File: D:/hMailServer/Data/itpartnership.com/neil/57/{57FB064F-9B3E-46AE-8F32-AA360CBB903F}.eml
Return-Path: surinder@itpartnership.com
Delivered-To: neil@itpartnership.com
Received: from SSWin10MainVM (mail.ontheworldweb.com [88.98.246.98])
by mail.itpartnership.com with ESMTPSA
(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256)
; Tue, 28 Jul 2026 09:48:11 +0100
From: "Surinder Singh" <surinder@itpartnership.com>
To: "Neil Stainton" <neil@itpartnership.com>
References: <CWLP123MB5865BDAB4FC3E7698396FB70E2CC2@CWLP123MB5865.GBRP123.PROD.OUTLOOK.COM>
In-Reply-To:
Subject: FW: IMPORTANT -VDK PCI scan failure (path traversal false positive)
Date: Tue, 28 Jul 2026 09:48:10 +0100
Message-ID: <0c5b01dd1e6d$d1a3e2b0$74eba810$@itpartnership.com>
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="----=_NextPart_000_0C5C_01DD1E76.336A1F70"
X-Mailer: Microsoft Outlook 16.0
Thread-Index: Ad0dympwb7IeBqzPQXGkTwH5ImEo3QAo1raw
Content-Language: en-gb
This is a multipart message in MIME format.
------=_NextPart_000_0C5C_01DD1E76.336A1F70
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_0C5D_01DD1E76.336A1F70"
------=_NextPart_001_0C5D_01DD1E76.336A1F70
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
FYI
From: Surinder Singh <surinder@itpartnership.com>
Sent: 27 July 2026 14:42
To: 'Paul Brown (CIRC)' <paul@castironradiatorcentre.co.uk>
Subject: RE: IMPORTANT -VDK PCI scan failure (path traversal false positive)
Hi Paul,
Please could you forward the following to SecurityMetrics and ask them to
review the failing vulnerability manually?
_____
We have investigated and reproduced the reported CGI Generic Path Traversal
(write test) finding affecting:
https://www.vintagedoorknobs.co.uk/products.asp
The report identifies:
* the sortby parameter using GET; and
* the xcode parameter using POST.
Our investigation indicates that this is a false positive.
GET sortby parameter
The application does not place the submitted sortby value directly into SQL
or use it as a file path.
The value is processed through a strict whitelist. Only the following known
values are recognised:
* 2 - price, high to low
* 3 - price, low to high
* 4 - product name
Each recognised value is mapped internally to a predefined SQL ORDER BY
expression. Any other value results in no custom sort expression being used.
We reproduced the scanner test by comparing:
sortby=not-a-valid-sort-value
with:
sortby=../../../../../../../../../../windows/system32/config/sam
Both requests were made using the same ASP session.
The results were:
* HTTP status: 200 OK for both
* Content length: 63640 bytes for both
* HTML response: byte-for-byte identical
* File comparison result: FC: no differences encountered
The only response-header differences were the expected Date and Expires
timestamps.
POST xcode parameter
The SecurityMetrics request submitted an xcode value while leaving the
associated xcmd command blank.
In the application code, when xcmd is blank, the submitted xcode value is
discarded and replaced by the separate code parameter. As the scanner also
supplied a blank code value, the resulting command and product code are both
blank and the basket-operation routine exits without processing the
submitted xcode.
We reproduced this by comparing an ordinary invalid product code with the
reported traversal value, again using the same ASP session and leaving xcmd,
cmd and code blank.
The results were:
* HTTP status: 200 OK for both
* Content length: 63708 bytes for both
* HTML responses: identical apart from a dynamic page-execution timing
comment
* Baseline timing comment: 0.063 secs
* Traversal timing comment: 0.043 secs
The response headers again differed only in their normal Date and Expires
timestamps.
The changing execution-time comment is expected dynamic content and does not
indicate file access. The scan evidence also shows similar minor
execution-time differences, without demonstrating any file access or
modification.
Code review
Neither sortby nor xcode is passed to any:
* filesystem function;
* path-mapping function;
* file stream;
* dynamic include;
* operating-system command; or
* executable process.
There are no relevant calls to functions such as Server.MapPath,
FileSystemObject, ADODB.Stream, Server.Execute, Response.WriteFile or
WScript.Shell.
In legitimate use, xcode represents either a product code or a currency
code. Product codes are used only in database lookups with SQL escaping and
product-existence validation. Currency codes must match an allowed currency
list or a record in the currencies table.
No file contents were disclosed, no file was modified, no filesystem error
occurred, and the traversal value was not reflected in the response.
We also inspected the target file identified by the scanner. The Windows SAM
file at C:\Windows\System32\config\SAM has a last-modified timestamp of 6
May 2026 at 04:11. The SecurityMetrics scan was performed on 24 July 2026
between 15:05 and 16:28. The file was therefore not modified during or as a
result of the scan.
We therefore believe the reported CGI Generic Path Traversal (write test)
vulnerability is a false positive. Please could this finding be reviewed
manually and marked as a false positive?
We can provide the response files, comparison results and relevant
source-code extracts if required.
_____
Thanks,
Surinder
From: Paul Brown (CIRC) <paul@castironradiatorcentre.co.uk
<mailto:paul@castironradiatorcentre.co.uk> >
Sent: 27 July 2026 08:31
To: Surinder Singh <surinder@itpartnership.com
<mailto:surinder@itpartnership.com> >
Subject: IMPORTANT -VDK PCI scan failure
Importance: High
Morning Surinder,
Hope your weekend went well!
Can you take a look at the attached report and look to fix the issue raised
. Appears to only be one failed issue.
