Sato Nobuhiro

**Name of the Vulnerable Software and Affected Versions** Pleasanter versions 1.3.47.0 and earlier **Description** The issue is a stored cross-site scripting vulnerability. If exploited, it allows an arbitrary script to be executed on the user's web browser. **Recommendations** For Pleasanter versions 1.3.47.0 and earlier, as a temporary workaround, consider restricting user input to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Pleasanter versions 1.3.47.0 and earlier **Description** The issue is related to improper access control, which may allow a remote authenticated attacker to view temporary files uploaded by other users who are not permitted to access. **Recommendations** For Pleasanter versions 1.3.47.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Rakuten WiFi Pocket (affected versions not specified) **Description** The issue allows a network-adjacent attacker to log in to the product's Management Screen due to an improper authentication vulnerability. This could result in sensitive information being obtained and/or the settings being changed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DataSpider Servista versions 4.4 and earlier **Description** The issue concerns the use of a hard-coded cryptographic key in DataSpider Servista, which is data integration software. This key is embedded in ScriptRunner and ScriptRunner for Amazon SQS, tools used to start configured processes on DataSpider Servista. The key is common to all users, and if an attacker gains access to a target DataSpider Servista instance and obtains a Launch Settings file of ScriptRunner and/or ScriptRunner for Amazon SQS, they may perform operations with the user privilege encrypted in the file. DataSpider Servista and some of its OEM products are affected. **Recommendations** For DataSpider Servista versions 4.4 and earlier, consider disabling the use of ScriptRunner and ScriptRunner for Amazon SQS until a patch or fix is available to avoid potential exploitation. Restrict access to Launch Settings files of these tools to minimize the risk of attackers obtaining sensitive information. At the moment, there is no information about a newer version that contains a fix for this vulnerability.