File: D:/hMailServer/Data/itpartnership.com/surinder/78/{78296053-ECE2-42B5-9830-1BB053E21907}.eml
Return-Path: paul@castironradiatorcentre.co.uk
Delivered-To: surinder@itpartnership.com
Received: from CWXP265CU010.outbound.protection.outlook.com (mail-ukwestazon11022134.outbound.protection.outlook.com [52.101.101.134])
by mail.itpartnership.com with ESMTPS
(version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256)
; Mon, 27 Jul 2026 15:01:26 +0100
ARC-Seal: i=3; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=pass;
b=KvEQNw/TwmATKYj07B1UyHXXQCJr9ApxWNSS3G790HVC/bsqJpqIfJK83BVpR1VN1SnFKmZrdGTfrCXYiheblmyh7SfZvLozX/y1XD30YNrZAf3QioOCkn4VcUi8cG8tMsDbJiuElQlUmUL5TtEaBXSixv15iWhKfN2ZQX/yvmGHm0T/lELzn7tnXh40ZQ120laE+S03vXEut9LP0LCkawS/m4ZjJMSoaW5hleIzwvYjSIxb3eJVCayp7laLia4sOApNaEg12DkfjMQoICL5AWwJM/MHL4jiS8EmzmmSfoug/Yur1CzIgcgK4U1avnIoIytNBZJQJPOReRLG7KaS4g==
ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector10001; h=From:Date:Subject:Message-ID:MIME-Version;
bh=BmK40gmcuAR4BUURBKiZGVdUqmIUVqyPpvYaL3h5xiQ=;
b=d1NYabkw850pjeFtdamWNx78XUwbztUMtoA1fubvGnxHwY6O+hRtbyfLDKLPF+IzgLp5rQCv2ttN0MAwiuZkxQyZ42Ka/RlvNMeQqv41G4zU/X3uS2+mjjhoKx00gQ5Dt4cEE4pIuaG1fPXBTYWaH0y4T/zBDbRSt2kzjC12vKWazCZDVqFgVF7CHqFjEKEcaMO/bZHsIfN6/uvlNPSWe8W2ysQ0yqJn9BFUHLPsUKIpo+mHHtczg0fEPMTikSyZQmVZE2CGk08ENuWYG0UfwzrhlDxx0Kbeq6byI0G9goNeTVv1AdT+WToM1jzoW4jE0Rf7HwmrGjyudnfmAgCJmQ==
ARC-Authentication-Results: i=3; mx.microsoft.com 1; spf=pass (sender ip is
52.17.62.50) smtp.rcpttodomain=itpartnership.com
smtp.mailfrom=castironradiatorcentre.co.uk; dmarc=pass (p=reject sp=reject
pct=100) action=none header.from=castironradiatorcentre.co.uk; dkim=pass
(signature was verified) header.d=castironradiatorcentre.co.uk; arc=pass (0
oda=1 ltdi=1 spf=[1,1,smtp.mailfrom=castironradiatorcentre.co.uk]
dkim=[1,1,header.d=castironradiatorcentre.co.uk]
dmarc=[1,1,header.from=castironradiatorcentre.co.uk])
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=castironradiatorcentre.co.uk; s=selector1;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=BmK40gmcuAR4BUURBKiZGVdUqmIUVqyPpvYaL3h5xiQ=;
b=kmfJ3PIOer2EVUg9az7Ayyy0mqY71StOJ3fyTx9xZ1HgNVi4dw/kpM/gOMd5BShsWTocE4IFHYEUBr9CzAuL7hI7tj77NAlVj1xeL/+WnOV0a2n+2o+rUpsF83VCJ6OZXcBoorxCpiQUDzlO89lyQJpsn3eM8mGyZ538lrd0j+Pu2C/Q1ujV2QtWjjGZHlN4y6F/3e2vzm4G1bKNfYxjQZK+amZ/mlP+WYV+oYap/LN7gwNKu+sqgv1VFd//BkWr6X1kGty4yHSe8s00nTDR0fXTO+LCsIGXaGGgi5FyYp6Wt1hCygcc9/MM173eq+KWlJav0xegdngUsDx9aH0LBw==
Received: from CW1P302CA0023.GBRP302.PROD.OUTLOOK.COM (2603:10a6:400:297::19)
by CWXP123MB4277.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:db::8) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.13; Mon, 27 Jul
2026 14:01:23 +0000
Received: from CW2PEPF000056BE.GBRP265.PROD.OUTLOOK.COM
(2603:10a6:400:297:cafe::55) by CW1P302CA0023.outlook.office365.com
(2603:10a6:400:297::19) with Microsoft SMTP Server (version=TLS1_3,
cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.13 via Frontend Transport; Mon,
27 Jul 2026 14:01:23 +0000
X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 52.17.62.50)
smtp.mailfrom=castironradiatorcentre.co.uk; dkim=pass (signature was
verified) header.d=castironradiatorcentre.co.uk;dmarc=pass action=none
header.from=castironradiatorcentre.co.uk;
Received-SPF: Pass (protection.outlook.com: domain of
castironradiatorcentre.co.uk designates 52.17.62.50 as permitted sender)
receiver=protection.outlook.com; client-ip=52.17.62.50;
helo=eu-dlp.cloud-sec-av.com; pr=C
Received: from eu-dlp.cloud-sec-av.com (52.17.62.50) by
CW2PEPF000056BE.mail.protection.outlook.com (10.167.240.22) with Microsoft
SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.5
via Frontend Transport; Mon, 27 Jul 2026 14:01:23 +0000
Received: from emails-8560156-15-mt-prod-cp-eu-2.checkpointcloudsec.com (ip-10-20-5-100.eu-west-1.compute.internal [10.20.5.100])
by mta-outgoing-dlp-670-mt-prod-cp-eu-2.checkpointcloudsec.com (Postfix) with ESMTPS id E1B5C7FF0D
for <surinder@itpartnership.com>; Mon, 27 Jul 2026 14:01:22 +0000 (UTC)
X-Mailbox-Line: From b'paul@castironradiatorcentre.co.uk' Mon Jul 27 14:01:13 2026
ARC-Seal: i=2; cv=pass; a=rsa-sha256; d=checkpointcloudsec.com;
s=arcselector01; t=1785160882;
b=ZDyN4EI2d/Mh5Bh3sPmvpO9EI1bmV6tzFVL9KYMdqihan5qfoxbZnC57Dn+aPA9FQTpuC
xgCwf7t10hcjai276pMONiAcsVFEqelhKtxH//Olfg3JClSUB2GiTR1+1bSPk3Q1lgApYiQ
RfTwaZqYCGK+xg9PBKTgZHyAKwLbpns=
ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed;
d=checkpointcloudsec.com; s=arcselector01; t=1785160882; h=from : to :
subject : date : message-id : content-type : mime-version;
bh=BmK40gmcuAR4BUURBKiZGVdUqmIUVqyPpvYaL3h5xiQ=;
b=dxnq/sphHtytkk3Ykmb8hug1pt/QW9tOfy9ljpLCW4Ec1liJY470Cz7EJZp1uvSYvfJns
DUBAGuFXipx8PJNpB++/q2HcRFdeg7o/z6vhE2Uz2/KRheVY2WL348vn9FQ20gYR2vfWKXi
vPoLQrxP2eUf4No+KKJHgcaIhcc3Nc8=
ARC-Authentication-Results: i=2; mx.checkpointcloudsec.com;
arc=pass;
dkim=none header.d=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=castironradiatorcentre.co.uk; s=selector1;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=BmK40gmcuAR4BUURBKiZGVdUqmIUVqyPpvYaL3h5xiQ=;
b=kmfJ3PIOer2EVUg9az7Ayyy0mqY71StOJ3fyTx9xZ1HgNVi4dw/kpM/gOMd5BShsWTocE4IFHYEUBr9CzAuL7hI7tj77NAlVj1xeL/+WnOV0a2n+2o+rUpsF83VCJ6OZXcBoorxCpiQUDzlO89lyQJpsn3eM8mGyZ538lrd0j+Pu2C/Q1ujV2QtWjjGZHlN4y6F/3e2vzm4G1bKNfYxjQZK+amZ/mlP+WYV+oYap/LN7gwNKu+sqgv1VFd//BkWr6X1kGty4yHSe8s00nTDR0fXTO+LCsIGXaGGgi5FyYp6Wt1hCygcc9/MM173eq+KWlJav0xegdngUsDx9aH0LBw==
Received: from CWLP123MB5865.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:15d::8)
by LO6P123MB7143.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:33d::7) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.13; Mon, 27 Jul
2026 14:01:08 +0000
Received: from CWLP123MB5865.GBRP123.PROD.OUTLOOK.COM
([fe80::2208:7b09:2b90:ab24]) by CWLP123MB5865.GBRP123.PROD.OUTLOOK.COM
([fe80::2208:7b09:2b90:ab24%5]) with mapi id 15.21.0245.012; Mon, 27 Jul 2026
14:01:08 +0000
From: "Paul Brown (CIRC)" <paul@castironradiatorcentre.co.uk>
To: Surinder Singh <surinder@itpartnership.com>
Subject: RE: IMPORTANT -VDK PCI scan failure (path traversal false positive)
Thread-Topic: IMPORTANT -VDK PCI scan failure (path traversal false positive)
Thread-Index: AQHdHc26xQ7ojxu8lUiHx6l3O1/PCraBYsxAgAAB0ICAAABCkA==
Date: Mon, 27 Jul 2026 14:01:08 +0000
Message-ID:
<CWLP123MB5865013C48F8B47DCD5E5007E2CC2@CWLP123MB5865.GBRP123.PROD.OUTLOOK.COM>
References:
<CWLP123MB5865BDAB4FC3E7698396FB70E2CC2@CWLP123MB5865.GBRP123.PROD.OUTLOOK.COM>
<0b6701dd1dcd$b638f470$22aadd50$@itpartnership.com>
<CWLP123MB58658AF472E618DB74167B4AE2CC2@CWLP123MB5865.GBRP123.PROD.OUTLOOK.COM>
<0b8501dd1dd0$1c6a1420$553e3c60$@itpartnership.com>
In-Reply-To: <0b8501dd1dd0$1c6a1420$553e3c60$@itpartnership.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
Authentication-Results-Original: dkim=none (message not signed)
