Partywave

**Name of the Vulnerable Software and Affected Versions** OpenClinic GA version 5.351.19 **Description** A reflected cross-site scripting issue exists in the DICOM image upload handler. Attackers can execute arbitrary JavaScript in a victim's browser by embedding malicious payloads in DICOM file metadata fields, such as `Study Description`. These payloads are reflected without sanitization in 'popup.jsp' and 'archiving/uploadfiles jsp.java' when processed through the Upload DICOM images feature. This flaw can be chained to achieve remote code execution (RCE), which is the ability to execute arbitrary commands on a target machine. **Recommendations** As a temporary workaround, restrict access to the Upload DICOM images feature or avoid uploading DICOM files from untrusted sources until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Weasis version 4.5.1 **Description** The issue concerns a hardcoded key for symmetric encryption of proxy credentials in the `ui/pref/ProxyPrefView.java` file within the weasis-core component of Weasis. This hardcoded key is used for the symmetric encryption of proxy credentials. **Recommendations** For Weasis version 4.5.1, consider disabling the symmetric encryption of proxy credentials until a patch is available that addresses the hardcoded key issue. Restrict access to the `ui/pref/ProxyPrefView.java` file to minimize the risk of exploitation. Avoid using the hardcoded key for symmetric encryption of proxy credentials in the affected component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.