Marios Nicolaides

**Name of the Vulnerable Software and Affected Versions** uWSGI versions prior to 2.0.17 **Description** The issue arises from the mishandling of a `DOCUMENT ROOT` check during the use of the `--php-docroot` option, allowing directory traversal. **Recommendations** For versions prior to 2.0.17, update to version 2.0.17 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Primavera P6 Enterprise Project Portfolio Management versions 8.3, 8.4, 15.1, 15.2, 16.1 **Description** The issue affects the Web Access component of Oracle Primavera Products Suite, allowing a low-privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. This can result in unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of accessible data. **Recommendations** For versions 8.3, 8.4, 15.1, 15.2, 16.1, update to a version that includes a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DotNetNuke (DNN) versions prior to 7.4.1 **Description** The issue allows remote attackers to reinstall the application and gain SuperUser access. This is achieved via a direct request to "Install/InstallWizard.aspx", which is an API endpoint. The estimated number of potentially affected devices and details about real-world incidents are not provided. **Recommendations** For versions prior to 7.4.1, update to version 7.4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the "Install/InstallWizard.aspx" endpoint until the update is applied.