Luke-Published

**Name of the Vulnerable Software and Affected Versions** HumHub versions prior to 1.11.4 HumHub versions prior to 1.10.5 **Description** HumHub is an Open Source Enterprise Social Network. Affected versions of HumHub are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, the attacker would need permission to administer the Spaces feature. The names of individual "spaces" are not properly escaped, and so an attacker with sufficient privilege could insert malicious javascript into a space name and exploit system users who visit that space. **Recommendations** For versions prior to 1.11.4, upgrade to 1.11.4. For versions prior to 1.10.5, upgrade to 1.10.5. As a temporary workaround, consider restricting access to the Spaces feature until a patch is available. Avoid using the `space name` variable in the affected feature until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** HumHub versions prior to 1.11.0 HumHub versions prior to 1.10.4 HumHub versions prior to 1.9.4 **Description** The issue allows users who are forced to change their password by an administrator to retrieve other users' data. **Recommendations** For versions prior to 1.11.0, upgrade to 1.11.0. For versions prior to 1.10.4, upgrade to 1.10.4. For versions prior to 1.9.4, upgrade to 1.9.4.

Name of the Vulnerable Software and Affected Versions: HumHub versions prior to 1.10.3 HumHub versions prior to 1.9.3 Description: HumHub is an open-source social network kit written in PHP. Prior to certain versions, it could be possible for registered users to become unauthorized members of private Spaces. Recommendations: For versions prior to 1.10.3, update to version 1.10.3 to resolve the issue. For versions prior to 1.9.3, update to version 1.9.3 to resolve the issue.