Robin

**Name of the Vulnerable Software and Affected Versions** Token Content Access versions 0.0.0 through 3.1.2 **Description** An observable timing discrepancy exists in the Token Content Access module, which allows site administrators to grant content access via access tokens. The module fails to sufficiently protect the comparison of access tokens, enabling a persistent attacker to perform a timing attack—a method of guessing secret data by measuring how long a system takes to respond—to discover a valid token and bypass access restrictions. Exploitation requires the attacker to know the URL of the protected content and accurately measure timing differences in the responses. **Recommendations** Update Token Content Access to a version later than 3.1.2.

**Name of the Vulnerable Software and Affected Versions** WebUntis versions prior to 2020.9.6 **Description** The issue allows for XSS in multiple functions that store information. **Recommendations** For versions prior to 2020.9.6, update to version 2020.9.6 or later to resolve the issue.