Mitchell_45

**Name of the Vulnerable Software and Affected Versions** Webkul Bagisto versions prior to 2.4.5 **Description** An authorization bypass exists in the Backend Sales RMA Endpoint component due to improper processing of the '/admin/sales/rma/requests' endpoint. This flaw allows a remote attacker to bypass authorization requirements through specific manipulation. **Recommendations** Update to a version newer than 2.4.4. Restrict access to the '/admin/sales/rma/requests' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Webkul Bagisto versions prior to 2.4.5 **Description** Improper access controls exist within the Customer Item Deletion Endpoint, allowing for remote manipulation of the component. **Recommendations** Update Webkul Bagisto to version 2.4.5 or later.

**Name of the Vulnerable Software and Affected Versions** Webkul Bagisto versions prior to 2.4.5 **Description** A weakness in the Customer Search component, specifically within the `/admin/customers/search` endpoint, allows for remote information disclosure. This occurs when the `Query` argument is manipulated, enabling an attacker to access sensitive data. **Recommendations** Update Webkul Bagisto to version 2.4.5 or later. As a temporary mitigation, restrict access to the `/admin/customers/search` endpoint.

**Name of the Vulnerable Software and Affected Versions** Bottelet DaybydayCRM versions prior to 2.2.2 **Description** An issue exists within the Setting Handler component where a manipulation of an unknown function allows for missing authentication. This flaw enables remote exploitation of the system. **Recommendations** Apply the available patch for versions prior to 2.2.2.

**Name of the Vulnerable Software and Affected Versions** DevaslanPHP project-management versions prior to 2.0.0-beta1 **Description** An improper authorization issue exists in the Ticket Handler component. A remote attacker can exploit this by manipulating the `recordUpdated()` function within the `app/Helpers/KanbanScrumHelper.php` file. **Recommendations** As a temporary workaround, restrict access to the `recordUpdated()` function in the `app/Helpers/KanbanScrumHelper.php` file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.