header.d=none;dmarc=none action=none
header.from=castironradiatorcentre.co.uk;
x-ms-traffictypediagnostic:
CWLP123MB5865:EE_|LO6P123MB7143:EE_|CW2PEPF000056BE:EE_|CWXP123MB4277:EE_
X-MS-Office365-Filtering-Correlation-Id: 8ddc1a66-380a-446e-f94b-08deebe78ad0
X-LD-Processed: 0415e796-cc04-4618-8152-6ecf37a22201,ExtAddr,ExtAddr
x-cloud-sec-av-info: mossmeadltd1,office365_emails,sent,inline
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam-Untrusted:
BCL:0;ARA:13230040|376014|366016|6049299003|23010399003|1800799024|38070700021|13003099007|4053099003|6133799003|5023799004|4143699003|10067099003|56012099006|8096899003|18002099003|22082099003;
X-Microsoft-Antispam-Message-Info-Original:
Ri8K3RF/Kw2uQ/eB4wC2x5hGUeW6ONkpx1x4ofRUt/qGpTzKHxHXKOiP5PMNnZWnvDiCetIee/2DXkmkD6SSs+JDPVUZ5mSjcHzdxJ6HKlSX74pH5dgDvviJoJHB+bHqSWsy17bhHIYOiZ3+/RUG8XP/8ndo1hl9FOIqw2E01V0lnEjxA48xLfhmxvGsuk3OcVe33GvQrb7GJaeur46UNLW/2l2st963wDpp4nHFUpHMdJCKwxsEhaXVlmdQnXW0KjBM9Qlr053dUIvBuJ9R+YlD7VdruQ0eNlqe1AqONxenJNmb9BWSFPAQMqkGJ7qXNP+smBFDBdk6c+NT8JA9MW9vSRQilr3EEU0moy/L6n4i3B2YP7+vGqHpYj/cTtYRTk4J9Pz9KfokmYoSGFeOKJR9gkVRhqSSEdqFIMKgK7aB773cIKkCg8ZJCwQiaa6XvVD8aY4M0MU0mWD1CTUix5RrZKiQhVa3e7v3b7I4EMgrZkFFtAq37KetBqswe2FNYxuxmRXZ1HYthzD2uIbTTd7BXXUd82efv4Ei1Y9kX2QD3D0+lYRteHKcMO+4vJNapMNLosCYe8C4vYRg+iN66l24DjYuko+J2RlMbpiHk8l1ju9HuHWjgYjbooqhUWcGiE7rK5ja1F5EXZcVl0pFtGE8jgCRW4xecKGQociGQ8w=
X-Forefront-Antispam-Report-Untrusted:
CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CWLP123MB5865.GBRP123.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(6049299003)(23010399003)(1800799024)(38070700021)(13003099007)(4053099003)(6133799003)(5023799004)(4143699003)(10067099003)(56012099006)(8096899003)(18002099003)(22082099003);DIR:OUT;SFP:1102;
Content-Type: multipart/related;
boundary="_004_CWLP123MB5865013C48F8B47DCD5E5007E2CC2CWLP123MB5865GBRP_";
type="multipart/alternative"
MIME-Version: 1.0
X-Exchange-RoutingPolicyChecked:
Sg34jP7zUkM+sAwhVjyRGnKyJmoG+eHe28BmY4MVErqSCkocnVxR1OsbVig6N1d5jRF1EdknJJ0q067PxWsAnVLWXgqB+r/zpaC5ZPlElCLPmgxva2Rn8ZAr8irtIAJzJCxkLwwoN/Pjhg4mONU5ICGsu+ulr1BovYLALHKMvyD5OCiJNgxfDYvVi0Rk3C6floQx48oAMycghbOlPmRdf/RrKwXlAnRqJAY5MiIFkU44HhjDMJTiPV79CVCNvSBYpKf9kOTYZA+TjZfNCipvS2np9/V6JWNaQYAPkA3yIyO/WgWC6WSQTVgI9PQR8W9vsF716QxE9QXLRri51q/SpA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO6P123MB7143
X-CLOUD-SEC-AV-INT-Relay: sent<mta-outgoing-dlp-mt-prod-cp-eu-2.checkpointcloudsec.com>
X-CLOUD-SEC-AV-UUID: 4238cc1452be46758bde779cb1fad1f2:mossmeadltd1,office365_emails,sent,inline:d7f24b4a2ba8bbf0d7324069baf3261d
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;
b=OTA/Wg4HKgr1LFeO5+kpdF1SDBNnhW/943KpzNUgwAQS0yS1YppfhQs7Sug/UypTcfo1JY6c3By5f18/QxRSG125MR1X/7YRgCmu6bUR5wWDyJ249yxsD2N1ANBAWEr5quN8kWw7gB1bzUO7uX2/ILtF6lsVodxX85VJjBPnguUr92x7Y4vpI8iQXuefsQ22wi1d5PGcSxSaqIOWHMxGLFMrdkZ8tM+bHLxFbgpktoBpYe7wsOmStV9HcWNtBqnvqBu4WY+3QCTRGxFVugkDmXQbwyEW/rS4AMpsAJUMYa4isA7vfVTdaFpqkQJE87U3TRPyKZMyygRbzH4umpN3Lw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector10001; h=From:Date:Subject:Message-ID:MIME-Version;
bh=BmK40gmcuAR4BUURBKiZGVdUqmIUVqyPpvYaL3h5xiQ=;
b=lMW12GeyGPT44wzWRS376J6Pmp0IadgRg9umzb5tJQdKqGsItSVL8gBtPEY4u97d+PYDKFQDSbhrAVfHh5j/V9Y783cvbQAdadoVRy/PD02ypLTM95oJsLLIYWnUC3FuS6/h7sFDKpXXadiOaDe93+zESQ887UJqq3DbtEYTgMkhee6i3DyAMOcIwfZivyT+OzFMS5ycs5plhzZDDxXJCTZMok330oqugmdB4DIhNpqHC+PLo8mnBybSkh2q8lMixhXhR8CmKq0Ei6Hdj/8i0TMew0XZtPWVUJBiiX3Oyx6G69hXaThlyIN6oHB7mCoRKT/wTiiYbTZLn8GtSjmP+g==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass
smtp.mailfrom=castironradiatorcentre.co.uk; dmarc=pass action=none
header.from=castironradiatorcentre.co.uk; dkim=pass
header.d=castironradiatorcentre.co.uk; arc=none
Authentication-Results-Original: mx.checkpointcloudsec.com; arc=pass;
dkim=none header.d=none
Return-Path: paul@castironradiatorcentre.co.uk
X-EOPAttributedMessage: 0
X-MS-Exchange-Transport-CrossTenantHeadersStripped:
CW2PEPF000056BE.GBRP265.PROD.OUTLOOK.COM
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id-Prvs:
06f3039b-0295-4d33-2ae2-08deebe78205
X-Microsoft-Antispam:
BCL:0;ARA:13230040|36860700016|7149299003|82310400026|6049299003|376014|1800799024|23010399003|14060799003|35042699022|13003099007|4053099003|6133799003|5023799004|18002099003|22082099003|4143699003|10067099003|56012099006|4076899003|8096899003;
X-Microsoft-Antispam-Message-Info:
+WRa96T2kqDJux/rvCYpHe3XqE8PWoLwTw33+CGej8mszYOv/8tZMlBSycvC/cAAwHCVDd0J801JuRRHwZE1jQWIbfo2bfbU3BHknhZKC+JeprngWv5wg5wu+U7+3Rm0jD2NcTZAq+b3pSOYE1gkpdS8Hbn4qnGiMYqtsguCOrqJ2AqsCzrUr755pTx1a4gCB1mbIqC9ZEJg04a0hTXVSPhlBKkSjaQMQf24Tre6jC3nOLr746H+XeGgVDuqgnpvmVtIpOEKiUS2IK1ClLajXUhbreA0cJFfgrUvJr2sWb7SD7vj4PJApQ1dhQcaWz4eRoxbGbKCVXnI44hMM2iheegtGn1817wnkPv4ZVVCaAA9mJQH5chNi9gEpmrws3KqR+ZJPljYWGKrtqtgEOwESwtUG1JEzoXqWHkaJroMOeUgO6lLz8NTJnqk1O4a2xmxcqRVBLgMRHoIlI3RcPgyBEUSMptGbNAhKNvV6iBgHrVoLS7LlMVHFvkZ5P320t6pQxybTNFBkfWmXoQP1P49O7aKS0Z5DNqYbjMPELPm4RnmHOusts82g5bX1cQ3IvfeK7/jDw5bc9axBhwyaMWt7gIJYRPOUIocJru95NMgBHHgT1d1I4KkxthT3uMABw4SvoXnWngLlKSYWDcLoKazAQ==
X-Forefront-Antispam-Report:
CIP:52.17.62.50;CTRY:IE;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:eu-dlp.cloud-sec-av.com;PTR:eu-dlp.cloud-sec-av.com;CAT:NONE;SFS:(13230040)(36860700016)(7149299003)(82310400026)(6049299003)(376014)(1800799024)(23010399003)(14060799003)(35042699022)(13003099007)(4053099003)(6133799003)(5023799004)(18002099003)(22082099003)(4143699003)(10067099003)(56012099006)(4076899003)(8096899003);DIR:OUT;SFP:1102;
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
aQP+niS1qiFCetHlyE8AfIm8CH94hTPydpV1rHvq9VP4b5C7h/5sznHWB7SaJQSgJtQcbWc438R2lhvMaZyqIb3/b9QJ8VD3bgu5ZYORCFpHNlJsonHrNfxCaC+Q6YY4+N7M9EWdpyjBKAGZomtjlOjdEETH5KJ71t1/c8WtgOwUp1hqjy5YJ6uF1p6BPXBqFaX6tZgNy4XP2TUXyP1D53VceoTda37qjISGAflNLRI3TXtt5a860oA0W8EX9cRVyAu41bjSBoAouy24AD8ELfgdzqGTzHxbJp6s73z2aQPMGvYg3w2PBtlFCQ2RxMts3u2g2QCdnGiF4LNClBxJ9F0plAIikbS+9mZ+EHbIshmeAHIbcIjZZVsBwboz+/Ms/kmglfJWcthZ6wbzIdInAqveYaafQikVPQtuVijQ4SZXLB0oQo4hPLTAtotmLhJq
X-OriginatorOrg: castironradiatorcentre.co.uk
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Jul 2026 14:01:23.1220
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 8ddc1a66-380a-446e-f94b-08deebe78ad0
X-MS-Exchange-CrossTenant-Id: 0415e796-cc04-4618-8152-6ecf37a22201
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=0415e796-cc04-4618-8152-6ecf37a22201;Ip=[52.17.62.50];Helo=[eu-dlp.cloud-sec-av.com]
X-MS-Exchange-CrossTenant-AuthSource: CW2PEPF000056BE.GBRP265.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CWXP123MB4277
--_004_CWLP123MB5865013C48F8B47DCD5E5007E2CC2CWLP123MB5865GBRP_
Content-Type: multipart/alternative;
boundary="_000_CWLP123MB5865013C48F8B47DCD5E5007E2CC2CWLP123MB5865GBRP_"
--_000_CWLP123MB5865013C48F8B47DCD5E5007E2CC2CWLP123MB5865GBRP_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Thanks Surinder.
