Jr0Ch17

**Name of the Vulnerable Software and Affected Versions** IBM Aspera Shares versions 1.9.9 through 1.10.0 PL7 **Description** The issue allows a remote authenticated attacker to expose sensitive information or consume memory resources through an XML external entity injection (XXE) attack when processing XML data. **Recommendations** For versions 1.9.9 through 1.10.0 PL7, update to a version that includes a fix for the XML external entity injection issue to prevent XXE attacks.

Name of the Vulnerable Software and Affected Versions: IBM Aspera Shares versions 1.9.0 through 1.10.0 PL6 Description: This issue allows authenticated users to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to credentials disclosure within a trusted session. The vulnerability is related to stored cross-site scripting. Recommendations: For IBM Aspera Shares versions 1.9.0 through 1.10.0 PL6, consider disabling access to the Web UI until a patch is available to prevent exploitation of the stored cross-site scripting vulnerability. Restrict user input to minimize the risk of embedding arbitrary JavaScript code.

Name of the Vulnerable Software and Affected Versions: IBM Aspera Shares versions 1.9.0 through 1.10.0 PL6 Description: The issue allows an attacker to spoof their IP address, which is then written to log files, due to improper verification of `Client-IP` headers. Recommendations: For versions 1.9.0 through 1.10.0 PL6, consider implementing proper verification of `Client-IP` headers to prevent IP address spoofing. As a temporary workaround, restrict access to log files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Gotenberg versions through 6.2.1 **Description** A Server-Side Request Forgery (SSRF) issue exists in the remote URL to PDF conversion, allowing a remote attacker to read local files or fetch intranet resources. **Recommendations** For Gotenberg versions through 6.2.1, update to a version later than 6.2.1 to resolve the issue. As a temporary workaround, consider restricting access to the remote URL to PDF conversion feature until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Gotenberg versions through 6.2.1 **Description** The issue allows for the injection of HTML and/or JavaScript in the HTML to PDF conversion process. This is possible via the "http://localhost:3000/convert/html" endpoint. **Recommendations** For versions through 6.2.1, as a temporary workaround, consider restricting access to the /convert/html endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.