Simon Bieber

**Name of the Vulnerable Software and Affected Versions** Drupal Wiki versions prior to 8.31.1 **Description** The issue allows for XSS attacks via comments, captions, and image titles of a Wiki page. **Recommendations** For versions prior to 8.31.1, update to version 8.31.1 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: NetSetMan Pro versions prior to 5.0 Description: An unauthenticated attacker with physical access to a computer, where the pre-logon profile switch button within the Windows logon screen is enabled, can drop to an administrative shell and execute arbitrary commands as SYSTEM via the "save log to file" feature by navigating to cmd.exe. Recommendations: For versions prior to 5.0, update to version 5.0 or later to resolve the issue. As a temporary workaround, consider disabling the pre-logon profile switch button within the Windows logon screen to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OCS Inventory NG version ocsreports 2.4 **Description** The issue concerns a Cross Site Scripting (XSS) vulnerability in the login form and search functionality. This allows an attacker to execute arbitrary JavaScript code within a victim's browser. The attack is exploitable if the victim opens a crafted link to the application. **Recommendations** For OCS Inventory NG version ocsreports 2.4, update to version 2.4.1 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** OCS Inventory NG ocsreports versions 2.3.1 through 2.4 **Description** The issue allows an authenticated attacker to gain full access to data stored within the database due to a SQL Injection vulnerability in the web search function. This can be exploited by sending crafted requests to gain database access. **Recommendations** For versions 2.3.1 through 2.4, update to version 2.4.1 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** e107 versions prior to 1.0.3 **Description** A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the query string. This is due to a vulnerability in the content preset.php file within the e107 plugins/content/handlers directory. **Recommendations** For versions prior to 1.0.3, update to version 1.0.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the content preset.php file to minimize the risk of exploitation.