Miguel Segovia Gil

**Name of the Vulnerable Software and Affected Versions** Alkacon's OpenCMS version 16 **Description** Two Cross-Site Scripting issues have been discovered in Alkacon's OpenCMS, which could allow a user with sufficient privileges to create and modify web pages through the admin panel to execute malicious JavaScript code after inserting code in the `title` field. Another issue allows users with the roles of gallery editor or VFS resource manager to upload images in the .svg format containing JavaScript code, which will be executed when another user accesses the image. **Recommendations** For version 16, consider disabling the ability to insert code in the `title` field and restrict the upload of .svg images until a patch is available. Restrict access to the admin panel and limit the roles of gallery editor and VFS resource manager to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Gophish version 0.12.1 **Description** The issue is a Cross-Site Scripting stored vulnerability that could allow an attacker to store a malicious JavaScript payload in the campaign menu. This payload can be triggered when the campaign is removed from the menu. **Recommendations** For Gophish version 0.12.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Plone CMS versions prior to 6.0.5 **Description** A Cross-Frame Scripting issue has been found in Plone CMS. This issue allows an attacker to store a malicious URL that can be opened by an administrator, potentially leading to the execution of a malicious iframe element. **Recommendations** For versions prior to 6.0.5, update to version 6.0.5 or later to resolve the issue. As a temporary workaround, consider restricting access to areas where malicious URLs can be stored and executed, to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Alkacon Software Open CMS versions 14 through 15 of the 'Mercury' template **Description** A cross-site scripting (XSS) issue affects the software, allowing a remote attacker to send a specially crafted JavaScript payload to a victim, potentially taking partial control of their browsing session. **Recommendations** For versions 14 and 15 of the 'Mercury' template, consider disabling JavaScript execution from untrusted sources as a temporary workaround until a patch is available. Restrict access to sensitive areas of the application to minimize the risk of exploitation. Avoid using the application with the 'Mercury' template until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Open CMS versions 14 through 15 of the 'Mercury' template **Description** An open redirect vulnerability has been found in the Open CMS product. This issue allows an attacker to create a specially crafted URL and send it to a specific user, redirecting them to a malicious site and potentially compromising them. The exploitation of this vulnerability is possible due to the lack of proper sanitization of the `URI` parameter. **Recommendations** For versions 14 and 15 of the 'Mercury' template, consider disabling the functionality that uses the `URI` parameter until a patch is available. Restrict access to the affected 'Mercury' template to minimize the risk of exploitation. Avoid using the `URI` parameter in affected URLs until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apache Superset versions prior to 2.1.2 **Description** The issue allows authenticated users to read configured CSS templates and annotations due to unnecessary read permissions within the Gamma role. **Recommendations** For versions prior to 2.1.2, upgrade to version 2.1.2 or above and run `superset init` to reconstruct the Gamma role or remove `can read` permission from the mentioned resources.

**Name of the Vulnerable Software and Affected Versions** Apache Superset versions up to and including 2.1.0 **Description** The issue is related to an improper default REST API permission for Gamma users in Apache Superset, which is connected to shortcomings in the authorization mechanism. This allows an authenticated Gamma user to test database connections. **Recommendations** For Apache Superset versions up to and including 2.1.0, consider restricting the REST API permissions for Gamma users to prevent them from testing database connections until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apache Superset versions up to and including 2.1.0 **Description** The issue is related to stack traces for errors being enabled by default, resulting in the exposure of internal traces on REST API endpoints to users. This could potentially reveal sensitive information about the system's internal workings. **Recommendations** For Apache Superset versions up to and including 2.1.0, consider disabling the default stack trace feature to prevent the exposure of internal traces on REST API endpoints. As a temporary workaround, restrict access to the REST API endpoints until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.