You will I have lodged the query, but I can run a further scan now to see i=
f the result is consistent or not whilst we wait their reply.
Kind regards,
Paul
[CIRC Logo - Copy]
Tel: 024 76303999 Ext: 204
Mob: 07950 606244
email: paul@castironradiatorcentre.co.uk
WEBSITE: Cast Iron Radiator Centre<http://www.castironradiatorcentre.co.uk/=
>
CONFIDENTIALITY NOTICE: This email and any attachments are confidential and=
intended solely for the use of the individual or entity to whom they are a=
ddressed. If you have received this email in error, please notify the sende=
r immediately and delete it from your system. You must not disclose, copy, =
or distribute any part of this email if you are not the intended recipient.
DISCLAIMER: The views and opinions expressed in this email are those of the=
author and do not necessarily represent the views of our company. The info=
rmation contained in this email is for general information purposes only. W=
hile we endeavour to keep the information up to date and correct, we make n=
o representations or warranties of any kind, express or implied, about the =
completeness, accuracy, reliability, suitability, or availability with resp=
ect to the email or the information, products, services, or related graphic=
s contained in the email for any purpose. Any reliance you place on such in=
formation is therefore strictly at your own risk.
VIRUS WARNING: Although we have taken reasonable precautions to ensure no v=
iruses are present in this email, we cannot accept responsibility for any l=
oss or damage arising from the use of this email or attachments. It is your=
responsibility to ensure that your computer systems are adequately protect=
ed from viruses and other harmful code.
LEGAL NOTICE: This email does not constitute legal advice and is not intend=
ed to establish any attorney-client relationship. You should seek appropria=
te legal advice before taking or refraining from any action based on the co=
ntents of this email.
COMPLIANCE WITH REGULATIONS: Our company operates in accordance with releva=
nt data protection regulations. If you have any concerns about how your per=
sonal data is being processed, please contact our company using the above d=
etails.
From: Surinder Singh <surinder@itpartnership.com>
Sent: 27 July 2026 14:59
To: Paul Brown (CIRC) <paul@castironradiatorcentre.co.uk>
Subject: RE: IMPORTANT -VDK PCI scan failure (path traversal false positive=
)
Thanks Paul.
I couldn't find any vulnerability. Quite often these scanning tools report =
false positives. Which I think is the case here.
Hope you had a good weekend too. At least it was cooler.
Kind regards,
Surinder
From: Paul Brown (CIRC) <paul@castironradiatorcentre.co.uk<mailto:paul@cast=
ironradiatorcentre.co.uk>>
Sent: 27 July 2026 14:54
To: Surinder Singh <surinder@itpartnership.com<mailto:surinder@itpartnershi=
p.com>>
Subject: RE: IMPORTANT -VDK PCI scan failure (path traversal false positive=
)
Hi Surinder,
Thank you and I have forwarded onto security metrics and CC you in, though =
they will, no doubt only reply to me.
As soon as I hear anything I'll let you know.
Kind regards,
Paul
[CIRC Logo - Copy]
Tel: 024 76303999 Ext: 204
Mob: 07950 606244
email: paul@castironradiatorcentre.co.uk<mailto:paul@castironradiatorcentre=
.co.uk>
WEBSITE: Cast Iron Radiator Centre<http://www.castironradiatorcentre.co.uk/=
>
CONFIDENTIALITY NOTICE: This email and any attachments are confidential and=
intended solely for the use of the individual or entity to whom they are a=
ddressed. If you have received this email in error, please notify the sende=
r immediately and delete it from your system. You must not disclose, copy, =
or distribute any part of this email if you are not the intended recipient.
DISCLAIMER: The views and opinions expressed in this email are those of the=
author and do not necessarily represent the views of our company. The info=
rmation contained in this email is for general information purposes only. W=
hile we endeavour to keep the information up to date and correct, we make n=
o representations or warranties of any kind, express or implied, about the =
completeness, accuracy, reliability, suitability, or availability with resp=
ect to the email or the information, products, services, or related graphic=
s contained in the email for any purpose. Any reliance you place on such in=
formation is therefore strictly at your own risk.
VIRUS WARNING: Although we have taken reasonable precautions to ensure no v=
iruses are present in this email, we cannot accept responsibility for any l=
oss or damage arising from the use of this email or attachments. It is your=
responsibility to ensure that your computer systems are adequately protect=
ed from viruses and other harmful code.
LEGAL NOTICE: This email does not constitute legal advice and is not intend=
ed to establish any attorney-client relationship. You should seek appropria=
te legal advice before taking or refraining from any action based on the co=
ntents of this email.
COMPLIANCE WITH REGULATIONS: Our company operates in accordance with releva=
nt data protection regulations. If you have any concerns about how your per=
sonal data is being processed, please contact our company using the above d=
etails.
From: Surinder Singh <surinder@itpartnership.com<mailto:surinder@itpartners=
hip.com>>
Sent: 27 July 2026 14:42
To: Paul Brown (CIRC) <paul@castironradiatorcentre.co.uk<mailto:paul@castir=
onradiatorcentre.co.uk>>
Subject: RE: IMPORTANT -VDK PCI scan failure (path traversal false positive=
)
Hi Paul,
Please could you forward the following to SecurityMetrics and ask them to r=
eview the failing vulnerability manually?
________________________________
We have investigated and reproduced the reported CGI Generic Path Traversal=
(write test) finding affecting:
https://www.vintagedoorknobs.co.uk/products.asp
The report identifies:
* the sortby parameter using GET; and
* the xcode parameter using POST.
Our investigation indicates that this is a false positive.
GET sortby parameter
The application does not place the submitted sortby value directly into SQL=
or use it as a file path.
The value is processed through a strict whitelist. Only the following known=
values are recognised:
* 2 - price, high to low
* 3 - price, low to high
* 4 - product name
Each recognised value is mapped internally to a predefined SQL ORDER BY exp=
ression. Any other value results in no custom sort expression being used.
We reproduced the scanner test by comparing:
sortby=3Dnot-a-valid-sort-value
with:
sortby=3D../../../../../../../../../../windows/system32/config/sam
Both requests were made using the same ASP session.
The results were:
* HTTP status: 200 OK for both
* Content length: 63640 bytes for both
* HTML response: byte-for-byte identical
* File comparison result: FC: no differences encountered
The only response-header differences were the expected Date and Expires tim=
estamps.
POST xcode parameter
The SecurityMetrics request submitted an xcode value while leaving the asso=
ciated xcmd command blank.
In the application code, when xcmd is blank, the submitted xcode value is d=
iscarded and replaced by the separate code parameter. As the scanner also s=
upplied a blank code value, the resulting command and product code are both=
blank and the basket-operation routine exits without processing the submit=
ted xcode.
We reproduced this by comparing an ordinary invalid product code with the r=
eported traversal value, again using the same ASP session and leaving xcmd,=
cmd and code blank.
The results were:
* HTTP status: 200 OK for both
* Content length: 63708 bytes for both
* HTML responses: identical apart from a dynamic page-execution timing =
comment
* Baseline timing comment: 0.063 secs
* Traversal timing comment: 0.043 secs
The response headers again differed only in their normal Date and Expires t=
imestamps.
The changing execution-time comment is expected dynamic content and does no=
t indicate file access. The scan evidence also shows similar minor executio=
n-time differences, without demonstrating any file access or modification.
Code review
Neither sortby nor xcode is passed to any:
* filesystem function;
* path-mapping function;
* file stream;
* dynamic include;
* operating-system command; or
* executable process.
There are no relevant calls to functions such as Server.MapPath, FileSystem=
Object, ADODB.Stream, Server.Execute, Response.WriteFile or WScript.Shell.
In legitimate use, xcode represents either a product code or a currency cod=
e. Product codes are used only in database lookups with SQL escaping and pr=
oduct-existence validation. Currency codes must match an allowed currency l=
ist or a record in the currencies table.
No file contents were disclosed, no file was modified, no filesystem error =
occurred, and the traversal value was not reflected in the response.
We also inspected the target file identified by the scanner. The Windows SA=
M file at C:\Windows\System32\config\SAM has a last-modified timestamp of 6=
May 2026 at 04:11. The SecurityMetrics scan was performed on 24 July 2026 =
between 15:05 and 16:28. The file was therefore not modified during or as a=
result of the scan.
We therefore believe the reported CGI Generic Path Traversal (write test) v=
ulnerability is a false positive. Please could this finding be reviewed man=
ually and marked as a false positive?
We can provide the response files, comparison results and relevant source-c=
ode extracts if required.
________________________________
Thanks,
Surinder
From: Paul Brown (CIRC) <paul@castironradiatorcentre.co.uk<mailto:paul@cast=
ironradiatorcentre.co.uk>>
Sent: 27 July 2026 08:31
To: Surinder Singh <surinder@itpartnership.com<mailto:surinder@itpartnershi=
p.com>>
Subject: IMPORTANT -VDK PCI scan failure
Importance: High
Morning Surinder,
Hope your weekend went well!
Can you take a look at the attached report and look to fix the issue raised=
. Appears to only be one failed issue.
It is very important that this is corrected as it affects the Worldpay inte=
gration and costs we are charged for currently not meeting their PCI requir=
ements.
Would be grateful if you could let me know as soon as possible when fixed a=
nd I will sort out a further vulnerability scan so that I can get complianc=
e re-established
Kind regards,
Paul
[CIRC Logo - Copy]
Tel: 024 76303999 Ext: 204
Mob: 07950 606244
email: paul@castironradiatorcentre.co.uk<mailto:paul@castironradiatorcentre=
.co.uk>
WEBSITE: Cast Iron Radiator Centre<http://www.castironradiatorcentre.co.uk/=
>
CONFIDENTIALITY NOTICE: This email and any attachments are confidential and=
intended solely for the use of the individual or entity to whom they are a=
ddressed. If you have received this email in error, please notify the sende=
r immediately and delete it from your system. You must not disclose, copy, =
or distribute any part of this email if you are not the intended recipient.
