Wiktor Sędkowski

Name of the Vulnerable Software and Affected Versions: Pimcore AdminBundle versions 6.8.0 and earlier Description: The issue is a SQL injection problem in the `specificID` variable used by the application. This was fixed in version 6.9.4 of the product. Recommendations: For Pimcore AdminBundle versions 6.8.0 and earlier, update to version 6.9.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the `specificID` variable to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: EspoCRM versions 6.1.6 and prior Description: The issue is a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images. This vulnerability was fixed in version 6.1.7 of the product. Recommendations: For EspoCRM versions 6.1.6 and prior, update to version 6.1.7 or later to resolve the issue. As a temporary workaround, consider restricting the upload of user-supplied avatar images until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Akaunting versions 2.1.12 and earlier **Description** The issue is an authentication bypass problem in a user-controllable field, specifically `companies[0]`. This problem was resolved in version 2.1.13 of the product. **Recommendations** For versions 2.1.12 and earlier, update to version 2.1.13 to resolve the authentication bypass issue. As a temporary workaround, consider restricting access to the `companies[0]` field until the update can be applied.

**Name of the Vulnerable Software and Affected Versions** Akaunting versions 2.1.12 and earlier **Description** The issue is a denial-of-service problem triggered by setting a malformed `locale` variable and sending it in an otherwise normal HTTP POST request. This issue was fixed in version 2.1.13 of the product. **Recommendations** For versions 2.1.12 and earlier, update to version 2.1.13 or later to resolve the issue. As a temporary workaround, consider restricting the use of the `locale` variable in HTTP POST requests until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Akaunting versions 2.1.12 and earlier **Description** The issue is a persistent (type II) cross-site scripting (XSS) vulnerability that occurs when processing user-supplied avatar images. This vulnerability was fixed in version 2.1.13 of the product. **Recommendations** For versions 2.1.12 and earlier, update to version 2.1.13 or later to resolve the issue. As a temporary workaround, consider restricting the upload of user-supplied avatar images until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Akaunting versions 2.1.12 and earlier **Description** The issue allows an attacker to proxy password reset requests through a running Akaunting instance if the attacker knows the target's e-mail address. This is caused by the defaults provided by the Laravel framework, specifically how proxy headers are handled with respect to multi-tenant implementations. Although this is not technically a vulnerability in Laravel, the default configuration can lead to similar vulnerabilities in Laravel projects that implement multi-tenant applications. **Recommendations** For Akaunting versions 2.1.12 and earlier, update to version 2.1.13 to resolve the issue. As a temporary workaround, consider restricting access to the password reset functionality until the update is applied. Additionally, review and adjust the configuration of proxy headers in multi-tenant implementations to prevent similar issues.

**Name of the Vulnerable Software and Affected Versions** Akaunting versions 2.1.12 and earlier **Description** The issue is a persistent (type II) cross-site scripting (XSS) vulnerability in the sales invoice processing component of the application. This vulnerability was fixed in version 2.1.13 of the product. **Recommendations** For versions 2.1.12 and earlier, update to version 2.1.13 or later to resolve the issue. As a temporary workaround, consider restricting access to the sales invoice processing component until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Pimcore Customer Data Framework versions 3.0.0 and earlier **Description** The issue is related to a Boolean-based blind SQL injection in the $id parameter of the SegmentAssignmentController.php component. This allows a remote attacker to disclose protected information by exploiting the lack of protection of the SQL query structure. **Recommendations** For Pimcore Customer Data Framework versions 3.0.0 and earlier, update to version 3.0.2 to resolve the issue. As a temporary workaround, consider restricting access to the SegmentAssignmentController.php component until a patch is available. Avoid using the `$id` parameter in the affected component until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Akaunting versions 2.1.12 and earlier **Description** The issue is related to a code injection problem in the Money.php component of the application. It can be exploited by sending a POST request to the "/{company id}/sales/invoices/{invoice id}" endpoint with an `items[0][price]` that includes a PHP callable function, which is then executed directly. This can potentially impact the confidentiality, integrity, and availability of protected information. **Recommendations** For versions 2.1.12 and earlier, update to version 2.1.13 to resolve the issue. As a temporary workaround, consider restricting access to the Money.php component and the "/{company id}/sales/invoices/{invoice id}" endpoint to minimize the risk of exploitation. Avoid using the `items[0][price]` parameter in the affected API endpoint until the issue is resolved.