Manuel Scala

**Name of the Vulnerable Software and Affected Versions** ZenShare Suite version 17.0 **Description** A reflected cross-site scripting (XSS) issue exists in the 'login newpwd.php' endpoint. This allows attackers to execute arbitrary Javascript in the user's browser by injecting a crafted URL into the `codice azienda` parameter. **Recommendations** Update ZenShare Suite to a version newer than 17.0. As a temporary mitigation, restrict access to the 'login newpwd.php' endpoint or avoid using the `codice azienda` parameter until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** ZenShare Suite version 17.0 **Description** Reflected cross-site scripting (XSS) occurs in the 'login.php' endpoint. This allows attackers to execute arbitrary Javascript within the user's browser by injecting a crafted URL into the `codice azienda` and `red url` parameters. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** eNMS versions 4.4.0 through 4.7.1 **Description** The issue is related to Directory Traversal via `edit file`. This allows unauthorized access to sensitive files and directories. **Recommendations** For versions 4.4.0 through 4.7.1, consider restricting access to the `edit file` functionality until a patch is available.

**Name of the Vulnerable Software and Affected Versions** eNMS versions 4.4.0 through 4.7.1 **Description** The issue is related to a Directory Traversal vulnerability in the `scan folder` feature. This vulnerability allows unauthorized access to sensitive files and directories. **Recommendations** For eNMS versions 4.4.0 through 4.7.1, consider disabling the `scan folder` feature until a patch is available to prevent potential exploitation. Restrict access to sensitive files and directories to minimize the risk of unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** eNMS versions up to 4.7.1 **Description** The issue is a Directory Traversal vulnerability, which occurs via the `download/folder` path. **Recommendations** For versions up to 4.7.1, consider restricting access to the `download/folder` path as a temporary workaround until a patch is available.