DISCLAIMER: The views and opinions expressed in this email are those of the=
author and do not necessarily represent the views of our company. The info=
rmation contained in this email is for general information purposes only. W=
hile we endeavour to keep the information up to date and correct, we make n=
o representations or warranties of any kind, express or implied, about the =
completeness, accuracy, reliability, suitability, or availability with resp=
ect to the email or the information, products, services, or related graphic=
s contained in the email for any purpose. Any reliance you place on such in=
formation is therefore strictly at your own risk.
VIRUS WARNING: Although we have taken reasonable precautions to ensure no v=
iruses are present in this email, we cannot accept responsibility for any l=
oss or damage arising from the use of this email or attachments. It is your=
responsibility to ensure that your computer systems are adequately protect=
ed from viruses and other harmful code.
LEGAL NOTICE: This email does not constitute legal advice and is not intend=
ed to establish any attorney-client relationship. You should seek appropria=
te legal advice before taking or refraining from any action based on the co=
ntents of this email.
COMPLIANCE WITH REGULATIONS: Our company operates in accordance with releva=
nt data protection regulations. If you have any concerns about how your per=
sonal data is being processed, please contact our company using the above d=
etails.
--_000_CWLP123MB5865013C48F8B47DCD5E5007E2CC2CWLP123MB5865GBRP_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:12.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#467886;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Aptos",sans-serif;
color:windowtext;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:469254620;
mso-list-template-ids:-1177640542;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1
{mso-list-id:506289413;
mso-list-template-ids:-884078184;}
@list l1:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l1:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level4
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level5
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level7
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level8
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2
{mso-list-id:1247956506;
mso-list-template-ids:119591116;}
@list l2:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l2:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level4
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level5
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level7
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level8
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3
{mso-list-id:1482623388;
mso-list-template-ids:-1502574334;}
@list l3:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l3:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level4
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level5
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level7
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level8
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l4
{mso-list-id:1929340171;
mso-list-template-ids:842060856;}
@list l4:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l4:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l4:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l4:level4
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l4:level5
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l4:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l4:level7
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l4:level8
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l4:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=3D"EN-GB" link=3D"#467886" vlink=3D"#96607D" style=3D"word-wrap:=
break-word">
<div class=3D"WordSection1">
<p class=3D"MsoNormal">Thanks Surinder.<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal">You will I have lodged the query, but I can run a fu=
rther scan now to see if the result is consistent or not whilst we wait the=
ir reply.<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:black;mso-liga=
tures:none;mso-fareast-language:EN-GB">Kind regards,</span><span style=3D"m=
so-ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:black;mso-liga=
tures:none;mso-fareast-language:EN-GB"> </span><span style=3D"mso-liga=
tures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><b><i><span style=3D"color:black;mso-ligatures:none;=
mso-fareast-language:EN-GB">Paul</span></i></b><span style=3D"mso-ligatures=
:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:black;mso-liga=
tures:none;mso-fareast-language:EN-GB"> </span><span style=3D"mso-liga=
tures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:black;mso-liga=
tures:none;mso-fareast-language:EN-GB"><img width=3D"172" height=3D"59" sty=
le=3D"width:1.7916in;height:.6166in" id=3D"Picture_x0020_1568290040" src=3D=
"cid:image001.png@01DD1DD8.C08B9EE0" alt=3D"CIRC Logo - Copy"></span><span =
style=3D"mso-ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span><=
/p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black;mso-l=
igatures:none;mso-fareast-language:EN-GB"> </span></i><span style=3D"m=
so-ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><b><i><span style=3D"font-size:11.0pt;color:black;ms=
o-ligatures:none;mso-fareast-language:EN-GB">Tel:</span></i></b><i><span st=
yle=3D"font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-language=
:EN-GB"> 024 76303999
<b>Ext:</b> 204</span></i><span style=3D"mso-ligatures:none;mso-fareast-lan=
guage:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><b><i><span style=3D"font-size:11.0pt;color:black;ms=
o-ligatures:none;mso-fareast-language:EN-GB">Mob:</span></i></b><i><span st=
yle=3D"font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-language=
:EN-GB"> 07950 606244 </span></i><span style=3D"mso-ligatures:none;ms=
o-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><b><i><span style=3D"font-size:11.0pt;color:black;ms=
o-ligatures:none;mso-fareast-language:EN-GB">email</span></i></b><i><span s=
tyle=3D"font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-languag=
e:EN-GB">:
<u>paul@castironradiatorcentre.co.uk</u> </span></i><span style=
=3D"mso-ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><b><i><span style=3D"font-size:11.0pt;color:black;ms=
o-ligatures:none;mso-fareast-language:EN-GB">WEBSITE</span></i></b><i><span=
style=3D"font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-langu=
age:EN-GB">:
</span></i><b><i><u><span style=3D"font-size:11.0pt;color:blue;mso-ligature=
s:none;mso-fareast-language:EN-GB"><a href=3D"http://www.castironradiatorce=
ntre.co.uk/" target=3D"_blank" title=3D"http://www.castironradiatorcentre.c=
o.uk/"><span style=3D"color:blue">Cast Iron
Radiator Centre</span></a></span></u></i></b><span style=3D"mso-ligatures:=
none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:black;mso-liga=
tures:none;mso-fareast-language:EN-GB"> </span><span style=3D"mso-liga=
tures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black;mso-l=
igatures:none;mso-fareast-language:EN-GB">CONFIDENTIALITY NOTICE: This emai=
l and any attachments are confidential and intended solely for the use of t=
he individual or entity to whom they
are addressed. If you have received this email in error, please notify the=
sender immediately and delete it from your system. You must not disclose, =
copy, or distribute any part of this email if you are not the intended reci=
pient.</span></i><span style=3D"mso-ligatures:none;mso-fareast-language:EN-=
GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black;mso-l=
igatures:none;mso-fareast-language:EN-GB"> </span></i><span style=3D"m=
so-ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black;mso-l=
igatures:none;mso-fareast-language:EN-GB">DISCLAIMER: The views and opinion=
s expressed in this email are those of the author and do not necessarily re=
present the views of our company. The
information contained in this email is for general information purposes on=
ly. While we endeavour to keep the information up to date and correct, we m=
ake no representations or warranties of any kind, express or implied, about=
the completeness, accuracy, reliability,
suitability, or availability with respect to the email or the information,=
products, services, or related graphics contained in the email for any pur=
pose. Any reliance you place on such information is therefore strictly at y=
our own risk.</span></i><span style=3D"mso-ligatures:none;mso-fareast-langu=
age:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black;mso-l=
igatures:none;mso-fareast-language:EN-GB"> </span></i><span style=3D"m=
so-ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black;mso-l=
igatures:none;mso-fareast-language:EN-GB">VIRUS WARNING: Although we have t=
aken reasonable precautions to ensure no viruses are present in this email,=
we cannot accept responsibility for
any loss or damage arising from the use of this email or attachments. It i=
s your responsibility to ensure that your computer systems are adequately p=
rotected from viruses and other harmful code.</span></i><span style=3D"mso-=
ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black;mso-l=
igatures:none;mso-fareast-language:EN-GB"> </span></i><span style=3D"m=
so-ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black;mso-l=
igatures:none;mso-fareast-language:EN-GB">LEGAL NOTICE: This email does not=
constitute legal advice and is not intended to establish any attorney-clie=
nt relationship. You should seek appropriate
legal advice before taking or refraining from any action based on the cont=
ents of this email.</span></i><span style=3D"mso-ligatures:none;mso-fareast=
-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black;mso-l=
igatures:none;mso-fareast-language:EN-GB"> </span></i><span style=3D"m=
so-ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black;mso-l=
igatures:none;mso-fareast-language:EN-GB">COMPLIANCE WITH REGULATIONS: Our =
company operates in accordance with relevant data protection regulations. I=
f you have any concerns about how your
personal data is being processed, please contact</span></i><span style=3D"=
font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-language:EN-GB"=
> <i>our company using the above details.</i></span><span style=3D"mso=
-ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
</div>
</div>
<p class=3D"MsoNormal"><span style=3D"mso-ligatures:none;mso-fareast-langua=
ge:EN-GB"> </span><o:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<div>
<div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm =
0cm 0cm">
<p class=3D"MsoNormal"><b><span lang=3D"EN-US" style=3D"font-size:11.0pt;fo=
nt-family:"Calibri",sans-serif;mso-ligatures:none;mso-fareast-lan=
guage:EN-GB">From:</span></b><span lang=3D"EN-US" style=3D"font-size:11.0pt=