It is very important that this is corrected as it affects the Worldpay
integration and costs we are charged for currently not meeting their PCI
requirements.
Would be grateful if you could let me know as soon as possible when fixed
and I will sort out a further vulnerability scan so that I can get
compliance re-established
Kind regards,
Paul
Tel: 024 76303999 Ext: 204
Mob: 07950 606244
email: paul@castironradiatorcentre.co.uk
<mailto:paul@castironradiatorcentre.co.uk>
WEBSITE: <http://www.castironradiatorcentre.co.uk/> Cast Iron Radiator
Centre
CONFIDENTIALITY NOTICE: This email and any attachments are confidential and
intended solely for the use of the individual or entity to whom they are
addressed. If you have received this email in error, please notify the
sender immediately and delete it from your system. You must not disclose,
copy, or distribute any part of this email if you are not the intended
recipient.
DISCLAIMER: The views and opinions expressed in this email are those of the
author and do not necessarily represent the views of our company. The
information contained in this email is for general information purposes
only. While we endeavour to keep the information up to date and correct, we
make no representations or warranties of any kind, express or implied, about
the completeness, accuracy, reliability, suitability, or availability with
respect to the email or the information, products, services, or related
graphics contained in the email for any purpose. Any reliance you place on
such information is therefore strictly at your own risk.
VIRUS WARNING: Although we have taken reasonable precautions to ensure no
viruses are present in this email, we cannot accept responsibility for any
loss or damage arising from the use of this email or attachments. It is your
responsibility to ensure that your computer systems are adequately protected
from viruses and other harmful code.
LEGAL NOTICE: This email does not constitute legal advice and is not
intended to establish any attorney-client relationship. You should seek
appropriate legal advice before taking or refraining from any action based
on the contents of this email.
COMPLIANCE WITH REGULATIONS: Our company operates in accordance with
relevant data protection regulations. If you have any concerns about how
your personal data is being processed, please contact our company using the
above details.
------=_NextPart_001_0C5D_01DD1E76.336A1F70
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =
xmlns=3D"http://www.w3.org/TR/REC-html40"><head><META =
HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii"><meta name=3DGenerator content=3D"Microsoft Word 15 =
(filtered medium)"><!--[if !mso]><style>v\:* =
{behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:12.0pt;
font-family:"Aptos",serif;
mso-ligatures:standardcontextual;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#467886;
text-decoration:underline;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:469254620;
mso-list-template-ids:-1177640542;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1
{mso-list-id:506289413;
mso-list-template-ids:-884078184;}
@list l1:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l1:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level4
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level5
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level7
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level8
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2
{mso-list-id:1247956506;
mso-list-template-ids:119591116;}
@list l2:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l2:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level4
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level5
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level7
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level8
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3
{mso-list-id:1482623388;
mso-list-template-ids:-1502574334;}
@list l3:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l3:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level4
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level5
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level7
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level8
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l4
{mso-list-id:1929340171;
mso-list-template-ids:842060856;}
@list l4:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l4:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l4:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l4:level4
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l4:level5
