Woodman

**Name of the Vulnerable Software and Affected Versions** Redaxo version 5.15.1 **Description** A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `Name` parameter in the Template section. **Recommendations** For Redaxo version 5.15.1, avoid using the `Name` parameter in the Template section until a fix is available. As a temporary workaround, consider restricting access to the Template section to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Totolink X6000R version 9.4.0cu.852 B20230719 **Description** A vulnerability was found in the file `/etc/shadow` of the Totolink X6000R, which is related to the use of hard-coded credentials. The manipulation of this vulnerability can lead to unauthorized access to protected information. The attack can be launched on the local host, and the complexity of the attack is rather high, making exploitation difficult. The exploit has been disclosed to the public and may be used. **Recommendations** For Totolink X6000R version 9.4.0cu.852 B20230719, consider changing the hard-coded credentials in the `/etc/shadow` file to prevent unauthorized access. As a temporary workaround, restrict access to the `/etc/shadow` file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.