Mohamed Magdy Abumsulim

**Name of the Vulnerable Software and Affected Versions** LavaLite CMS version 9.0.0 **Description** The issue concerns Sensitive Data Exposure. **Recommendations** For LavaLite CMS version 9.0.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LavaLite CMS version 9.0.0 **Description** The issue is related to a host header injection attack. This type of attack involves manipulating the host header in HTTP requests to potentially bypass security controls or access unauthorized resources. **Recommendations** For LavaLite CMS version 9.0.0, as a temporary workaround, consider restricting access to the `Host` header in incoming requests until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LavaLite CMS version 9.0.0 **Description** The issue is related to web cache poisoning. **Recommendations** For LavaLite CMS version 9.0.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MoveIt framework version 1.1.11 **Description** The issue concerns a cross-site scripting (XSS) flaw via the API authentication function. This allows for potential malicious script execution. No information is provided about the estimated number of affected devices or real-world incidents. **Recommendations** For MoveIt framework version 1.1.11, consider disabling the API authentication function as a temporary workaround until a patch is available. Restrict access to the authentication endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.