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l4:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l4:level7
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l4:level8
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l4:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]--></head><body lang=3DEN-GB =
link=3D"#467886" vlink=3D"#96607D" style=3D'word-wrap:break-word'><div =
class=3DWordSection1><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>FYI<o:p></o:p=
></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></p><div><div style=3D'border:none;border-top:solid #E1E1E1 =
1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=3DMsoNormal><b><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:=
none;mso-fareast-language:EN-GB'>From:</span></b><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:=
none;mso-fareast-language:EN-GB'> Surinder Singh =
<surinder@itpartnership.com> <br><b>Sent:</b> 27 July 2026 =
14:42<br><b>To:</b> 'Paul Brown (CIRC)' =
<paul@castironradiatorcentre.co.uk><br><b>Subject:</b> RE: =
IMPORTANT -VDK PCI scan failure (path traversal false =
positive)<o:p></o:p></span></p></div></div><p =
class=3DMsoNormal><o:p> </o:p></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>Hi =
Paul,<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>Please could =
you forward the following to SecurityMetrics and ask them to review the =
failing vulnerability manually?<o:p></o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></p><div class=3DMsoNormal align=3Dcenter =
style=3D'text-align:center'><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><hr size=3D1 =
width=3D"100%" align=3Dcenter></span></div><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>We have =
investigated and reproduced the reported <b>CGI Generic Path Traversal =
(write test)</b> finding affecting:<o:p></o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><a =
href=3D"https://www.vintagedoorknobs.co.uk/products.asp">https://www.vint=
agedoorknobs.co.uk/products.asp</a><o:p></o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>The report =
identifies:<o:p></o:p></span></p><ul style=3D'margin-top:0cm' =
type=3Ddisc><li class=3DMsoNormal style=3D'mso-list:l1 level1 =
lfo1'><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>the sortby =
parameter using GET; and <o:p></o:p></span></li><li class=3DMsoNormal =
style=3D'mso-list:l1 level1 lfo1'><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>the xcode =
parameter using POST. <o:p></o:p></span></li></ul><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>Our =
investigation indicates that this is a false =
positive.<o:p></o:p></span></p><p class=3DMsoNormal><b><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></b></p><p class=3DMsoNormal><b><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>GET sortby =
parameter<o:p></o:p></span></b></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>The =
application does not place the submitted sortby value directly into SQL =
or use it as a file path.<o:p></o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>The value is =
processed through a strict whitelist. Only the following known values =
are recognised:<o:p></o:p></span></p><ul style=3D'margin-top:0cm' =
type=3Ddisc><li class=3DMsoNormal style=3D'mso-list:l2 level1 =
lfo2'><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>2 – =
price, high to low <o:p></o:p></span></li><li class=3DMsoNormal =
style=3D'mso-list:l2 level1 lfo2'><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>3 – =
price, low to high <o:p></o:p></span></li><li class=3DMsoNormal =
style=3D'mso-list:l2 level1 lfo2'><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>4 – =
product name <o:p></o:p></span></li></ul><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>Each =
recognised value is mapped internally to a predefined SQL ORDER BY =
expression. Any other value results in no custom sort expression being =
used.<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>We =
reproduced the scanner test by comparing:<o:p></o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>sortby=3Dnot-=
a-valid-sort-value<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>with:<o:p></o=
:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>sortby=3D../.=
./../../../../../../../../windows/system32/config/sam<o:p></o:p></span></=
p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>Both =
requests were made using the same ASP session.<o:p></o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>The results =
were:<o:p></o:p></span></p><ul style=3D'margin-top:0cm' type=3Ddisc><li =
class=3DMsoNormal style=3D'mso-list:l3 level1 lfo3'><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>HTTP status: =
