Mattia Furlani

**Name of the Vulnerable Software and Affected Versions** Agenzia delle Entrate Desktop Telematico version 1.0.0 **Description** The issue allows man-in-the-middle attackers to spoof product updates because it contacts the jws.agenziaentrate.it server over cleartext HTTP. **Recommendations** For version 1.0.0, consider disabling the cleartext HTTP connection to the jws.agenziaentrate.it server as a temporary workaround until a patch is available. Restrict access to the server to minimize the risk of exploitation. Avoid using the cleartext HTTP protocol for product updates until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** VirtueMart versions prior to 3.2.14 **Description** A cross-site scripting (XSS) issue was found. The textareas in the backend of the plugin are vulnerable to this issue. By adding `</textarea>` to the value and saving the product/config, an attacker can execute arbitrary code when the product/config is edited again, potentially leading to XSS attacks. **Recommendations** For versions prior to 3.2.14, update to version 3.2.14 or later to resolve the issue. As a temporary workaround, consider restricting access to the backend of the plugin to minimize the risk of exploitation. Avoid using the textareas in the backend until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** EasyDiscuss extension versions prior to 4.0.21 **Description** The issue allows for XSS. **Recommendations** For versions prior to 4.0.21, update to version 4.0.21 or later to resolve the issue.