Manuel Sommer

**Name of the Vulnerable Software and Affected Versions** Eclipse Ditto versions 3.0.0 through 3.5.5 **Description** The user input of several input fields of the Eclipse Ditto Explorer User Interface was not properly neutralized, making it vulnerable to both Reflected and Stored XSS (Cross Site Scripting). Several inputs were not persisted at the backend of Eclipse Ditto, but only in local browser storage, resulting in a Reflected XSS vulnerability. However, several other inputs were persisted at the backend of Eclipse Ditto, leading to a Stored XSS vulnerability. This means that authenticated and authorized users at Eclipse Ditto can persist Things in Ditto, which can cause scripts to be executed in the browser of other users when being displayed. **Recommendations** For Eclipse Ditto versions 3.0.0 through 3.5.5, update to a version that properly neutralizes user input to prevent Reflected and Stored XSS vulnerabilities. As a temporary workaround, consider restricting access to the Eclipse Ditto Explorer User Interface to minimize the risk of exploitation. Avoid using the vulnerable input fields in the Eclipse Ditto Explorer User Interface until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Checkmk versions 1.6.0p27 and earlier Checkmk versions 2.0.0p19 and earlier **Description** The issue arises from the title of a Predefined condition not being properly escaped when shown as a condition, which can result in Cross Site Scripting (XSS). **Recommendations** For Checkmk versions 1.6.0p27 and earlier, update to version 1.6.0p28 to resolve the issue. For Checkmk versions 2.0.0p19 and earlier, update to version 2.0.0p20 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Checkmk versions 1.6.0p27 and earlier Checkmk versions 2.0.0p19 and earlier **Description** The issue is related to a Cross Site Scripting (XSS) vulnerability. It occurs because the Alias of a site is not properly escaped when shown as a condition for notifications. **Recommendations** For Checkmk versions 1.6.0p27 and earlier, update to version 1.6.0p28 or later. For Checkmk versions 2.0.0p19 and earlier, update to version 2.0.0p20 or later.