;font-family:"Calibri",sans-serif;mso-ligatures:none;mso-fareast-=
language:EN-GB">
Surinder Singh <surinder@itpartnership.com> <br>
<b>Sent:</b> 27 July 2026 14:59<br>
<b>To:</b> Paul Brown (CIRC) <paul@castironradiatorcentre.co.uk><br>
<b>Subject:</b> RE: IMPORTANT -VDK PCI scan failure (path traversal false p=
ositive)<o:p></o:p></span></p>
</div>
</div>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">Thanks Paul.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">I couldn’t find any vulnerability. Quite ofte=
n these scanning tools report false positives. Which I think is the case he=
re.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">Hope you had a good weekend too. At least it =
was cooler.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">Kind regards,<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">Surinder<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm =
0cm 0cm">
<p class=3D"MsoNormal"><b><span lang=3D"EN-US" style=3D"font-size:11.0pt;fo=
nt-family:"Calibri",sans-serif;mso-ligatures:none;mso-fareast-lan=
guage:EN-GB">From:</span></b><span lang=3D"EN-US" style=3D"font-size:11.0pt=
;font-family:"Calibri",sans-serif;mso-ligatures:none;mso-fareast-=
language:EN-GB">
Paul Brown (CIRC) <<a href=3D"mailto:paul@castironradiatorcentre.co.uk"=
>paul@castironradiatorcentre.co.uk</a>>
<br>
<b>Sent:</b> 27 July 2026 14:54<br>
<b>To:</b> Surinder Singh <<a href=3D"mailto:surinder@itpartnership.com"=
>surinder@itpartnership.com</a>><br>
<b>Subject:</b> RE: IMPORTANT -VDK PCI scan failure (path traversal false p=
ositive)<o:p></o:p></span></p>
</div>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal"><span class=3D"EmailStyle18">Hi Surinder,<o:p></o:p>=
</span></p>
<p class=3D"MsoNormal"><span class=3D"EmailStyle18"><o:p> </o:p></span=
></p>
<p class=3D"MsoNormal"><span class=3D"EmailStyle18">Thank you and I have fo=
rwarded onto security metrics and CC you in, though they will, no doubt onl=
y reply to me.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span class=3D"EmailStyle18"><o:p> </o:p></span=
></p>
<p class=3D"MsoNormal"><span class=3D"EmailStyle18">As soon as I hear anyth=
ing I’ll let you know.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span class=3D"EmailStyle18"><o:p> </o:p></span=
></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:black;mso-liga=
tures:none;mso-fareast-language:EN-GB">Kind regards,</span><span style=3D"m=
so-ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:black;mso-liga=
tures:none;mso-fareast-language:EN-GB"> </span><span style=3D"mso-liga=
tures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><b><i><span style=3D"color:black;mso-ligatures:none;=
mso-fareast-language:EN-GB">Paul</span></i></b><span style=3D"mso-ligatures=
:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:black;mso-liga=
tures:none;mso-fareast-language:EN-GB"> </span><span style=3D"mso-liga=
tures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:black;mso-liga=
tures:none;mso-fareast-language:EN-GB"><img border=3D"0" width=3D"172" heig=
ht=3D"59" style=3D"width:1.7916in;height:.6166in" id=3D"_x0000_i1029" src=
=3D"cid:image001.png@01DD1DD8.C08B9EE0" alt=3D"CIRC Logo - Copy"></span><sp=
an style=3D"mso-ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></spa=
n></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black;mso-l=
igatures:none;mso-fareast-language:EN-GB"> </span></i><span style=3D"m=
so-ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><b><i><span style=3D"font-size:11.0pt;color:black;ms=
o-ligatures:none;mso-fareast-language:EN-GB">Tel:</span></i></b><i><span st=
yle=3D"font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-language=
:EN-GB"> 024 76303999
<b>Ext:</b> 204</span></i><span style=3D"mso-ligatures:none;mso-fareast-lan=
guage:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><b><i><span style=3D"font-size:11.0pt;color:black;ms=
o-ligatures:none;mso-fareast-language:EN-GB">Mob:</span></i></b><i><span st=
yle=3D"font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-language=
:EN-GB"> 07950 606244 </span></i><span style=3D"mso-ligatures:none;ms=
o-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><b><i><span style=3D"font-size:11.0pt;color:black;ms=
o-ligatures:none;mso-fareast-language:EN-GB">email</span></i></b><i><span s=
tyle=3D"font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-languag=
e:EN-GB">:
<u><a href=3D"mailto:paul@castironradiatorcentre.co.uk">paul@castironradiat=
orcentre.co.uk</a></u> </span></i><span style=3D"mso-ligatures:=
none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><b><i><span style=3D"font-size:11.0pt;color:black;ms=
o-ligatures:none;mso-fareast-language:EN-GB">WEBSITE</span></i></b><i><span=
style=3D"font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-langu=
age:EN-GB">:
</span></i><b><i><u><span style=3D"font-size:11.0pt;color:blue;mso-ligature=
s:none;mso-fareast-language:EN-GB"><a href=3D"http://www.castironradiatorce=
ntre.co.uk/" target=3D"_blank" title=3D"http://www.castironradiatorcentre.c=
o.uk/"><span style=3D"color:blue">Cast Iron
Radiator Centre</span></a></span></u></i></b><span style=3D"mso-ligatures:=
none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:black;mso-liga=
tures:none;mso-fareast-language:EN-GB"> </span><span style=3D"mso-liga=
tures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black;mso-l=
igatures:none;mso-fareast-language:EN-GB">CONFIDENTIALITY NOTICE: This emai=
l and any attachments are confidential and intended solely for the use of t=
he individual or entity to whom they
are addressed. If you have received this email in error, please notify the=
sender immediately and delete it from your system. You must not disclose, =
copy, or distribute any part of this email if you are not the intended reci=
pient.</span></i><span style=3D"mso-ligatures:none;mso-fareast-language:EN-=
GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black;mso-l=
igatures:none;mso-fareast-language:EN-GB"> </span></i><span style=3D"m=
so-ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black;mso-l=
igatures:none;mso-fareast-language:EN-GB">DISCLAIMER: The views and opinion=
s expressed in this email are those of the author and do not necessarily re=
present the views of our company. The
information contained in this email is for general information purposes on=
ly. While we endeavour to keep the information up to date and correct, we m=
ake no representations or warranties of any kind, express or implied, about=
the completeness, accuracy, reliability,
suitability, or availability with respect to the email or the information,=
products, services, or related graphics contained in the email for any pur=
pose. Any reliance you place on such information is therefore strictly at y=
our own risk.</span></i><span style=3D"mso-ligatures:none;mso-fareast-langu=
age:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black;mso-l=
igatures:none;mso-fareast-language:EN-GB"> </span></i><span style=3D"m=
so-ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black;mso-l=
igatures:none;mso-fareast-language:EN-GB">VIRUS WARNING: Although we have t=
aken reasonable precautions to ensure no viruses are present in this email,=
we cannot accept responsibility for
any loss or damage arising from the use of this email or attachments. It i=
s your responsibility to ensure that your computer systems are adequately p=
rotected from viruses and other harmful code.</span></i><span style=3D"mso-=
ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black;mso-l=
igatures:none;mso-fareast-language:EN-GB"> </span></i><span style=3D"m=
so-ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black;mso-l=
igatures:none;mso-fareast-language:EN-GB">LEGAL NOTICE: This email does not=
constitute legal advice and is not intended to establish any attorney-clie=
nt relationship. You should seek appropriate
legal advice before taking or refraining from any action based on the cont=
ents of this email.</span></i><span style=3D"mso-ligatures:none;mso-fareast=
-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black;mso-l=
igatures:none;mso-fareast-language:EN-GB"> </span></i><span style=3D"m=
so-ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black;mso-l=
igatures:none;mso-fareast-language:EN-GB">COMPLIANCE WITH REGULATIONS: Our =
company operates in accordance with relevant data protection regulations. I=
f you have any concerns about how your
personal data is being processed, please contact</span></i><span style=3D"=
font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-language:EN-GB"=
> <i>our company using the above details.</i></span><span style=3D"mso=
-ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"mso-ligatures:none;mso-fareast-langua=
ge:EN-GB"> </span><o:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm =
0cm 0cm">
<p class=3D"MsoNormal"><b><span lang=3D"EN-US" style=3D"font-size:11.0pt;fo=
nt-family:"Calibri",sans-serif;mso-ligatures:none;mso-fareast-lan=
guage:EN-GB">From:</span></b><span lang=3D"EN-US" style=3D"font-size:11.0pt=
;font-family:"Calibri",sans-serif;mso-ligatures:none;mso-fareast-=
language:EN-GB">
Surinder Singh <<a href=3D"mailto:surinder@itpartnership.com">surinder@=
itpartnership.com</a>>
<br>
<b>Sent:</b> 27 July 2026 14:42<br>
<b>To:</b> Paul Brown (CIRC) <<a href=3D"mailto:paul@castironradiatorcen=
tre.co.uk">paul@castironradiatorcentre.co.uk</a>><br>
<b>Subject:</b> RE: IMPORTANT -VDK PCI scan failure (path traversal false p=
ositive)<o:p></o:p></span></p>
</div>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">Hi Paul,<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">Please could you forward the following to SecurityM=
etrics and ask them to review the failing vulnerability manually?<o:p></o:p=
></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<div class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><span=
style=3D"font-size:11.0pt;font-family:"Calibri",sans-serif">
<hr size=3D"1" width=3D"100%" align=3D"center">
</span></div>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">We have investigated and reproduced the reported
<b>CGI Generic Path Traversal (write test)</b> finding affecting:<o:p></o:p=
></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><a href=3D"https://www.vintagedoorknobs.co.uk/produ=
cts.asp">https://www.vintagedoorknobs.co.uk/products.asp</a><o:p></o:p></sp=
an></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">The report identifies:<o:p></o:p></span></p>
<ul style=3D"margin-top:0cm" type=3D"disc">
<li class=3D"MsoNormal" style=3D"mso-list:l1 level1 lfo1"><span style=3D"fo=
nt-size:11.0pt;font-family:"Calibri",sans-serif">the sortby param=
eter using GET; and
<o:p></o:p></span></li><li class=3D"MsoNormal" style=3D"mso-list:l1 level1 =
lfo1"><span style=3D"font-size:11.0pt;font-family:"Calibri",sans-=
serif">the xcode parameter using POST.
