Nikola Kojic

The WP BackItUp Community Edition plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.0 via the 'backup file' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The basename() normalization present in the handler only executes when the traversed target path does not exist, providing no protection against reads of existing files.

**Name of the Vulnerable Software and Affected Versions** User Login History versions prior to 2.1.8 **Description** The User Login History plugin for WordPress contains a SQL Injection flaw, which occurs when an application fails to properly sanitize or escape input used in a database query, allowing an attacker to interfere with the queries. This issue is caused by insufficient escaping of the user-supplied `blog id` parameter and a lack of proper preparation of the SQL query. Authenticated attackers with Administrator-level access or higher can append additional SQL queries to extract sensitive information from the database. This issue is only exploitable on multisite installations. **Recommendations** Update User Login History to version 2.1.8 or later. As a temporary mitigation, restrict access to the `blog id` parameter in multisite environments until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 153 Firefox ESR versions prior to 140.13 Thunderbird versions prior to 153 Thunderbird versions prior to 140.13 **Description** A mitigation bypass exists within the PDF Viewer component. **Recommendations** Update Firefox to version 153 or later. Update Firefox ESR to version 140.13 or later. Update Thunderbird to version 153 or later. Update Thunderbird to version 140.13 or later.

**Name of the Vulnerable Software and Affected Versions** No specific software or versions are mentioned. **Description** A malicious unauthorized PAM user can access the administration configuration data and change the values. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LAMS versions prior to 3.1 **Description** The issue concerns unauthenticated reflected cross-site scripting (XSS) that allows a remote attacker to introduce arbitrary JavaScript. This is achieved through the manipulation of an unsanitized GET parameter during a password change, specifically in the forgotPasswordChange.jsp page with a key parameter. **Recommendations** For versions prior to 3.1, update to version 3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the forgotPasswordChange.jsp page to minimize the risk of exploitation. Avoid using the key parameter in the forgotPasswordChange.jsp page until the issue is resolved.