Paulino Calderon

**Name of the Vulnerable Software and Affected Versions** Helidon versions 1.4.10 and 2.0.0-RC1 **Description** The issue exists due to insufficient input validation in the Reactive WebServer component of Helidon, allowing an unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks can result in the takeover of Helidon. The vulnerability is difficult to exploit and can be leveraged by an attacker to execute arbitrary code using HTTP requests. **Recommendations** For version 1.4.10, update to a version that includes the fix for this issue. For version 2.0.0-RC1, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Reactive WebServer component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** MantisBT versions prior to 1.2.8 **Description** The issue allows remote attackers to inject arbitrary web script or HTML via the PATH INFO, affecting multiple pages, including "manage config email page.php", "manage config workflow page.php", and "bugs/plugin.php". **Recommendations** For versions prior to 1.2.8, update to version 1.2.8 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** MantisBT versions prior to 1.2.8 **Description** The issue allows remote attackers to inject arbitrary web script or HTML via the `os`, `os build`, or `platform` parameter to bug reporting or update pages, related to the use of the Projax library. This can be achieved by accessing specific API endpoints, such as bug report page.php or bug update advanced page.php. **Recommendations** For versions prior to 1.2.8, update to version 1.2.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the bug report page.php and bug update advanced page.php pages, and avoid using the `os`, `os build`, or `platform` parameters until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** SmartSiteCMS version 1.0 **Description** The issue allows remote attackers to bypass authentication and gain administrator privileges. This is achieved by setting the `userName` cookie in the `admin.php` file. **Recommendations** For SmartSiteCMS version 1.0, consider restricting access to the `admin.php` file until a patch is available. As a temporary workaround, avoid using the `userName` cookie in the affected file to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: JAWS version 0.4 Description: A cross-site scripting (XSS) issue exists in the NewTerm function in GlossaryModel.php, allowing remote attackers to inject arbitrary web script or HTML via the `term` or `description` variables. Recommendations: For JAWS version 0.4, as a temporary workaround, consider disabling the NewTerm function in GlossaryModel.php until a patch is available. Restrict input for the `term` and `description` variables to minimize the risk of exploitation.