<o:p></o:p></span></li></ul>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">Our investigation indicates that this is a false po=
sitive.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><b><span style=3D"font-size:11.0pt;font-family:"=
;Calibri",sans-serif"><o:p> </o:p></span></b></p>
<p class=3D"MsoNormal"><b><span style=3D"font-size:11.0pt;font-family:"=
;Calibri",sans-serif">GET sortby parameter<o:p></o:p></span></b></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">The application does not place the submitted sortby=
value directly into SQL or use it as a file path.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">The value is processed through a strict whitelist. =
Only the following known values are recognised:<o:p></o:p></span></p>
<ul style=3D"margin-top:0cm" type=3D"disc">
<li class=3D"MsoNormal" style=3D"mso-list:l2 level1 lfo2"><span style=3D"fo=
nt-size:11.0pt;font-family:"Calibri",sans-serif">2 – price,=
high to low
<o:p></o:p></span></li><li class=3D"MsoNormal" style=3D"mso-list:l2 level1 =
lfo2"><span style=3D"font-size:11.0pt;font-family:"Calibri",sans-=
serif">3 – price, low to high
<o:p></o:p></span></li><li class=3D"MsoNormal" style=3D"mso-list:l2 level1 =
lfo2"><span style=3D"font-size:11.0pt;font-family:"Calibri",sans-=
serif">4 – product name
<o:p></o:p></span></li></ul>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">Each recognised value is mapped internally to a pre=
defined SQL ORDER BY expression. Any other value results in no custom sort =
expression being used.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">We reproduced the scanner test by comparing:<o:p></=
o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">sortby=3Dnot-a-valid-sort-value<o:p></o:p></span></=
p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">with:<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">sortby=3D../../../../../../../../../../windows/syst=
em32/config/sam<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">Both requests were made using the same ASP session.=
<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">The results were:<o:p></o:p></span></p>
<ul style=3D"margin-top:0cm" type=3D"disc">
<li class=3D"MsoNormal" style=3D"mso-list:l3 level1 lfo3"><span style=3D"fo=
nt-size:11.0pt;font-family:"Calibri",sans-serif">HTTP status: 200=
OK for both
<o:p></o:p></span></li><li class=3D"MsoNormal" style=3D"mso-list:l3 level1 =
lfo3"><span style=3D"font-size:11.0pt;font-family:"Calibri",sans-=
serif">Content length: 63640 bytes for both
<o:p></o:p></span></li><li class=3D"MsoNormal" style=3D"mso-list:l3 level1 =
lfo3"><span style=3D"font-size:11.0pt;font-family:"Calibri",sans-=
serif">HTML response: byte-for-byte identical
<o:p></o:p></span></li><li class=3D"MsoNormal" style=3D"mso-list:l3 level1 =
lfo3"><span style=3D"font-size:11.0pt;font-family:"Calibri",sans-=
serif">File comparison result: FC: no differences encountered
<o:p></o:p></span></li></ul>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">The only response-header differences were the expec=
ted Date and Expires timestamps.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><b><span style=3D"font-size:11.0pt;font-family:"=
;Calibri",sans-serif">POST xcode parameter<o:p></o:p></span></b></p>
<p class=3D"MsoNormal"><b><span style=3D"font-size:11.0pt;font-family:"=
;Calibri",sans-serif"><o:p> </o:p></span></b></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">The SecurityMetrics request submitted an xcode valu=
e while leaving the associated xcmd command blank.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">In the application code, when xcmd is blank, the su=
bmitted xcode value is discarded and replaced by the separate code paramete=
r. As the scanner also supplied a blank code value,
the resulting command and product code are both blank and the basket-opera=
tion routine exits without processing the submitted xcode.<o:p></o:p></span=
></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">We reproduced this by comparing an ordinary invalid=
product code with the reported traversal value, again using the same ASP s=
ession and leaving xcmd, cmd and code blank.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">The results were:<o:p></o:p></span></p>
<ul style=3D"margin-top:0cm" type=3D"disc">
<li class=3D"MsoNormal" style=3D"mso-list:l0 level1 lfo4"><span style=3D"fo=
nt-size:11.0pt;font-family:"Calibri",sans-serif">HTTP status: 200=
OK for both
<o:p></o:p></span></li><li class=3D"MsoNormal" style=3D"mso-list:l0 level1 =
lfo4"><span style=3D"font-size:11.0pt;font-family:"Calibri",sans-=
serif">Content length: 63708 bytes for both
<o:p></o:p></span></li><li class=3D"MsoNormal" style=3D"mso-list:l0 level1 =
lfo4"><span style=3D"font-size:11.0pt;font-family:"Calibri",sans-=
serif">HTML responses: identical apart from a dynamic page-execution timing=
comment
<o:p></o:p></span></li><li class=3D"MsoNormal" style=3D"mso-list:l0 level1 =
lfo4"><span style=3D"font-size:11.0pt;font-family:"Calibri",sans-=
serif">Baseline timing comment: 0.063 secs
<o:p></o:p></span></li><li class=3D"MsoNormal" style=3D"mso-list:l0 level1 =
lfo4"><span style=3D"font-size:11.0pt;font-family:"Calibri",sans-=
serif">Traversal timing comment: 0.043 secs
<o:p></o:p></span></li></ul>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">The response headers again differed only in their n=
ormal Date and Expires timestamps.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">The changing execution-time comment is expected dyn=
amic content and does not indicate file access. The scan evidence also show=
s similar minor execution-time differences, without
demonstrating any file access or modification.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><b><span style=3D"font-size:11.0pt;font-family:"=
;Calibri",sans-serif">Code review<o:p></o:p></span></b></p>
<p class=3D"MsoNormal"><b><span style=3D"font-size:11.0pt;font-family:"=
;Calibri",sans-serif"><o:p> </o:p></span></b></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">Neither sortby nor xcode is passed to any:<o:p></o:=
p></span></p>
<ul style=3D"margin-top:0cm" type=3D"disc">
<li class=3D"MsoNormal" style=3D"mso-list:l4 level1 lfo5"><span style=3D"fo=
nt-size:11.0pt;font-family:"Calibri",sans-serif">filesystem funct=
ion;
<o:p></o:p></span></li><li class=3D"MsoNormal" style=3D"mso-list:l4 level1 =
lfo5"><span style=3D"font-size:11.0pt;font-family:"Calibri",sans-=
serif">path-mapping function;
<o:p></o:p></span></li><li class=3D"MsoNormal" style=3D"mso-list:l4 level1 =
lfo5"><span style=3D"font-size:11.0pt;font-family:"Calibri",sans-=
serif">file stream;
<o:p></o:p></span></li><li class=3D"MsoNormal" style=3D"mso-list:l4 level1 =
lfo5"><span style=3D"font-size:11.0pt;font-family:"Calibri",sans-=
serif">dynamic include;
<o:p></o:p></span></li><li class=3D"MsoNormal" style=3D"mso-list:l4 level1 =
lfo5"><span style=3D"font-size:11.0pt;font-family:"Calibri",sans-=
serif">operating-system command; or
<o:p></o:p></span></li><li class=3D"MsoNormal" style=3D"mso-list:l4 level1 =
lfo5"><span style=3D"font-size:11.0pt;font-family:"Calibri",sans-=
serif">executable process.
<o:p></o:p></span></li></ul>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">There are no relevant calls to functions such as Se=
rver.MapPath, FileSystemObject, ADODB.Stream, Server.Execute, Response.Writ=
eFile or WScript.Shell.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">In legitimate use, xcode represents either a produc=
t code or a currency code. Product codes are used only in database lookups =
with SQL escaping and product-existence validation.
Currency codes must match an allowed currency list or a record in the curr=
encies table.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">No file contents were disclosed, no file was modifi=
ed, no filesystem error occurred, and the traversal value was not reflected=
in the response.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">We also inspected the target file identified by the=
scanner. The Windows SAM file at C:\Windows\System32\config\SAM has a last=
-modified timestamp of 6 May 2026 at 04:11. The
SecurityMetrics scan was performed on 24 July 2026 between 15:05 and 16:28=
. The file was therefore not modified during or as a result of the scan.<o:=
p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">We therefore believe the reported
<b>CGI Generic Path Traversal (write test)</b> vulnerability is a false pos=
