R3Naissance

Name of the Vulnerable Software and Affected Versions: bootstrap-multiselect version 1.1.2 Description: An issue was discovered in post.php, where a PHP script echoes arbitrary POST data. This could create a Reflective Cross-Site Scripting (XSS) vulnerability exploitable through Cross-Site Request Forgery (CSRF) if a developer adopts this structure in a live application. Recommendations: For version 1.1.2, consider modifying the post.php script to validate and sanitize POST data to prevent echoing arbitrary input, thus mitigating the risk of Reflective Cross-Site Scripting (XSS) exploitation. As a temporary workaround, consider restricting access to the post.php script until a proper fix is implemented.

**Name of the Vulnerable Software and Affected Versions** Xen Orchestra versions through 5.80.0 (xo-web) and through 5.84.0 (xo-server) **Description** The issue concerns mishandled authorization. An attacker can modify WebSocket `resourceSet.getAll` data, changing the permission field from none to admin, thereby gaining access to sensitive data sets including VMs, Backups, Audit, Users, and Groups. **Recommendations** For versions through 5.80.0 (xo-web) and through 5.84.0 (xo-server), as a temporary workaround, consider restricting access to the `resourceSet.getAll` WebSocket endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CRK Business Platform versions <= 2019.1 **Description** The issue allows reflected XSS via the erro.aspx page, specifically through the `CRK`, `IDContratante`, `Erro`, or `Mod` parameters. This vulnerability is path-independent. **Recommendations** For CRK Business Platform versions <= 2019.1, consider restricting access to the erro.aspx page or disabling the `CRK`, `IDContratante`, `Erro`, and `Mod` parameters to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Concrete5 versions prior to 8.3.0 Description: An issue was discovered in tools/conversations/view ajax.php. An unauthenticated user can enumerate comments from all blog posts by POSTing requests to "/index.php/tools/required/conversations/view ajax" with incremental `cnvID` integers. Recommendations: For versions prior to 8.3.0, update to version 8.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/index.php/tools/required/conversations/view ajax" endpoint to prevent unauthorized comment enumeration.