200 OK for both <o:p></o:p></span></li><li class=3DMsoNormal =
style=3D'mso-list:l3 level1 lfo3'><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>Content =
length: 63640 bytes for both <o:p></o:p></span></li><li =
class=3DMsoNormal style=3D'mso-list:l3 level1 lfo3'><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>HTML =
response: byte-for-byte identical <o:p></o:p></span></li><li =
class=3DMsoNormal style=3D'mso-list:l3 level1 lfo3'><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>File =
comparison result: FC: no differences encountered =
<o:p></o:p></span></li></ul><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>The only =
response-header differences were the expected Date and Expires =
timestamps.<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></p><p class=3DMsoNormal><b><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>POST xcode =
parameter<o:p></o:p></span></b></p><p class=3DMsoNormal><b><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></b></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>The =
SecurityMetrics request submitted an xcode value while leaving the =
associated xcmd command blank.<o:p></o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>In the =
application code, when xcmd is blank, the submitted xcode value is =
discarded and replaced by the separate code parameter. As the scanner =
also supplied a blank code value, the resulting command and product code =
are both blank and the basket-operation routine exits without processing =
the submitted xcode.<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>We =
reproduced this by comparing an ordinary invalid product code with the =
reported traversal value, again using the same ASP session and leaving =
xcmd, cmd and code blank.<o:p></o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>The results =
were:<o:p></o:p></span></p><ul style=3D'margin-top:0cm' type=3Ddisc><li =
class=3DMsoNormal style=3D'mso-list:l0 level1 lfo4'><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>HTTP status: =
200 OK for both <o:p></o:p></span></li><li class=3DMsoNormal =
style=3D'mso-list:l0 level1 lfo4'><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>Content =
length: 63708 bytes for both <o:p></o:p></span></li><li =
class=3DMsoNormal style=3D'mso-list:l0 level1 lfo4'><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>HTML =
responses: identical apart from a dynamic page-execution timing comment =
<o:p></o:p></span></li><li class=3DMsoNormal style=3D'mso-list:l0 level1 =
lfo4'><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>Baseline =
timing comment: 0.063 secs <o:p></o:p></span></li><li class=3DMsoNormal =
style=3D'mso-list:l0 level1 lfo4'><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>Traversal =
timing comment: 0.043 secs <o:p></o:p></span></li></ul><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>The response =
headers again differed only in their normal Date and Expires =
timestamps.<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>The changing =
execution-time comment is expected dynamic content and does not indicate =
file access. The scan evidence also shows similar minor execution-time =
differences, without demonstrating any file access or =
modification.<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></p><p class=3DMsoNormal><b><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>Code =
review<o:p></o:p></span></b></p><p class=3DMsoNormal><b><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></b></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>Neither =
sortby nor xcode is passed to any:<o:p></o:p></span></p><ul =
style=3D'margin-top:0cm' type=3Ddisc><li class=3DMsoNormal =
style=3D'mso-list:l4 level1 lfo5'><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>filesystem =
function; <o:p></o:p></span></li><li class=3DMsoNormal =
style=3D'mso-list:l4 level1 lfo5'><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>path-mapping =
function; <o:p></o:p></span></li><li class=3DMsoNormal =
style=3D'mso-list:l4 level1 lfo5'><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>file stream; =
<o:p></o:p></span></li><li class=3DMsoNormal style=3D'mso-list:l4 level1 =
lfo5'><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>dynamic =
include; <o:p></o:p></span></li><li class=3DMsoNormal =
style=3D'mso-list:l4 level1 lfo5'><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>operating-sys=
tem command; or <o:p></o:p></span></li><li class=3DMsoNormal =
style=3D'mso-list:l4 level1 lfo5'><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>executable =
process. <o:p></o:p></span></li></ul><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>There are no =
