Rahul Kadavil

**Name of the Vulnerable Software and Affected Versions** Bynder version 0.1.394 **Description** A stored cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML through a crafted payload. Stored XSS occurs when a malicious script is permanently stored on the target server, such as in a database, and later served to other users. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TCPWave DDI version 11.34P1C2 **Description** The issue allows for Remote Code Execution via Unrestricted File Upload combined with Path Traversal. **Recommendations** For TCPWave DDI version 11.34P1C2, consider restricting access to file upload functionality to minimize the risk of exploitation until a patch is available.

Name of the Vulnerable Software and Affected Versions: Vegam 4i versions 6.3.47.0 and earlier Description: A Local File Inclusion issue allows a remote attacker to obtain sensitive information through the print label function. The `filePathList` parameter is susceptible to this issue, enabling a malicious user to include files from the web server, such as `web.config` or `/etc/hosts`, leading to the disclosure of sensitive information. Recommendations: For versions 6.3.47.0 and earlier, consider disabling the print label function until a patch is available. Restrict access to sensitive files on the web server to minimize the risk of exploitation. Avoid using the `filePathList` parameter in the affected print labelling function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.