itive. Please could this finding be reviewed manually and marked as a false=
positive?<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">We can provide the response files, comparison resul=
ts and relevant source-code extracts if required.<o:p></o:p></span></p>
<div class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><span=
style=3D"font-size:11.0pt;font-family:"Calibri",sans-serif">
<hr size=3D"1" width=3D"100%" align=3D"center">
</span></div>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">Thanks,<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif">Surinder<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif"><o:p> </o:p></span></p>
<div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm =
0cm 0cm">
<p class=3D"MsoNormal"><b><span lang=3D"EN-US" style=3D"font-size:11.0pt;fo=
nt-family:"Calibri",sans-serif;mso-ligatures:none;mso-fareast-lan=
guage:EN-GB">From:</span></b><span lang=3D"EN-US" style=3D"font-size:11.0pt=
;font-family:"Calibri",sans-serif;mso-ligatures:none;mso-fareast-=
language:EN-GB">
Paul Brown (CIRC) <<a href=3D"mailto:paul@castironradiatorcentre.co.uk"=
>paul@castironradiatorcentre.co.uk</a>>
<br>
<b>Sent:</b> 27 July 2026 08:31<br>
<b>To:</b> Surinder Singh <<a href=3D"mailto:surinder@itpartnership.com"=
>surinder@itpartnership.com</a>><br>
<b>Subject:</b> IMPORTANT -VDK PCI scan failure<br>
<b>Importance:</b> High<o:p></o:p></span></p>
</div>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal">Morning Surinder,<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal">Hope your weekend went well!<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal">Can you take a look at the attached report and look =
to fix the issue raised . Appears to only be one failed issue.<o:p></o:p></=
p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal">It is very important that this is corrected as it af=
fects the Worldpay integration and costs we are charged for currently not m=
eeting their PCI requirements.<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal">Would be grateful if you could let me know as soon a=
s possible when fixed and I will sort out a further vulnerability scan so t=
hat I can get compliance re-established<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:black;mso-liga=
tures:none;mso-fareast-language:EN-GB">Kind regards,</span><span style=3D"m=
so-ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:black;mso-liga=
tures:none;mso-fareast-language:EN-GB"> </span><span style=3D"mso-liga=
tures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><b><i><span style=3D"color:black;mso-ligatures:none;=
mso-fareast-language:EN-GB">Paul</span></i></b><span style=3D"mso-ligatures=
:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:black;mso-liga=
tures:none;mso-fareast-language:EN-GB"> </span><span style=3D"mso-liga=
tures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:black;mso-liga=
tures:none;mso-fareast-language:EN-GB"><img border=3D"0" width=3D"172" heig=
ht=3D"59" style=3D"width:1.7916in;height:.6166in" id=3D"Picture_x0020_1" sr=
c=3D"cid:image001.png@01DD1DD8.C08B9EE0" alt=3D"CIRC Logo - Copy"></span><s=
pan style=3D"mso-ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></sp=
an></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black;mso-l=
igatures:none;mso-fareast-language:EN-GB"> </span></i><span style=3D"m=
so-ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><b><i><span style=3D"font-size:11.0pt;color:black;ms=
o-ligatures:none;mso-fareast-language:EN-GB">Tel:</span></i></b><i><span st=
yle=3D"font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-language=
:EN-GB"> 024 76303999
<b>Ext:</b> 204</span></i><span style=3D"mso-ligatures:none;mso-fareast-lan=
guage:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><b><i><span style=3D"font-size:11.0pt;color:black;ms=
o-ligatures:none;mso-fareast-language:EN-GB">Mob:</span></i></b><i><span st=
yle=3D"font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-language=
:EN-GB"> 07950 606244 </span></i><span style=3D"mso-ligatures:none;ms=
o-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><b><i><span style=3D"font-size:11.0pt;color:black;ms=
o-ligatures:none;mso-fareast-language:EN-GB">email</span></i></b><i><span s=
tyle=3D"font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-languag=
e:EN-GB">:
<u><a href=3D"mailto:paul@castironradiatorcentre.co.uk">paul@castironradiat=
orcentre.co.uk</a></u> </span></i><span style=3D"mso-ligatures:=
none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><b><i><span style=3D"font-size:11.0pt;color:black;ms=
o-ligatures:none;mso-fareast-language:EN-GB">WEBSITE</span></i></b><i><span=
style=3D"font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-langu=
age:EN-GB">:
</span></i><b><i><u><span style=3D"font-size:11.0pt;color:blue;mso-ligature=
s:none;mso-fareast-language:EN-GB"><a href=3D"http://www.castironradiatorce=
ntre.co.uk/" target=3D"_blank" title=3D"http://www.castironradiatorcentre.c=
o.uk/"><span style=3D"color:blue">Cast Iron
Radiator Centre</span></a></span></u></i></b><span style=3D"mso-ligatures:=
none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:black;mso-liga=
tures:none;mso-fareast-language:EN-GB"> </span><span style=3D"mso-liga=
tures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black;mso-l=
igatures:none;mso-fareast-language:EN-GB">CONFIDENTIALITY NOTICE: This emai=
l and any attachments are confidential and intended solely for the use of t=
he individual or entity to whom they
are addressed. If you have received this email in error, please notify the=
sender immediately and delete it from your system. You must not disclose, =
copy, or distribute any part of this email if you are not the intended reci=
pient.</span></i><span style=3D"mso-ligatures:none;mso-fareast-language:EN-=
GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black;mso-l=
igatures:none;mso-fareast-language:EN-GB"> </span></i><span style=3D"m=
so-ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black;mso-l=
igatures:none;mso-fareast-language:EN-GB">DISCLAIMER: The views and opinion=
s expressed in this email are those of the author and do not necessarily re=
present the views of our company. The
information contained in this email is for general information purposes on=
ly. While we endeavour to keep the information up to date and correct, we m=
ake no representations or warranties of any kind, express or implied, about=
the completeness, accuracy, reliability,
suitability, or availability with respect to the email or the information,=
products, services, or related graphics contained in the email for any pur=
pose. Any reliance you place on such information is therefore strictly at y=
our own risk.</span></i><span style=3D"mso-ligatures:none;mso-fareast-langu=
age:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black;mso-l=
igatures:none;mso-fareast-language:EN-GB"> </span></i><span style=3D"m=
so-ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black;mso-l=
igatures:none;mso-fareast-language:EN-GB">VIRUS WARNING: Although we have t=
aken reasonable precautions to ensure no viruses are present in this email,=
we cannot accept responsibility for
any loss or damage arising from the use of this email or attachments. It i=
s your responsibility to ensure that your computer systems are adequately p=
rotected from viruses and other harmful code.</span></i><span style=3D"mso-=
ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black;mso-l=
igatures:none;mso-fareast-language:EN-GB"> </span></i><span style=3D"m=
so-ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black;mso-l=
igatures:none;mso-fareast-language:EN-GB">LEGAL NOTICE: This email does not=
constitute legal advice and is not intended to establish any attorney-clie=
nt relationship. You should seek appropriate
legal advice before taking or refraining from any action based on the cont=
ents of this email.</span></i><span style=3D"mso-ligatures:none;mso-fareast=
-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black;mso-l=
igatures:none;mso-fareast-language:EN-GB"> </span></i><span style=3D"m=
so-ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black;mso-l=
igatures:none;mso-fareast-language:EN-GB">COMPLIANCE WITH REGULATIONS: Our =
company operates in accordance with relevant data protection regulations. I=
f you have any concerns about how your
personal data is being processed, please contact</span></i><span style=3D"=