relevant calls to functions such as Server.MapPath, FileSystemObject, =
ADODB.Stream, Server.Execute, Response.WriteFile or =
WScript.Shell.<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>In =
legitimate use, xcode represents either a product code or a currency =
code. Product codes are used only in database lookups with SQL escaping =
and product-existence validation. Currency codes must match an allowed =
currency list or a record in the currencies =
table.<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>No file =
contents were disclosed, no file was modified, no filesystem error =
occurred, and the traversal value was not reflected in the =
response.<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>We also =
inspected the target file identified by the scanner. The Windows SAM =
file at C:\Windows\System32\config\SAM has a last-modified timestamp of =
6 May 2026 at 04:11. The SecurityMetrics scan was performed on 24 July =
2026 between 15:05 and 16:28. The file was therefore not modified during =
or as a result of the scan.<o:p></o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>We therefore =
believe the reported <b>CGI Generic Path Traversal (write test)</b> =
vulnerability is a false positive. Please could this finding be reviewed =
manually and marked as a false positive?<o:p></o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>We can =
provide the response files, comparison results and relevant source-code =
extracts if required.<o:p></o:p></span></p><div class=3DMsoNormal =
align=3Dcenter style=3D'text-align:center'><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><hr size=3D1 =
width=3D"100%" align=3Dcenter></span></div><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>Thanks,<o:p><=
/o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>Surinder<o:p>=
</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </=
o:p></span></p><div style=3D'border:none;border-top:solid #E1E1E1 =
1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=3DMsoNormal><b><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:=
none;mso-fareast-language:EN-GB'>From:</span></b><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:=
none;mso-fareast-language:EN-GB'> Paul Brown (CIRC) <<a =
href=3D"mailto:paul@castironradiatorcentre.co.uk">paul@castironradiatorce=
ntre.co.uk</a>> <br><b>Sent:</b> 27 July 2026 08:31<br><b>To:</b> =
Surinder Singh <<a =
href=3D"mailto:surinder@itpartnership.com">surinder@itpartnership.com</a>=
><br><b>Subject:</b> IMPORTANT -VDK PCI scan =
failure<br><b>Importance:</b> High<o:p></o:p></span></p></div><p =
class=3DMsoNormal><o:p> </o:p></p><p class=3DMsoNormal>Morning =
Surinder,<o:p></o:p></p><p class=3DMsoNormal><o:p> </o:p></p><p =
class=3DMsoNormal>Hope your weekend went well!<o:p></o:p></p><p =
class=3DMsoNormal><o:p> </o:p></p><p class=3DMsoNormal>Can you take =
a look at the attached report and look to fix the issue raised . Appears =
to only be one failed issue.<o:p></o:p></p><p =
class=3DMsoNormal><o:p> </o:p></p><p class=3DMsoNormal>It is very =
important that this is corrected as it affects the Worldpay integration =
and costs we are charged for currently not meeting their PCI =
requirements.<o:p></o:p></p><p class=3DMsoNormal><o:p> </o:p></p><p =
class=3DMsoNormal>Would be grateful if you could let me know as soon as =
possible when fixed and I will sort out a further vulnerability scan so =
that I can get compliance re-established<o:p></o:p></p><p =
class=3DMsoNormal><o:p> </o:p></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-lang=
uage:EN-GB'>Kind regards,</span><span =
style=3D'mso-ligatures:none;mso-fareast-language:EN-GB'><o:p></o:p></span=
></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-lang=
uage:EN-GB'> </span><span =
style=3D'mso-ligatures:none;mso-fareast-language:EN-GB'><o:p></o:p></span=
></p><p class=3DMsoNormal><b><i><span =
style=3D'color:black;mso-ligatures:none;mso-fareast-language:EN-GB'>Paul<=
/span></i></b><span =
style=3D'mso-ligatures:none;mso-fareast-language:EN-GB'><o:p></o:p></span=
></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-lang=
uage:EN-GB'> </span><span =
style=3D'mso-ligatures:none;mso-fareast-language:EN-GB'><o:p></o:p></span=
></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-lang=
uage:EN-GB'><img border=3D0 width=3D172 height=3D59 =
style=3D'width:1.7916in;height:.618in' id=3D"Picture_x0020_1" =
src=3D"cid:image001.png@01DD1DD3.6ACF5320" alt=3D"CIRC Logo - =
Copy"></span><span =
style=3D'mso-ligatures:none;mso-fareast-language:EN-GB'><o:p></o:p></span=
></p><p class=3DMsoNormal><i><span =
style=3D'font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-lang=
