Zero-day bug found in procurement solution used by government bodies

The flaw in BuySpeed version 14.5 could allow a local, authenticated attacker to store arbitrary JavaScript within the application, as per a vulnerability advisory from the CERT/CC at CMU.