Ranjit Pahan

**Name of the Vulnerable Software and Affected Versions** Odoo Community versions 14.0 through 15.0 Odoo Enterprise versions 14.0 through 15.0 **Description** The issue is related to improper access control in the reporting engine, allowing remote attackers to download PDF reports for arbitrary documents via crafted requests. **Recommendations** For Odoo Community versions 14.0 through 15.0, update to a version that includes the fix for this issue. For Odoo Enterprise versions 14.0 through 15.0, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the reporting engine to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Odoo Community versions 14.0 through 15.0 Odoo Enterprise versions 14.0 through 15.0 **Description** The issue is a cross-site scripting (XSS) problem in the Discuss app, allowing remote attackers to inject arbitrary web script in the browser of a victim by posting crafted contents. **Recommendations** For Odoo Community versions 14.0 through 15.0, update to a version that includes a fix for this issue. For Odoo Enterprise versions 14.0 through 15.0, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to the Discuss app until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Zoho ManageEngine NetFlow Analyzer version 12.3 **Description** A SQL injection issue allows attackers to execute arbitrary SQL commands via the `DeviceID` parameter in the "/client/api/json/v2/nfareports/compareReport" API endpoint. **Recommendations** For Zoho ManageEngine NetFlow Analyzer version 12.3, consider restricting access to the "/client/api/json/v2/nfareports/compareReport" API endpoint until a patch is available, and avoid using the `DeviceID` parameter in this endpoint to minimize the risk of exploitation.