uage:EN-GB'> </span></i><span =
style=3D'mso-ligatures:none;mso-fareast-language:EN-GB'><o:p></o:p></span=
></p><p class=3DMsoNormal><b><i><span =
style=3D'font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-lang=
uage:EN-GB'>Tel:</span></i></b><i><span =
style=3D'font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-lang=
uage:EN-GB'> 024 76303999 <b>Ext:</b> 204</span></i><span =
style=3D'mso-ligatures:none;mso-fareast-language:EN-GB'><o:p></o:p></span=
></p><p class=3DMsoNormal><b><i><span =
style=3D'font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-lang=
uage:EN-GB'>Mob:</span></i></b><i><span =
style=3D'font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-lang=
uage:EN-GB'> 07950 606244 </span></i><span =
style=3D'mso-ligatures:none;mso-fareast-language:EN-GB'><o:p></o:p></span=
></p><p class=3DMsoNormal><b><i><span =
style=3D'font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-lang=
uage:EN-GB'>email</span></i></b><i><span =
style=3D'font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-lang=
uage:EN-GB'>: <u><a =
href=3D"mailto:paul@castironradiatorcentre.co.uk">paul@castironradiatorce=
ntre.co.uk</a></u> </span></i><span =
style=3D'mso-ligatures:none;mso-fareast-language:EN-GB'><o:p></o:p></span=
></p><p class=3DMsoNormal><b><i><span =
style=3D'font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-lang=
uage:EN-GB'>WEBSITE</span></i></b><i><span =
style=3D'font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-lang=
uage:EN-GB'>: </span></i><b><i><u><span =
style=3D'font-size:11.0pt;color:blue;mso-ligatures:none;mso-fareast-langu=
age:EN-GB'><a href=3D"http://www.castironradiatorcentre.co.uk/" =
target=3D"_blank" =
title=3D"http://www.castironradiatorcentre.co.uk/"><span =
style=3D'color:blue'>Cast Iron Radiator =
Centre</span></a></span></u></i></b><span =
style=3D'mso-ligatures:none;mso-fareast-language:EN-GB'><o:p></o:p></span=
></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-lang=
uage:EN-GB'> </span><span =
style=3D'mso-ligatures:none;mso-fareast-language:EN-GB'><o:p></o:p></span=
></p><p class=3DMsoNormal><i><span =
style=3D'font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-lang=
uage:EN-GB'>CONFIDENTIALITY NOTICE: This email and any attachments are =
confidential and intended solely for the use of the individual or entity =
to whom they are addressed. If you have received this email in error, =
please notify the sender immediately and delete it from your system. You =
must not disclose, copy, or distribute any part of this email if you are =
not the intended recipient.</span></i><span =
style=3D'mso-ligatures:none;mso-fareast-language:EN-GB'><o:p></o:p></span=
></p><p class=3DMsoNormal><i><span =
style=3D'font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-lang=
uage:EN-GB'> </span></i><span =
style=3D'mso-ligatures:none;mso-fareast-language:EN-GB'><o:p></o:p></span=
></p><p class=3DMsoNormal><i><span =
style=3D'font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-lang=
uage:EN-GB'>DISCLAIMER: The views and opinions expressed in this email =
are those of the author and do not necessarily represent the views of =
our company. The information contained in this email is for general =
information purposes only. While we endeavour to keep the information up =
to date and correct, we make no representations or warranties of any =
kind, express or implied, about the completeness, accuracy, reliability, =
suitability, or availability with respect to the email or the =
information, products, services, or related graphics contained in the =
email for any purpose. Any reliance you place on such information is =
therefore strictly at your own risk.</span></i><span =
style=3D'mso-ligatures:none;mso-fareast-language:EN-GB'><o:p></o:p></span=
></p><p class=3DMsoNormal><i><span =
style=3D'font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-lang=
uage:EN-GB'> </span></i><span =
style=3D'mso-ligatures:none;mso-fareast-language:EN-GB'><o:p></o:p></span=
></p><p class=3DMsoNormal><i><span =
style=3D'font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-lang=
uage:EN-GB'>VIRUS WARNING: Although we have taken reasonable precautions =
to ensure no viruses are present in this email, we cannot accept =
responsibility for any loss or damage arising from the use of this email =
or attachments. It is your responsibility to ensure that your computer =
systems are adequately protected from viruses and other harmful =
code.</span></i><span =
style=3D'mso-ligatures:none;mso-fareast-language:EN-GB'><o:p></o:p></span=
></p><p class=3DMsoNormal><i><span =
style=3D'font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-lang=
uage:EN-GB'> </span></i><span =
