Zi0Black

**Name of the Vulnerable Software and Affected Versions** OpenVSX versions v0.9.0 through v0.20.0 **Description** The issue allows a user to edit all namespace details, including name, description, website, support link, and social media links, even if the user is not a namespace Owner or Contributor. This is possible through the `/user/namespace/{namespace}/details` API endpoint and also affects the `/user/namespace/{namespace}/details/logo` endpoint, allowing a user to change the logo. **Recommendations** For OpenVSX versions v0.9.0 through v0.20.0, consider restricting access to the `/user/namespace/{namespace}/details` and `/user/namespace/{namespace}/details/logo` API endpoints to only allow authorized users, such as namespace Owners or Contributors, to edit namespace details and change logos. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 106.0.5249.62 Microsoft Edge (affected versions not specified) **Description** The issue is related to insufficient policy enforcement in developer tools, allowing a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This could enable the attacker to bypass existing security restrictions and disclose protected information using a specially crafted website. **Recommendations** For Google Chrome versions prior to 106.0.5249.62, update to version 106.0.5249.62 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: QNAP NAS running Q’center versions prior to Q’center v1.10.1004 QNAP NAS running Q’center versions prior to Q’center v1.12.1012 Description: A post-authentication reflected XSS vulnerability has been reported to affect QNAP NAS running Q’center. If exploited, this vulnerability allows remote attackers to inject malicious code. Recommendations: For QTS 4.5.3, update to Q’center v1.12.1012 or later. For QTS 4.3.6, update to Q’center v1.10.1004 or later. For QTS 4.3.3, update to Q’center v1.10.1004 or later. For QuTS hero h4.5.2, update to Q’center v1.12.1012 or later. For QuTScloud c4.5.4, update to Q’center v1.12.1012 or later.

Name of the Vulnerable Software and Affected Versions: Cisco node-jose versions prior to 0.11.0 Description: A security issue exists due to the node-jose library following the JSON Web Signature (JWS) standard for JSON Web Tokens (JWTs), which allows a JSON Web Key (JWK) representing a public key to be embedded within the header of a JWS. This public key is then trusted for verification. An attacker could exploit this by forging valid JWS objects, removing the original signature, adding a new public key to the header, and then signing the object using the associated private key. Recommendations: For versions prior to 0.11.0, update to version 0.11.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of JSON Web Tokens (JWTs) that contain embedded public keys until a patch is applied. Avoid trusting public keys embedded in JWS headers to minimize the risk of exploitation.