Cedric Van Bockhaven

**Nome do Software Vulnerável e Versões Afetadas** Software Intel(R) Graphics (versões afetadas não especificadas) **Descrição** O problema está relacionado ao controle de acesso inadequado em alguns softwares Intel(R) Graphics, o que pode permitir que um usuário autenticado potencialmente realize escalonamento de privilégio via acesso local. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

**Nome do software vulnerável e versões afetadas** Versões do Dell Power Manager anteriores à 3.14 **Descrição** O problema está relacionado a uma vulnerabilidade de autorização inadequada no serviço DPM. Um usuário mal-intencionado com privilégios limitados poderia potencialmente explorar essa vulnerabilidade para elevar seus privilégios no sistema. **Recomendações** Para versões anteriores à 3.14, atualize para a versão 3.14 ou posterior para resolver o problema. Como solução alternativa temporária, considere restringir o acesso ao serviço DPM para minimizar o risco de exploração.

**Name of the Vulnerable Software and Affected Versions** Windows Azure Pack versions prior to Rollup 13.1 **Description** A Cross-site Scripting (XSS) issue exists due to improper sanitization of user-provided input. This allows a remote attacker to perform cross-site scripting attacks with elevated privileges. **Recommendations** For Windows Azure Pack versions prior to Rollup 13.1, update to Rollup 13.1 or later to resolve the issue. As a temporary workaround, consider restricting user input to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** MISP versions prior to 2.4.79 **Description** The issue is related to persistent XSS via comments in the `app/View/Helper/CommandHelper.php` file. It affects users of the same instance, as the comment field is not part of the MISP synchronization. **Recommendations** For versions prior to 2.4.79, update to version 2.4.79 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** WordPress versions prior to 4.1.2 **Description** The issue allows remote attackers to inject arbitrary web script or HTML via a crafted character in a comment, potentially affecting WordPress installations that use MySQL without strict mode. This can be achieved by injecting a four-byte UTF-8 character or an invalid character that reaches the database layer. **Recommendations** For versions prior to 4.1.2, update to version 4.1.2 or later to resolve the issue. As a temporary workaround, consider restricting user input to prevent the injection of malicious characters.

**Name of the Vulnerable Software and Affected Versions** Plupload versions 2.1.2 WordPress versions 3.9.x through 4.1.1 **Description** A cross-site scripting (XSS) issue allows remote attackers to execute same-origin JavaScript functions via the `target` parameter. This can be demonstrated by executing a certain click function, related to ` init.as` and ` fireEvent.as` files. **Recommendations** For Plupload version 2.1.2, update to a version that fixes the XSS vulnerability. For WordPress versions 3.9.x through 4.1.1, update to version 4.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the `plupload.flash.swf` shim to minimize the risk of exploitation.