Juan Manuel Fernandez

**Name of the Vulnerable Software and Affected Versions** Pleasant Password Server version 7.11.41.0 **Description** A cross-site scripting (XSS) issue exists in the /framework/cron/action/humanize component, allowing attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the `cronString` parameter. **Recommendations** For version 7.11.41.0, consider disabling access to the /framework/cron/action/humanize component until a patch is available. As a temporary workaround, restrict the use of the `cronString` parameter in the affected component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Arcserve UDP versions 7.0 through 9.0.6034 **Description** The issue allows authentication bypass, enabling an attacker to obtain a valid session and execute tasks as an administrator. This is achieved by exploiting the `getVersionInfo` method at `WebServiceImpl/services/FlashServiceImpl`, which leaks the `AuthUUID` token. The token can then be used at `/WebServiceImpl/services/VirtualStandbyServiceImpl` to gain administrative access. The vulnerability may be exploited by sending a specially crafted HTTP request, potentially allowing an attacker to elevate privileges and execute arbitrary code. It is estimated that 235,000 clients in 150 countries use the affected software, which could be targeted in ransomware attacks to delete data, including backups. **Recommendations** For Arcserve UDP versions 7.0 through 9.0.6034, update to version 9.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the `WebServiceImpl/services/FlashServiceImpl` and `/WebServiceImpl/services/VirtualStandbyServiceImpl` endpoints until a patch is available. Avoid using the `AuthUUID` token in the affected API endpoints until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** nfdump versions 1.6.17 and earlier **Description** The issue is related to an integer overflow in the `Process ipfix template withdraw` function in `ipfix.c`, which can be exploited to crash the process remotely, resulting in a denial of service. **Recommendations** For nfdump versions 1.6.17 and earlier, as a temporary workaround, consider disabling the `Process ipfix template withdraw` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Zeroshell version 3.9.0 **Description** The issue occurs because the web application mishandles a few HTTP parameters, allowing an unauthenticated attacker to exploit this by injecting OS commands inside the vulnerable parameters. There has been an increase in scanning activity to exploit and compromise ZeroShell Linux router. **Recommendations** For Zeroshell version 3.9.0, as a temporary workaround, consider restricting access to the web application to minimize the risk of exploitation. Avoid using the vulnerable HTTP parameters until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OCS Inventory version 2.4.1 **Description** The issue is a remote command-execution problem. It happens because the content of the `ipdiscover analyser` `rzo` GET parameter is concatenated to a string used in an `exec()` call in the PHP code. To exploit this, authentication is required. **Recommendations** For OCS Inventory version 2.4.1, consider restricting access to the `ipdiscover analyser` module to minimize the risk of exploitation. Avoid using the `rzo` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OCS Inventory version 2.4.1 **Description** The issue concerns multiple SQL injections in the search engine of the affected software. It is noted that authentication is required to exploit these issues. **Recommendations** For OCS Inventory version 2.4.1, update to a newer version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OCS Inventory version 2.4.1 **Description** The issue is related to improper XML parsing configuration, which allows the use of external entities. This can be exploited by an attacker through a crafted HTTP request, potentially leading to information exfiltration or a Denial of Service. **Recommendations** For OCS Inventory version 2.4.1, consider disabling the XML parsing functionality until a proper configuration or patch is available to prevent the exploitation of external entities.

Name of the Vulnerable Software and Affected Versions: ubiQuoss Switch VP5208A (affected versions not specified) Description: The issue allows unauthorized access to user credentials. When a failed login attempt occurs, the system creates a file named bcm password at /cgi-bin/ containing the user credentials in cleartext. This file can be accessed via an HTTP request, potentially allowing attackers to obtain the credentials and use them to access the system via SSH or TELNET if enabled. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** YADIFA versions prior to 2.2.6 **Description** The issue is related to the DNS packet parser, which does not check for infinite pointer loops. This allows an attacker to force the server into an infinite loop, resulting in high CPU usage and making the server unresponsive. **Recommendations** For versions prior to 2.2.6, update to version 2.2.6 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** dnsmasq versions prior to 2.78 **Description** The issue is related to insufficient size checking of DNS packets in the `memset()` function of the dnsmasq DNS server. This can be exploited by a remote attacker to cause a denial of service by sending specially crafted requests to port 53/udp. The exploitation leads to `dnsmasq` crashing due to an incorrect size parameter in a `memset` call, resulting in an attempt to write a large number of zeros. **Recommendations** For versions prior to 2.78, update to version 2.78 or later to resolve the issue. As a temporary workaround, consider restricting access to the DNS server to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Cobian Backup version 11 **Description** The issue allows man-in-the-middle attackers to add and execute new backup tasks by spoofing the master server. Additionally, attackers can execute system commands remotely by abusing pre-backup events. **Recommendations** For Cobian Backup version 11, consider restricting access to the master server to prevent spoofing, and limit the execution of system commands through pre-backup events until a fix is available.

**Name of the Vulnerable Software and Affected Versions** AeroAdmin version 4.1 **Description** The issue concerns the use of an insecure protocol, specifically HTTP, for software updates. This allows an attacker to potentially hijack an update through a man-in-the-middle attack, enabling them to execute code on the machine. **Recommendations** For AeroAdmin version 4.1, consider disabling the automatic update feature until a secure update mechanism is implemented, and restrict network access to trusted sources to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** AeroAdmin version 4.1 **Description** The issue arises from a function that copies data between two pointers, where the size of the data copied is directly obtained from a network packet. This can lead to a buffer overflow, resulting in a denial of service. **Recommendations** For AeroAdmin version 4.1, consider restricting access to the function that handles network packets to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenText Tempo Box version 10.0.3 **Description** A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML persistently via the name of an uploaded image. This enables attackers to execute malicious scripts on the client-side, potentially leading to unauthorized actions or data theft. **Recommendations** For OpenText Tempo Box version 10.0.3, update to a version that fixes this issue, as using persistent XSS vulnerabilities can lead to severe security breaches. At the moment, there is no information about a newer version that contains a fix for this vulnerability.