style=3D'mso-ligatures:none;mso-fareast-language:EN-GB'><o:p></o:p></span=
></p><p class=3DMsoNormal><i><span =
style=3D'font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-lang=
uage:EN-GB'>LEGAL NOTICE: This email does not constitute legal advice =
and is not intended to establish any attorney-client relationship. You =
should seek appropriate legal advice before taking or refraining from =
any action based on the contents of this email.</span></i><span =
style=3D'mso-ligatures:none;mso-fareast-language:EN-GB'><o:p></o:p></span=
></p><p class=3DMsoNormal><i><span =
style=3D'font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-lang=
uage:EN-GB'> </span></i><span =
style=3D'mso-ligatures:none;mso-fareast-language:EN-GB'><o:p></o:p></span=
></p><p class=3DMsoNormal><i><span =
style=3D'font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-lang=
uage:EN-GB'>COMPLIANCE WITH REGULATIONS: Our company operates in =
accordance with relevant data protection regulations. If you have any =
concerns about how your personal data is being processed, please =
contact</span></i><span =
style=3D'font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-lang=
uage:EN-GB'> <i>our company using the above =
details.</i></span><span =
style=3D'mso-ligatures:none;mso-fareast-language:EN-GB'><o:p></o:p></span=
></p><p class=3DMsoNormal><span =
style=3D'mso-ligatures:none;mso-fareast-language:EN-GB'> </span><o:p=
></o:p></p></div></body></html>
------=_NextPart_001_0C5D_01DD1E76.336A1F70--
------=_NextPart_000_0C5C_01DD1E76.336A1F70
Content-Type: image/png;
name="image001.png"
Content-Transfer-Encoding: base64
Content-ID: <image001.png@01DD1DD3.6ACF5320>
iVBORw0KGgoAAAANSUhEUgAAAK0AAAA7CAYAAAAJkAodAAAAAXNSR0IArs4c6QAAFeRJREFUeF7t
3QOQJEvXBuDca9u2bdu2bdu2bdu2bdu2bd8vnvrjTNTU1nRXz/TMzt6/T8TEbk9nZSXePPkeZE6f
f//999/UktYI9Ecj0KcF2v5otlpNzUagBdoWEPq7EWiBtr+bslaDW6BtYaC/G4EWaPu7KWs1uAXa
Fgb6uxFogba/m7JWg7sNtJ988kn6+OOP0xtvvJG++OKL9Oeff6a///47DTzwwGnYYYdNE000URp9
9NHTZJNN1iOzcP/996ebbropffTRR+mvv/5KAw00UJp00knToosummafffYO2/DCCy+k2267LT37
7LNZ+z2n/UsvvXRaYoklOnzu7bffTtdcc0167rnn0i+//JIGGWSQ7DnPLLfccu2ee++995LyytSS
P/74I0088cRpnHHG6avYa6+9loy58SXKzjzzzGmYYYbJ2n3XXXelIYYYot1zffr0SYMPPngabbTR
0phjjlnz3fpw8803Zz+///57+ueff7L2zjXXXGmhhRZKE044YV99euedd7L2GO/JJ588ew8xB6+/
/npbf9U3wwwzpBFGGKESFpoK2k8//TTdcccd6ZZbbkkjjjhiGnfccbPBGG644dLQQw+dBhxwwGwC
v/nmm/T1118nnQLoCSaYIC2zzDJpxhlnrNToRgqde+65aYMNNqj5iHZdfvnlacUVV2wr9+CDD6aV
Vlopa18t2X333dMhhxzSVuStt95Kiy++ePJvLdl1113TwQcfnI3JXnvtlf2/iniXdxZl5ZVXTldd
dVW7X999991pgQUWyMZ6pJFGqlv9NNNMk/bdd9+0wgortCu77LLLphtuuKHm81NPPXW2SCkjsvPO
O6ejjjqq3TMRxzrggAOy9+Tl+uuvzzBQRZoCWhN0+umnpy+//DLTXAZq1FFHrfL+9PPPP6dnnnkm
04KfffZZBpyqja/3guuuuy4tv/zy9Yq1ff/II49kWtdiKmqOWpVsuumm6bTTTss0Gm2qT1Vkhx12
SEcffXQGWMCtIsccc0zafvvt+yq64YYbpnPOOafd7y08mvC7775Lww8/fJXqszJLLbVUuvHGG7P/
09ZPPfVU5WcDmPvvv3/ab7/92j231VZbpRNPPDHr80477dTuu9tvvz0tssgild7TJdCaJANukjfa
aKNsgLoitrezzz472zp0arrpputKdZl2oCXyghLYXtGW999/v913Dz/8cJpjjjnSu+++m2n/vIwy
yihpqqmmSj/88ENfk6jvZ555ZkaBLNZvv/227dGhhhoqGxfa7sknn2xX5y677JIOP/zwdNBBB6W9
9967Ul9NOLAXpQy0Dz30UJpzzjlLQUvDW2Dff/99ttjyQunQ0sQifuyxx9p9P/fcc2dbu9/nFygq
gJaQMtD6PcV22WWXpa233rrnQfv8888nap4mW2uttSoNeNVCAHXYYYdldGHLLbes+lhf5WiLotZG
XWzfp5xySl91h6bFMccff/x29WnHSSedlPS7uJg23njjdMYZZ2SgxdvQn5Dpp58+20lMFuDnBUXQ
z9C0KNSPP/5Y2t/4zpa74447dhm08847b7rvvvvSq6++mqaYYop29S288MIZzSNAb1zyEtqUZrzz
zjvbvqoC2tlmmy3ttttuffH6bte0V155ZcafbFX1CHynEZdStihogiOPPDINMMAADVdVBlrtRkFM
Pt6Vl1qgxYvtAo8++mimjfNSC7S4HmOujHIEaPN1lVEFvHy99dar2f9GNa0+2Fm6AlrAf+CBBxoC
rcKMUcojL90KWrzp8ccfz7hJPWu3YZSVPHD++ecn29ypp56aWe6NSBloLTgGVm8F7RFHHJGAOS/R
5lp97yxoX3755Yz25KWqpu0saMv60W2gZeExmDoDoEbAViwLuFxOxx13XEPV9CbQlmm0oBz5TqEL
Re8ADrjqqqt2i6b9T4P2lVdeySzcK664omGN1xDSOijMYGE8FK3OWnX3JtCiOVxC4Uflm+RiYp3/
fwGtvuP9PaZpV1lllWTrGm+88UpfSpNMMskkGbDIm2++mbmNgotynrPaY9J8P8YYY6QhhxwyK8+S
F2yoRTlYnAw/1m0VqQXaQw89NO2xxx7tqgkXUZkh1llOy5hsxGX0X9a0F110UYdGe9PpATcL63WT
TTYpxUrwMI5lYAzLXHABAPhwN9tss8xoEw0J/6lojGADMo8fkd9++y0NOuigpe9R15577pnOO++8
NvB3VtNeeuml6ayzzmpbNDThySefnPG7MtCGL5YnoBgEqWWIaZ/dYZ999snGsJ70FGi54SxSyiQC
AtG27uK0jFhGJU9LUZoKWu4bWgbQOhJuHeFKwh3CMtXAss+//vprFnG59dZbs+8ZdVdffXWmxYmQ
qQBFR4JP08YMj3pSS9PWerYMtEsuuWTme3ziiSfSFlts0e7xAK2+c+JbAGWy9tprZx6XWtGpngKt
Obv44ouz/hQ9E3yz4eaq5fJq1BAz54sttlgSPu5W0JoovrVaQPI98AVIOZ9Z/GWfcRpU49prr82+
t3Uy8A488MDsc3SsI1DhggBrtRZj6cVnmgnaWiAP0CpjR7Gz1BJ+ba6tshyCngJtR+1D555++uk2
X3QzQWs+RNvK3HpN07SiG5I7ij61YofrgXaeeebJtiJSBK0BosUDtPU0rTq422i0ekGNfgFa7RNI
EO1CY2qJfght5qVfg1aSE1sjpDtAW+ZubBpobR84Zr2tuKdB+8EHH2R0QoSqltQCrZDxhx9+2Gb4
oS34rKyoMnpQVdPmy0kgEhg59thjSx+P3IPeBFqJTiKSkXHVHaA1JhZ1XpoGWsaHkCGvQC3padBq
y7bbbpsljnTkzVCmFmjLMo2ENfG0MtAKSHC7oTNFn2meHpSNkx1LWxmoeSmLiPWUpp122mmznQB3
