Sehwang Kim

**Name of the Vulnerable Software and Affected Versions** ProjectSend version r2029 **Description** Reflected cross-site scripting occurs in the 'thumbnails-regenerate.php' endpoint. Remote attackers can inject arbitrary HTML and JavaScript by providing unsanitized values through the `start date` and `end date` GET parameters, which are echoed unescaped into HTML attribute values. An authenticated victim with edit settings permissions who follows a malicious URL may have scripts executed in the application origin, potentially leading to the theft of session cookies or unauthorized actions such as user management, file management, and changes to application settings. **Recommendations** For version r2029, avoid using the `start date` and `end date` parameters in the 'thumbnails-regenerate.php' endpoint until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OneDev versions prior to 15.0.7 **Description** An arbitrary file write issue exists due to symlink path traversal. The `TarUtils.untar()` function creates symbolic links using the `getLinkName()` TAR entry without validating if the target is an absolute path. A subsequent file entry within the same archive can traverse this symlink to write to arbitrary server-side locations. This can be exploited by any authenticated user with CI Job write access without requiring administrator interaction. **Recommendations** Update to version 15.0.7.