Marcus Nilsson

**Name of the Vulnerable Software and Affected Versions** Logpoint versions prior to 7.1.0 **Description** The issue allows Self-XSS on the LDAP authentication page via the `username` to the LDAP login form. **Recommendations** For versions prior to 7.1.0, update to version 7.1.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the LDAP login form to minimize the risk of exploitation. Avoid using malicious usernames in the affected form until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 **Description** The issue allows remote attackers to obtain sensitive information via the `User Profile` field. This is a CSV Injection vulnerability, which can be exploited by attackers to gain access to sensitive data. **Recommendations** For Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6, consider restricting access to the `User Profile` field until a patch is available. As a temporary workaround, avoid using the `User Profile` field in remote interactions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 **Description** An issue in Sesami Cash Point & Transport Optimizer (CPTO) allows local attackers to obtain sensitive information and bypass authentication via a "Back Button Refresh" attack. **Recommendations** For Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 **Description** An issue was discovered that allows remote attackers to obtain sensitive information and bypass profile restriction via improper access control in the Reader system user's web browser, allowing the journal to be displayed, despite the option being disabled. **Recommendations** For Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6, consider disabling the Reader system user's web browser access to the journal as a temporary workaround until a patch is available. Restrict access to the journal to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 **Description** The issue allows remote attackers to obtain sensitive information via the `Delivery Name` field. This is a result of a CSV Injection vulnerability. **Recommendations** For Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6, consider restricting access to the `Delivery Name` field until a patch is available. As a temporary workaround, avoid using the `Delivery Name` field in sensitive operations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 **Description** The issue allows attackers to obtain sensitive information via the `User Name` field. This is a CSV Injection vulnerability, which can be exploited to gain unauthorized access to data. **Recommendations** For Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6, consider restricting access to the `User Name` field until a patch is available. As a temporary workaround, avoid using the `User Name` field in sensitive operations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 **Description** The issue allows remote attackers to execute arbitrary code and obtain sensitive information via the `User ID` field when creating a new system user. This is a Cross Site Scripting (XSS) vulnerability. **Recommendations** For Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6, consider disabling the creation of new system users until a patch is available to prevent exploitation via the `User ID` field. Avoid using the `User ID` field in the affected functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 **Description** The issue allows remote attackers to execute arbitrary code via the `Barcode` field of a container. This is a Cross Site Scripting (XSS) vulnerability. **Recommendations** For Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6, consider disabling the `Barcode` field functionality until a patch is available to prevent exploitation. Restrict access to the container's `Barcode` field to minimize the risk of arbitrary code execution. Avoid using the `Barcode` field in the affected container until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 **Description** An issue in Sesami Cash Point & Transport Optimizer (CPTO) allows remote attackers to obtain sensitive information via transmission of unencrypted, cleartext credentials during the Password Reset feature. **Recommendations** For version 6.3.8.6, consider disabling the Password Reset feature until a patch is available to prevent the transmission of unencrypted credentials. Restrict access to sensitive information to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 **Description** The issue allows remote attackers to execute arbitrary code and obtain sensitive information via the `Username` field of the login form and application log. This is a Stored Cross Site Scripting (XSS) issue. **Recommendations** For Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6, consider disabling the login form's `Username` field until a patch is available to prevent exploitation. Restrict access to the application log to minimize the risk of sensitive information disclosure. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 **Description** A Cross Site Scripting (XSS) issue allows remote attackers to execute arbitrary code via the `Teller` field. This enables attackers to inject malicious scripts into the website, potentially leading to unauthorized actions. **Recommendations** For Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6, consider disabling the `Teller` field functionality until a patch is available to prevent exploitation. Additionally, restrict access to sensitive areas of the application to minimize the risk of arbitrary code execution.

**Name of the Vulnerable Software and Affected Versions** SESAMI planfocus CPTO (Cash Point & Transport Optimizer) version 6.3.8.6 718 **Description** An issue was discovered in the software, allowing for XSS via the `Name` field when modifying a client. **Recommendations** For SESAMI planfocus CPTO (Cash Point & Transport Optimizer) version 6.3.8.6 718, consider restricting input to the `Name` field to prevent XSS attacks until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Keycloak (affected versions not specified) **Description** A flaw was found in the "execute-actions-email" endpoint of Keycloak, allowing arbitrary HTML to be injected into emails sent to Keycloak users. This issue can be misused to perform phishing or other attacks against users, essentially conducting a cross-site scripting (XSS) attack. The flaw is related to inadequate protection measures of the web page structure. **Recommendations** As a temporary workaround, consider disabling the `execute-actions-email` endpoint until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using this endpoint to send emails containing potentially malicious content until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Gophish versions prior to 0.11.0 **Description** The issue allows attackers to cause a denial of service via a clickjacking attack, specifically targeting the Reset button on the Account Settings page. **Recommendations** For versions prior to 0.11.0, update to version 0.11.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Account Settings page to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Gophish versions prior to 0.11.0 **Description** The issue is related to a Cross Site Scripting (XSS) vulnerability. It occurs via the IMAP Host field on the account settings page. **Recommendations** For versions prior to 0.11.0, update to version 0.11.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the IMAP Host field on the account settings page until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Gophish versions prior to 0.10.2 **Description** The issue arises because Gophish does not invalidate the `gophish` cookie when a user logs out. This could potentially allow unauthorized access. **Recommendations** For versions prior to 0.10.2, update to version 0.10.2 or later to ensure the `gophish` cookie is properly invalidated upon logout.

**Name of the Vulnerable Software and Affected Versions** Gophish versions prior to 0.11.0 **Description** The issue is related to a Cross Site Scripting (XSS) vulnerability. It occurs via the Host field on the send profile form. **Recommendations** For versions prior to 0.11.0, update to version 0.11.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Host field on the send profile form until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Gophish versions prior to 0.10.2 **Description** A Cross Site Scripting (XSS) issue exists, allowing for the execution of malicious scripts via a crafted landing page or email template. **Recommendations** For versions prior to 0.10.2, update to version 0.10.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Gophish versions prior to 0.11.0 **Description** The issue allows the creation of CSV sheets that contain malicious content. **Recommendations** For versions prior to 0.11.0, update to version 0.11.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Gophish versions prior to 0.11.0 **Description** The issue allows for Server-Side Request Forgery (SSRF) attacks. This means an attacker can potentially force the server to make unauthorized requests, leading to various security issues. **Recommendations** For versions prior to 0.11.0, update to version 0.11.0 or later to resolve the issue.