LYbKI8Srrf0VaGkeoL3gggtqAtaX/QK0LP2xxx67ZkZYo37aSJgpAy3PCa4KtEXfaj3QBi2SPBMJ
JX7XL0HL7uC1Keur/NjIKeivQPvSSy9lK7GYE1mG4H4B2nvuuScDUHGbybevUdB2NfeAkchgteD5
qyU/8z0zNHlhJNPknev9ErSRe9CTEbEwxLqNHrDiJXlUybLqF6AVjKBtw1VWtph6GrS0KC6YT9dz
MkPgpQXa/6NrvAfdBlpalj90jTXW6JX0gIGI1wJuR4k0PQ3astTEyPJqgbYHQCsK5tzO/PPP3ytB
q1HrrrtudmJAZK2qpuVekxgu+aZ4AqCr9KAMtAwegZeffvopO4LUWzhtM+gBbDBeQ+rl03a7puU3
xc9mmWWWXgtaESbGUUdBhjJNy/20+uqrZ1uUhZmX7gAtzwsftfC2nIn/AmglTzEqeVRE1ELszHg9
KTu50O2gZYDNNNNMab755uu1oK2naUXdiof0anXGiV2BkM4mzJgwnFY+RRXZbrvt+vLh9pTLq6qm
dUrDaY2qUuuMWLeDVmKDbXe11Var295+YYgBSHDayCwrNtSJAXH0KiCSzMMbwcIvOyO2zjrrJHm9
3GLFs3CRAeb9ZadiOxpAaZ7K58VpW0lBebnkkkuy3aGWWMBF92QsQmfWisez7aBC77xEeHdebPu8
M6SMRnXUDvkZ8q2JBKGIckb5OHFbtjDrhe/z7+zwYKPz7Sz0YnJIWYP7BWireA+irSiEgRJJc14/
RDaZ9EkpimuuuWbb72naOBkquYMLS76E3UcyOtoUp1t9J9iAboTwfzqoqGzxzBcXGIA5J+VgYVFO
OOGELIhh+yWSbyQJ1TtVLAjkhEPwewtV/i6fsjqceRt55JGzOlEUubxAxOWFtjjmTygDvlnR0BBe
JMEYIfbPP/+8XZM954yZNqozxHgcf/zxbVl0xoEiNHaCLPIPoo++s+D4h6tIh6B98cUX04UXXljT
pRQvaCZoObVFZOKiB6ApHjL03ip+2uIAGHBWPKNImiCtGpNVZbAaLcMws7iAZrDBBssmSbpm/yzm
xfjpm0Xn1HJnzu91ZQw6BC3089GWRcQA2nZJk5BmgpaWcv8BzUZw6nvvvbevPlqtY401VtPuSOjK
ILae7dkRqHnvgdClbax4B0Cc0w/SXSsVUZlGsrzirL6LHmRBuS+gTBgxOG2ZFu7ZIWy9radHoCZo
Q8vSqnmJ1LJIABGVwgMJkBZB3Aho5aOyWBkfXCvS/IqCm+JMQF1LUAGZVhF8YLChA8UkbDuHjC9h
V1ue9wffdEdWJC37F61g1MTpCkYbHqjfcdzI9skItOA8Y0fgr/V/2WVufMkbj3i2epUjntUel2h4
F0NJe3x2kUk8a1v2HH5ddtpDZI7lH+2Qq6Euz+HibgbKH29SP34qPRGlwY8pBadN7LzaOeWUU2Zz
LbiTT+b2HT+08ZUlFseqtFXmHD4d5fHofEAI1fCeOHpVbxHUBK2O8cUxyspAW1a5ycvfSuLzrLPO
2ubPYwRwQ4WVyYJlEOTvw4p643hO8T2iYAaCn7aW4L3OJZl4fTFoJoxf1+LAaRkYjBbtNHgmyoSw
6lET2twzvgdOk+HHQhSksIDxVmX834RpX9RjcrzXM+6vcusNCmSC1BmGnpMEThA4POr9JNqj7dJD
AU571A1gxhLovIMLK38XmTxl9zTg0uoDHj/KeoeFw1h0gYh2+DEOjFbRUJ4U7+DL5uXwWf/1jbFI
cehTvg8MKVTRaWKKQfvi0j5t1j8X0bmRx/yFaIs7KHxXRepei6RjDKO8ZReaNuiBM0Vu5QtNm8/e
V8YZqXDk6wRLN46Du+ANsOKqH0TfqrP9czHlrxhSv4FYf/31s8EN67OjjqIaLGoTBxSuNAIwk2Mx
0n6AZEBpOXkCLGRtpm25mbifABLIaBmLjFbhBXDQ0iTSTMCHNnmn40MAwlLGz+UemHAT43s/NKd6
1UWLeZ+bGNURGo7m5mtWzjEVVj5A0Ko0rEmOK4vUl08e4kKyaAHL/Nl1aF27iXYDL0UBtMbUArE4
7F6OrNP2REK4mxpFvvQh8pjtGMZV28ypPnCVUVhcXdojbVRf1GVMtV8/RCJ9ry3eC7R+V/UGzbqg
tT1vvvnm7W7ki4SH/F9zQiEAL64M8gztIEChnAx9GnbBBRfMBoPGoB0iN9Xql4QdfmF1OXgIaHlx
ZxaRDlhPArQGFTcHILcj+szQo7mA1sQ6rGhAfTah2k3bhs+U1uf+U4+JstXqYxG0ompusaHd+Cpt
53aqGAMgsPVadEAA3OoxiRaoxW0BmGDa3GTSSm5lAT6g1T4L2xjIFPPZ1py/48u1Rn7U5RntiOP/
xt7vgdauw70HbNpMQzr0iTLR4oAM2ICF9lhU+gJw7A7tBnoRMMJDA9jqdepFfTSzRU/x+dEnn+10
+mCO0YqgFPXmtS5oVcBvqOE0HInj1935J8hsJVZ8bJXei+fFMZaOTuzmO5wHLc1Nq8s9MOBF0NLE
BtREAlIRtAZYfjEgVgUt/y+6ENob6MOo9Z64t9aCVSeNLcwMUAAqiAGUtGoRtM6XhaFssmuB1s6G
v9oBADwPWtqSDzgfMAnQxvZvno2JxYZOxaliGhv1oi2D3tnJ7MRA6c40oI1Qex60QG1MixfR1QOs
7yuBVkHbqS3dNmo1OXpcvNOqygurlkH+aZ58tAbwTF7VKyHzoLW6tdt2W6ZpgVa9NEmzQEtL03BF
0Hq/YActRpvRhADSKGjRMIu4CmgZtTStvqEpngE0oMWF83MZoAVwFMzW3xnQmiugldQEpGikndZc
+GzXqZL6WsRMZdDyyZpQHLGnnckabcHQurbnqhKgxRsNFHpA09rOLEJADXqA1jC8aAn966qmjSM2
DBb8krYKTdsM0OKLwsdsjvAi5McmTw9oVqDDrWlxhvFXX32V7aC0pnEQGbR7URIBWjuShYGysP4b
0bRAKXfWto/mWRx2D0A2FxaD7ygK1IPHqapUBq0KaSmDIWTXkyKkyAAC3EYWDNDSLrawcEvRbOqI
tERGgwH0PTCF1d9V0OJ6tn/vMmERrEEPugravPdA3dpuK84nN+VBa7EU/dncVrin+3RxVe1DOVCa
AC0lYXwoKllq+lOVHqArQe0sBu/wLNoQhpiFjc9aDKKvVaUh0KqUb5afDbnuKFGl6surlANYF/za
Yhq9pTFAawD5LAFIm21ZBs4Kt3sEaE0+zWOwmwFaQLDFAlmzQUsLaicQWAQ0IuMwJA9avNEY2Glo
WqFk9IumNRZhH+CYjOc8aBlYlBV/NTrTKGjtMOq3uBiK/g3jUluMPdAWk2tqYaNh0KqMgWSbBdzi
RcFVgFi1DE1gcG1PVS3LMkPM71joOK07HOKWG8kkee8BQ0EiRzPogQVg6zbZ3tlMemAsAJTHBogs
RGDI3yaeBy2XI3cX16KyygFScFpGKcoQ0gzQWkyRWBSnYFAAbj2gtZBpdoutUekUaL2Ef5Dry3Gc
vFO70QaUlbd18VDw25X9fYGq78gbYlZ5GGK0FFcbF1uAFq9jKMQf7+iqpqUFO/IedJUe0N4x4VUN
Md4DWV+e3WabbdpcXsDONZXnlM0CLf6KC9udgbhoiKEm2tKodBq0XmRibK+2He6XKqccajVQuNGl
zaI5PAWiK12RMu9BZ11eLN3w09JWVfy0XQEtfspPy11V5qcFWi44LrF63gPA5nrjPy66vGg8oC1z
eZnfztKDKi4vnig7YKPSJdDGy3BcTn+kWiIwK7HKnwDyPDIuYiKrnRvN30iIDK9GO1Ms3yw/Le6F
E7J05UTY6g04ENcKLjQKWlSIsQlYzufR/j4DVhhaEVyoB1o3tohSWmByhdUdid20GwqEHsQ80f5o
EyoWEbHuBC1DNXKbuTYFn/wRlyrSFNDGizj/8TeDg+uyWIU7TTgL3mQg3TSqsKIti8PfdyhGrT9C
V6UzxTJCj0BmQmgkyTO0DXpgIoVxAwToQETETDSOpwxa4XOEKmk9fBW1wMfcgsitpQwObqHYXgGA
lsJp488b2T2ERNUlmsQ4tD37PyNTaNQzXEEc9t7j/9xTXHTCpNEeLi8GljqNK/Dl79uVl8zqN7Ys
d9oYjwUQnBZgUKNi7oFFKFGKi9P70TQeGH5efdLHyBuQQyBZR3+MAxGGR7FoWgpI/WwfLjB0wRgb
t6iDAmAQ21GaFsbtDFg8IzLCWc65DqQmyESwFv1w/dAW4vllVz929r3553BjWtwE2WrtBAbfIAMs
a9nk0jrCtADFUxERLz5LgYFon4nXdtTAYiSuNDXonqGJAdg7LQwg0/fwj1qUQGSi5AjbZQBOufDE
8DJY9OpRBzCiSdqmPO2pPepBx/iAIzei6OuUgWYRRZYXr4FdENCA13GcOBQaoVk7JaPNAjJOeKid
lD2gPYyr8OJI/rHoPBu3aka9ygCh8RLa9lkf/FjE+YgmjS64UXV3bqqmbQbQWnW0RqDeCLRAW2+E
Wt/3uhFogbbXTUmrQfVGoAXaeiPU+r7XjUALtL1uSloNqjcCLdDWG6HW971uBFqg7XVT0mpQvRFo
gbbeCLW+73Uj8D8WwKqLT4nVEQAAAABJRU5ErkJggg==
------=_NextPart_000_0C5C_01DD1E76.336A1F70--