Michał Bogdanowicz

**Nome do software vulnerável e versões afetadas** Algosec FireFlow, versões A32.20 a A32.60 **Descrição** O problema está relacionado à validação inadequada de entradas no editor de fluxo de trabalho do VisualFlow, por meio dos campos `Nome`, `Descrição` e `Arquivo de configuração`. Isso permite que um invasor inicie um ataque XSS injetando scripts executáveis maliciosos no código do aplicativo. **Recomendações** Para a versão A32.20, atualize para b600 ou superior. Para a versão A32.50, atualize para b430 ou superior. Para a versão A32.60, atualize para b250 ou superior.

**Name of the Vulnerable Software and Affected Versions** FireFlow versions prior to A32.20 (b570) FireFlow versions prior to A32.50 (b390) FireFlow versions prior to A32.60 (b220) **Description** The issue allows an attacker to obtain a victim's domain credentials and Net-NTLM hash via HTML injection in the VisualFlow workflow editor, potentially leading to relay domain attacks. This is achieved through stored HTML injection using the `Name` and `Description` fields, and also impacts outbound actions using the `Name` and `Category` parameters. **Recommendations** For versions prior to A32.20 (b570), update to A32.20 (b570 or above) to resolve the issue. For versions prior to A32.50 (b390), update to A32.50 (b390 or above) to resolve the issue. For versions prior to A32.60 (b220), update to A32.60 (b220 or above) to resolve the issue. As a temporary workaround, consider restricting the use of the `Name` and `Description` fields in the VisualFlow workflow editor, as well as limiting outbound actions using the `Name` and `Category` parameters, until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** IBM Security Guardium versions 10.6 through 11.5 **Description** The issue allows a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. **Recommendations** For versions 10.6 through 11.5, update to a version that includes a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.