font-size:11.0pt;color:black;mso-ligatures:none;mso-fareast-language:EN-GB"=
> <i>our company using the above details.</i></span><span style=3D"mso=
-ligatures:none;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"mso-ligatures:none;mso-fareast-langua=
ge:EN-GB"> </span><o:p></o:p></p>
</div>
</body>
</html>
--_000_CWLP123MB5865013C48F8B47DCD5E5007E2CC2CWLP123MB5865GBRP_--
--_004_CWLP123MB5865013C48F8B47DCD5E5007E2CC2CWLP123MB5865GBRP_
Content-Type: image/png; name="image001.png"
Content-Description: image001.png
Content-Disposition: inline; filename="image001.png"; size=5674;
creation-date="Mon, 27 Jul 2026 14:01:08 GMT";
modification-date="Mon, 27 Jul 2026 14:01:08 GMT"
Content-ID: <image001.png@01DD1DD8.C08B9EE0>
Content-Transfer-Encoding: base64
iVBORw0KGgoAAAANSUhEUgAAAK0AAAA7CAYAAAAJkAodAAAAAXNSR0IArs4c6QAAFeRJREFUeF7t
3QOQJEvXBuDca9u2bdu2bdu2bdu2bdu2bd8vnvrjTNTU1nRXz/TMzt6/T8TEbk9nZSXePPkeZE6f
f//999/UktYI9Ecj0KcF2v5otlpNzUagBdoWEPq7EWiBtr+bslaDW6BtYaC/G4EWaPu7KWs1uAXa
Fgb6uxFogba/m7JWg7sNtJ988kn6+OOP0xtvvJG++OKL9Oeff6a///47DTzwwGnYYYdNE000URp9
9NHTZJNN1iOzcP/996ebbropffTRR+mvv/5KAw00UJp00knToosummafffYO2/DCCy+k2267LT37
7LNZ+z2n/UsvvXRaYoklOnzu7bffTtdcc0167rnn0i+//JIGGWSQ7DnPLLfccu2ee++995LyytSS
P/74I0088cRpnHHG6avYa6+9loy58SXKzjzzzGmYYYbJ2n3XXXelIYYYot1zffr0SYMPPngabbTR
0phjjlnz3fpw8803Zz+///57+ueff7L2zjXXXGmhhRZKE044YV99euedd7L2GO/JJ588ew8xB6+/
/npbf9U3wwwzpBFGGKESFpoK2k8//TTdcccd6ZZbbkkjjjhiGnfccbPBGG644dLQQw+dBhxwwGwC
v/nmm/T1118nnQLoCSaYIC2zzDJpxhlnrNToRgqde+65aYMNNqj5iHZdfvnlacUVV2wr9+CDD6aV
Vlopa18t2X333dMhhxzSVuStt95Kiy++ePJvLdl1113TwQcfnI3JXnvtlf2/iniXdxZl5ZVXTldd
dVW7X999991pgQUWyMZ6pJFGqlv9NNNMk/bdd9+0wgortCu77LLLphtuuKHm81NPPXW2SCkjsvPO
O6ejjjqq3TMRxzrggAOy9+Tl+uuvzzBQRZoCWhN0+umnpy+//DLTXAZq1FFHrfL+9PPPP6dnnnkm
04KfffZZBpyqja/3guuuuy4tv/zy9Yq1ff/II49kWtdiKmqOWpVsuumm6bTTTss0Gm2qT1Vkhx12
SEcffXQGWMCtIsccc0zafvvt+yq64YYbpnPOOafd7y08mvC7775Lww8/fJXqszJLLbVUuvHGG7P/
09ZPPfVU5WcDmPvvv3/ab7/92j231VZbpRNPPDHr80477dTuu9tvvz0tssgild7TJdCaJANukjfa
aKNsgLoitrezzz472zp0arrpputKdZl2oCXyghLYXtGW999/v913Dz/8cJpjjjnSu+++m2n/vIwy
yihpqqmmSj/88ENfk6jvZ555ZkaBLNZvv/227dGhhhoqGxfa7sknn2xX5y677JIOP/zwdNBBB6W9
9967Ul9NOLAXpQy0Dz30UJpzzjlLQUvDW2Dff/99ttjyQunQ0sQifuyxx9p9P/fcc2dbu9/nFygq
gJaQMtD6PcV22WWXpa233rrnQfv8888nap4mW2uttSoNeNVCAHXYYYdldGHLLbes+lhf5WiLotZG
XWzfp5xySl91h6bFMccff/x29WnHSSedlPS7uJg23njjdMYZZ2SgxdvQn5Dpp58+20lMFuDnBUXQ
z9C0KNSPP/5Y2t/4zpa74447dhm08847b7rvvvvSq6++mqaYYop29S288MIZzSNAb1zyEtqUZrzz
zjvbvqoC2tlmmy3ttttuffH6bte0V155ZcafbFX1CHynEZdStihogiOPPDINMMAADVdVBlrtRkFM
Pt6Vl1qgxYvtAo8++mimjfNSC7S4HmOujHIEaPN1lVEFvHy99dar2f9GNa0+2Fm6AlrAf+CBBxoC
rcKMUcojL90KWrzp8ccfz7hJPWu3YZSVPHD++ecn29ypp56aWe6NSBloLTgGVm8F7RFHHJGAOS/R
5lp97yxoX3755Yz25KWqpu0saMv60W2gZeExmDoDoEbAViwLuFxOxx13XEPV9CbQlmm0oBz5TqEL
Re8ADrjqqqt2i6b9T4P2lVdeySzcK664omGN1xDSOijMYGE8FK3OWnX3JtCiOVxC4Uflm+RiYp3/
fwGtvuP9PaZpV1lllWTrGm+88UpfSpNMMskkGbDIm2++mbmNgotynrPaY9J8P8YYY6QhhxwyK8+S
F2yoRTlYnAw/1m0VqQXaQw89NO2xxx7tqgkXUZkh1llOy5hsxGX0X9a0F110UYdGe9PpATcL63WT
TTYpxUrwMI5lYAzLXHABAPhwN9tss8xoEw0J/6lojGADMo8fkd9++y0NOuigpe9R15577pnOO++8
NvB3VtNeeuml6ayzzmpbNDThySefnPG7MtCGL5YnoBgEqWWIaZ/dYZ999snGsJ70FGi54SxSyiQC
AtG27uK0jFhGJU9LUZoKWu4bWgbQOhJuHeFKwh3CMtXAss+//vprFnG59dZbs+8ZdVdffXWmxYmQ
qQBFR4JP08YMj3pSS9PWerYMtEsuuWTme3ziiSfSFlts0e7xAK2+c+JbAGWy9tprZx6XWtGpngKt
Obv44ouz/hQ9E3yz4eaq5fJq1BAz54sttlgSPu5W0JoovrVaQPI98AVIOZ9Z/GWfcRpU49prr82+
t3Uy8A488MDsc3SsI1DhggBrtRZj6cVnmgnaWiAP0CpjR7Gz1BJ+ba6tshyCngJtR+1D555++uk2
X3QzQWs+RNvK3HpN07SiG5I7ij61YofrgXaeeebJtiJSBK0BosUDtPU0rTq422i0ekGNfgFa7RNI
EO1CY2qJfght5qVfg1aSE1sjpDtAW+ZubBpobR84Zr2tuKdB+8EHH2R0QoSqltQCrZDxhx9+2Gb4
oS34rKyoMnpQVdPmy0kgEhg59thjSx+P3IPeBFqJTiKSkXHVHaA1JhZ1XpoGWsaHkCGvQC3padBq
y7bbbpsljnTkzVCmFmjLMo2ENfG0MtAKSHC7oTNFn2meHpSNkx1LWxmoeSmLiPWUpp122mmznQB3
LYbKI8Srrf0VaGkeoL3gggtqAtaX/QK0LP2xxx67ZkZYo37aSJgpAy3PCa4KtEXfaj3QBi2SPBMJ
JX7XL0HL7uC1Keur/NjIKeivQPvSSy9lK7GYE1mG4H4B2nvuuScDUHGbybevUdB2NfeAkchgteD5
qyU/8z0zNHlhJNPknev9ErSRe9CTEbEwxLqNHrDiJXlUybLqF6AVjKBtw1VWtph6GrS0KC6YT9dz
MkPgpQXa/6NrvAfdBlpalj90jTXW6JX0gIGI1wJuR4k0PQ3astTEyPJqgbYHQCsK5tzO/PPP3ytB
q1HrrrtudmJAZK2qpuVekxgu+aZ4AqCr9KAMtAwegZeffvopO4LUWzhtM+gBbDBeQ+rl03a7puU3
xc9mmWWWXgtaESbGUUdBhjJNy/20+uqrZ1uUhZmX7gAtzwsftfC2nIn/AmglTzEqeVRE1ELszHg9
KTu50O2gZYDNNNNMab755uu1oK2naUXdiof0anXGiV2BkM4mzJgwnFY+RRXZbrvt+vLh9pTLq6qm
dUrDaY2qUuuMWLeDVmKDbXe11Var295+YYgBSHDayCwrNtSJAXH0KiCSzMMbwcIvOyO2zjrrJHm9
3GLFs3CRAeb9ZadiOxpAaZ7K58VpW0lBebnkkkuy3aGWWMBF92QsQmfWisez7aBC77xEeHdebPu8
M6SMRnXUDvkZ8q2JBKGIckb5OHFbtjDrhe/z7+zwYKPz7Sz0YnJIWYP7BWireA+irSiEgRJJc14/
RDaZ9EkpimuuuWbb72naOBkquYMLS76E3UcyOtoUp1t9J9iAboTwfzqoqGzxzBcXGIA5J+VgYVFO
OOGELIhh+yWSbyQJ1TtVLAjkhEPwewtV/i6fsjqceRt55JGzOlEUubxAxOWFtjjmTygDvlnR0BBe
JMEYIfbPP/+8XZM954yZNqozxHgcf/zxbVl0xoEiNHaCLPIPoo++s+D4h6tIh6B98cUX04UXXljT
pRQvaCZoObVFZOKiB6ApHjL03ip+2uIAGHBWPKNImiCtGpNVZbAaLcMws7iAZrDBBssmSbpm/yzm
xfjpm0Xn1HJnzu91ZQw6BC3089GWRcQA2nZJk5BmgpaWcv8BzUZw6nvvvbevPlqtY401VtPuSOjK
ILae7dkRqHnvgdClbax4B0Cc0w/SXSsVUZlGsrzirL6LHmRBuS+gTBgxOG2ZFu7ZIWy9radHoCZo
Q8vSqnmJ1LJIABGVwgMJkBZB3Aho5aOyWBkfXCvS/IqCm+JMQF1LUAGZVhF8YLChA8UkbDuHjC9h
V1ue9wffdEdWJC37F61g1MTpCkYbHqjfcdzI9skItOA8Y0fgr/V/2WVufMkbj3i2epUjntUel2h4
F0NJe3x2kUk8a1v2HH5ddtpDZI7lH+2Qq6Euz+HibgbKH29SP34qPRGlwY8pBadN7LzaOeWUU2Zz
LbiTT+b2HT+08ZUlFseqtFXmHD4d5fHofEAI1fCeOHpVbxHUBK2O8cUxyspAW1a5ycvfSuLzrLPO
2ubPYwRwQ4WVyYJlEOTvw4p643hO8T2iYAaCn7aW4L3OJZl4fTFoJoxf1+LAaRkYjBbtNHgmyoSw
6lET2twzvgdOk+HHQhSksIDxVmX834RpX9RjcrzXM+6vcusNCmSC1BmGnpMEThA4POr9JNqj7dJD
AU571A1gxhLovIMLK38XmTxl9zTg0uoDHj/KeoeFw1h0gYh2+DEOjFbRUJ4U7+DL5uXwWf/1jbFI
cehTvg8MKVTRaWKKQfvi0j5t1j8X0bmRx/yFaIs7KHxXRepei6RjDKO8ZReaNuiBM0Vu5QtNm8/e
V8YZqXDk6wRLN46Du+ANsOKqH0TfqrP9czHlrxhSv4FYf/31s8EN67OjjqIaLGoTBxSuNAIwk2Mx
0n6AZEBpOXkCLGRtpm25mbifABLIaBmLjFbhBXDQ0iTSTMCHNnmn40MAwlLGz+UemHAT43s/NKd6
1UWLeZ+bGNURGo7m5mtWzjEVVj5A0Ko0rEmOK4vUl08e4kKyaAHL/Nl1aF27iXYDL0UBtMbUArE4
7F6OrNP2REK4mxpFvvQh8pjtGMZV28ypPnCVUVhcXdojbVRf1GVMtV8/RCJ9ry3eC7R+V/UGzbqg
tT1vvvnm7W7ki4SH/F9zQiEAL64M8gztIEChnAx9GnbBBRfMBoPGoB0iN9Xql4QdfmF1OXgIaHlx
ZxaRDlhPArQGFTcHILcj+szQo7mA1sQ6rGhAfTah2k3bhs+U1uf+U4+JstXqYxG0ompusaHd+Cpt
53aqGAMgsPVadEAA3OoxiRaoxW0BmGDa3GTSSm5lAT6g1T4L2xjIFPPZ1py/48u1Rn7U5RntiOP/
xt7vgdauw70HbNpMQzr0iTLR4oAM2ICF9lhU+gJw7A7tBnoRMMJDA9jqdepFfTSzRU/x+dEnn+10
+mCO0YqgFPXmtS5oVcBvqOE0HInj1935J8hsJVZ8bJXei+fFMZaOTuzmO5wHLc1Nq8s9MOBF0NLE
BtREAlIRtAZYfjEgVgUt/y+6ENob6MOo9Z64t9aCVSeNLcwMUAAqiAGUtGoRtM6XhaFssmuB1s6G
v9oBADwPWtqSDzgfMAnQxvZvno2JxYZOxaliGhv1oi2D3tnJ7MRA6c40oI1Qex60QG1MixfR1QOs
7yuBVkHbqS3dNmo1OXpcvNOqygurlkH+aZ58tAbwTF7VKyHzoLW6tdt2W6ZpgVa9NEmzQEtL03BF
0Hq/YActRpvRhADSKGjRMIu4CmgZtTStvqEpngE0oMWF83MZoAVwFMzW3xnQmiugldQEpGikndZc
+GzXqZL6WsRMZdDyyZpQHLGnnckabcHQurbnqhKgxRsNFHpA09rOLEJADXqA1jC8aAn966qmjSM2
DBb8krYKTdsM0OKLwsdsjvAi5McmTw9oVqDDrWlxhvFXX32V7aC0pnEQGbR7URIBWjuShYGysP4b
0bRAKXfWto/mWRx2D0A2FxaD7ygK1IPHqapUBq0KaSmDIWTXkyKkyAAC3EYWDNDSLrawcEvRbOqI
tERGgwH0PTCF1d9V0OJ6tn/vMmERrEEPugravPdA3dpuK84nN+VBa7EU/dncVrin+3RxVe1DOVCa
AC0lYXwoKllq+lOVHqArQe0sBu/wLNoQhpiFjc9aDKKvVaUh0KqUb5afDbnuKFGl6surlANYF/za
Yhq9pTFAawD5LAFIm21ZBs4Kt3sEaE0+zWOwmwFaQLDFAlmzQUsLaicQWAQ0IuMwJA9avNEY2Glo
WqFk9IumNRZhH+CYjOc8aBlYlBV/NTrTKGjtMOq3uBiK/g3jUluMPdAWk2tqYaNh0KqMgWSbBdzi
RcFVgFi1DE1gcG1PVS3LMkPM71joOK07HOKWG8kkee8BQ0EiRzPogQVg6zbZ3tlMemAsAJTHBogs
RGDI3yaeBy2XI3cX16KyygFScFpGKcoQ0gzQWkyRWBSnYFAAbj2gtZBpdoutUekUaL2Ef5Dry3Gc
vFO70QaUlbd18VDw25X9fYGq78gbYlZ5GGK0FFcbF1uAFq9jKMQf7+iqpqUFO/IedJUe0N4x4VUN
Md4DWV+e3WabbdpcXsDONZXnlM0CLf6KC9udgbhoiKEm2tKodBq0XmRibK+2He6XKqccajVQuNGl
zaI5PAWiK12RMu9BZ11eLN3w09JWVfy0XQEtfspPy11V5qcFWi44LrF63gPA5nrjPy66vGg8oC1z
eZnfztKDKi4vnig7YKPSJdDGy3BcTn+kWiIwK7HKnwDyPDIuYiKrnRvN30iIDK9GO1Ms3yw/Le6F
E7J05UTY6g04ENcKLjQKWlSIsQlYzufR/j4DVhhaEVyoB1o3tohSWmByhdUdid20GwqEHsQ80f5o
EyoWEbHuBC1DNXKbuTYFn/wRlyrSFNDGizj/8TeDg+uyWIU7TTgL3mQg3TSqsKIti8PfdyhGrT9C
V6UzxTJCj0BmQmgkyTO0DXpgIoVxAwToQETETDSOpwxa4XOEKmk9fBW1wMfcgsitpQwObqHYXgGA
lsJp488b2T2ERNUlmsQ4tD37PyNTaNQzXEEc9t7j/9xTXHTCpNEeLi8GljqNK/Dl79uVl8zqN7Ys
d9oYjwUQnBZgUKNi7oFFKFGKi9P70TQeGH5efdLHyBuQQyBZR3+MAxGGR7FoWgpI/WwfLjB0wRgb
t6iDAmAQ21GaFsbtDFg8IzLCWc65DqQmyESwFv1w/dAW4vllVz929r3553BjWtwE2WrtBAbfIAMs
a9nk0jrCtADFUxERLz5LgYFon4nXdtTAYiSuNDXonqGJAdg7LQwg0/fwj1qUQGSi5AjbZQBOufDE
8DJY9OpRBzCiSdqmPO2pPepBx/iAIzei6OuUgWYRRZYXr4FdENCA13GcOBQaoVk7JaPNAjJOeKid
lD2gPYyr8OJI/rHoPBu3aka9ygCh8RLa9lkf/FjE+YgmjS64UXV3bqqmbQbQWnW0RqDeCLRAW2+E
Wt/3uhFogbbXTUmrQfVGoAXaeiPU+r7XjUALtL1uSloNqjcCLdDWG6HW971uBFqg7XVT0mpQvRFo
gbbeCLW+73Uj8D8WwKqLT4nVEQAAAABJRU5ErkJggg==
--_004_CWLP123MB5865013C48F8B47DCD5E5007E2CC2CWLP123MB5865GBRP_--