Mahendravarman

**Name of the Vulnerable Software and Affected Versions** tsi-coop tsi-dpdp-cms versions prior to 0.5.1 **Description** A flaw exists in the Admin Console/DPO Compliance Console component within the `web.xml` file. A remote attacker can perform a manipulation that results in missing authentication, allowing unauthorized access to the system. **Recommendations** Upgrade to version 0.5.1.

**Name of the Vulnerable Software and Affected Versions** tsi-coop tsi-dpdp-cms versions prior to 0.5.1 **Description** A flaw in the Bootstrap Setup Endpoint component, specifically within the `InterceptingFilter.java` file, allows remote attackers to bypass authentication. This manipulation leads to missing authentication, granting unauthorized access to the system. **Recommendations** Update tsi-coop tsi-dpdp-cms to version 0.5.1.

**Name of the Vulnerable Software and Affected Versions** tsi-coop tsi-dpdp-cms versions prior to 0.5.1 **Description** A security flaw involving improper neutralization of input during web page generation allows for remote attacks. This issue results in client-side enforcement of server-side security, meaning security checks are performed on the user's browser rather than the server, which can be bypassed by an attacker. **Recommendations** Upgrade to version 0.5.1.

**Name of the Vulnerable Software and Affected Versions** Webkul QloApps version 1.6.1 **Description** A problematic vulnerability was found in Webkul QloApps, affecting an unknown part of the file /stores of the component Your Location Search. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The issue is planned to be addressed by removing the affected page in the long term. **Recommendations** For Webkul QloApps version 1.6.1, consider restricting access to the /stores component of Your Location Search until a fix is available. As a temporary workaround, disabling the affected part of the Your Location Search component may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Webkul QloApps version 1.6.1 **Description** A problematic issue was found in Webkul QloApps, affecting the `logout` function of the `/en/?mylogout` file in the URL Handler component. This issue leads to cross-site request forgery and can be exploited remotely. The vendor is aware of the issue and is working on a resolution. **Recommendations** For Webkul QloApps version 1.6.1, consider disabling the `logout` function of the `/en/?mylogout` file in the URL Handler component as a temporary workaround until a patch is available. Restrict access to the vulnerable URL Handler component to minimize the risk of exploitation. Avoid using the affected `logout` functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.