Mateusz Gierblinski

**Name of the Vulnerable Software and Affected Versions** ubuntu-pro-client (affected versions not specified) **Description** An insecure symlink following issue exists within the `pro collect-logs` command framework. The utility uses predictable temporary file paths or user-accessible log directories to gather diagnostic information without verifying file type or ownership. A local attacker can create a symbolic link (symlink)—a file that points to another file or directory—at a predictable path targeting root-readable files, such as `/etc/shadow`. When an administrator runs the `pro collect-logs` command, the tool follows the symlink and includes the contents of the target file in a diagnostic archive. Since the archive is readable by the unprivileged user, this leads to the disclosure of sensitive system secrets. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Automotive Car Dealership Business WordPress Theme versions prior to 13.4.2 **Description** The software is subject to Stored Cross-Site Scripting, a condition where malicious scripts are permanently stored on the target server. The issue exists in the 'Project Details' custom field within Portfolio Items due to insufficient input sanitization and output escaping of user-supplied attributes in the `project details` variable. Authenticated attackers with contributor-level permissions or higher can inject arbitrary web scripts that execute when a user accesses the affected page. **Recommendations** Update to a version later than 13.4.1. As a temporary workaround, restrict access to the `project details` custom field for users with contributor-level permissions.

**Name of the Vulnerable Software and Affected Versions** Automotive Car Dealership Business WordPress Theme for WordPress versions prior to 13.5 **Description** The software is susceptible to Stored Cross-Site Scripting through the 'Call to Action' custom fields. Insufficient input sanitization and output escaping on user-supplied attributes in the 'action text', 'action button text', 'action link', and 'action class' custom fields allow authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. **Recommendations** Update Automotive Car Dealership Business WordPress Theme for WordPress to version 13.5 or later.

Name of the Vulnerable Software and Affected Versions: Wibu CodeMeter versions prior to 8.30a Description: The issue allows for privilege escalation immediately after installation, before a logoff or reboot, under specific conditions. These conditions include an unprivileged installation with UAC and the presence of the CodeMeter Control Center component without it having been restarted. In this scenario, a local user can exploit the issue by navigating from Import License to a privileged instance of Windows Explorer, thus gaining elevated privileges. Recommendations: For versions prior to 8.30a, update to version 8.30a or later to resolve the issue. As a temporary workaround, consider restarting the CodeMeter Control Center component after installation to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** EspoCRM versions prior to 9.0.5 **Description** The issue concerns the Iframe dashlet in EspoCRM, which allows users to display iframes with arbitrary URLs. Since the sandbox attribute is not included in the iframe, a remote page can open popups outside of the iframe, potentially tricking users and creating a phishing risk. The iframe URL is user-defined, so an attacker would need to trick the user into specifying a malicious URL. The missing sandbox attribute also allows the remote page to send messages to the parent frame, although EspoCRM does not utilize these messages. **Recommendations** To resolve the issue, update to version 9.0.5 or later. As a temporary workaround, consider restricting the use of the Iframe dashlet to minimize the risk of exploitation. Avoid using the Iframe dashlet with untrusted URLs until the issue is resolved.