Ossacip Thanh

**Name of the Vulnerable Software and Affected Versions** MDTF versions prior to 1.3.9 **Description** An unauthenticated Local File Inclusion (LFI) issue exists, which allows an attacker to read files from the local file system without requiring authentication. **Recommendations** Update to a version newer than 1.3.8.

**Name of the Vulnerable Software and Affected Versions** eMagicOne Store Manager versions prior to 1.3.3 **Description** Improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. Blind SQL Injection is a type of attack where the application does not return data directly in the HTTP response, but the attacker can still deduce information by observing the server's response to specific queries. **Recommendations** Update to a version newer than 1.3.2.