyBox versions prior to 1.8.18 **Description** The issue arises from improper encoding of arbitrarily submitted settings parameters in the Settings Menu, specifically in the inc/class-easyfancybox.php file. This leads to Stored XSS due to the lack of an inline styles output filter. **Recommendations** For versions prior to 1.8.18, update to version 1.8.18 or later to resolve the issue. As a temporary workaround, consider restricting access to the settings menu to minimize the risk of exploitation.