Richard Brain

**Name of the Vulnerable Software and Affected Versions** Adobe ColdFusion versions prior to 10 **Description** The authentication process in Adobe ColdFusion does not require knowledge of the cleartext password if the password hash is known. This makes it easier for attackers to obtain administrative privileges by leveraging read access to the configuration file. **Recommendations** For versions prior to 10, update to version 10 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** TYPO3 versions 4.5.x through 4.5.20 TYPO3 versions 4.6.x through 4.6.13 TYPO3 versions 4.7.x through 4.7.5 **Description** A cross-site scripting (XSS) issue exists in the function menu API, allowing remote authenticated backend users to inject arbitrary web script or HTML. **Recommendations** For versions 4.5.x through 4.5.20, update to version 4.5.21 or later. For versions 4.6.x through 4.6.13, update to version 4.6.14 or later. For versions 4.7.x through 4.7.5, update to version 4.7.6 or later.

**Name of the Vulnerable Software and Affected Versions** HP System Management Homepage (SMH) versions prior to 6.2 **Description** The issue allows remote attackers to redirect users to arbitrary web sites, potentially leading to phishing attacks. **Recommendations** For versions prior to 6.2, update to version 6.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Adobe ColdFusion versions 9.0.1 and earlier **Description** The issue allows remote attackers to read arbitrary files due to directory traversal vulnerabilities in the administrator console. This is achieved via the `locale` parameter to various CFIDE/administrator/ endpoints, including "CFIDE/administrator/settings/mappings.cfm", "logging/settings.cfm", "datasources/index.cfm", "j2eepackaging/editarchive.cfm", and "enter.cfm". The vulnerability exists because of incorrect restriction of the directory path name with limited access. **Recommendations** For Adobe ColdFusion versions 9.0.1 and earlier, consider disabling access to the vulnerable CFIDE/administrator/ endpoints, such as "mappings.cfm", "logging/settings.cfm", "datasources/index.cfm", "j2eepackaging/editarchive.cfm", and "enter.cfm", until a patch is available. Restrict the use of the `locale` parameter in these endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apache Axis2 versions 1.4.1 through 1.5.1 **Description** A cross-site scripting (XSS) issue exists in the administration console, allowing remote attackers to inject arbitrary web script or HTML via the `modules` parameter. This affects products that use Apache Axis2, such as SAP Business Objects 12 and 3com IMC. **Recommendations** For Apache Axis2 versions 1.4.1 through 1.5.1, consider restricting access to the administration console to minimize the risk of exploitation. As a temporary workaround, avoid using the `modules` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HP System Management Homepage (SMH) versions prior to 6.0 **Description** A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `servercert` parameter in the `proxy/smhui/getuiinfo` endpoint. **Recommendations** For versions prior to 6.0, update to version 6.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Moodle version 1.6.5 **Description** The issue allows remote attackers to obtain sensitive information via a direct request to certain PHP files, specifically "blog/blogpage.php" and "course/report/stats/report.php", when display errors is enabled. This reveals the installation path in an error message. **Recommendations** For Moodle version 1.6.5, consider disabling the display errors setting to prevent sensitive information disclosure. Additionally, restrict access to the "blog/blogpage.php" and "course/report/stats/report.php" files until a more permanent solution is available.

**Name of the Vulnerable Software and Affected Versions** RSA Authentication Agent version 5.3.0.258 for Web for IIS **Description** The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This can be achieved via an ftp URL in the `url` parameter to a Redirect action, particularly when accessed through certain browsers like Mozilla Firefox. **Recommendations** For RSA Authentication Agent version 5.3.0.258 for Web for IIS, consider restricting access to the Redirect action or validating the `url` parameter to prevent redirects to unauthorized sites. As a temporary workaround, avoid using the `url` parameter in the Redirect action until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Spyce - Python Server Pages (PSP) version 2.1.3 **Description** The issue allows remote attackers to obtain sensitive information via a direct request for "spyce/examples/automaton.spy", which reveals the path in an error message. **Recommendations** For version 2.1.3, consider restricting access to the "spyce/examples/automaton.spy" endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Spyce - Python Server Pages (PSP) version 2.1.3 **Description** The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the `url` parameter. This can be exploited by providing a malicious URL to the vulnerable application. **Recommendations** For Spyce - Python Server Pages (PSP) version 2.1.3, consider validating and sanitizing the `url` parameter to prevent redirects to arbitrary web sites. As a temporary workaround, restrict access to the redirect functionality to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Spyce - Python Server Pages (PSP) version 2.1.3 **Description** The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved through various parameters in different API endpoints, including: the `url` or `type` parameter to "docs/examples/redirect.spy"; the `x` parameter to "docs/examples/handlervalidate.spy"; the `name` parameter to "spyce/examples/request.spy"; the `Name` parameter to "spyce/examples/getpost.spy"; the `mytextarea`, `mypass`, or an empty parameter to "spyce/examples/formtag.spy"; the `newline` parameter to the default URI under "demos/chat/"; the `text1` parameter to "docs/examples/formintro.spy"; or the `mytext` or `mydate` parameter to "docs/examples/formtag.spy". **Recommendations** For Spyce - Python Server Pages (PSP) version 2.1.3, consider disabling the affected API endpoints until a patch is available. Restrict access to the parameters `url`, `type`, `x`, `name`, `Name`, `mytextarea`, `mypass`, `newline`, `text1`, `mytext`, and `mydate` in their respective endpoints to minimize the risk of exploitation. Avoid using these parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Absolute News Manager.NET version 5.1 **Description** The issue allows remote attackers to obtain sensitive information. This is achieved via a direct request to "getpath.aspx", which reveals the installation path in an error message. **Recommendations** For Absolute News Manager.NET version 5.1, consider restricting access to the "getpath.aspx" page to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Microsoft ASP .NET Framework version 2.0.50727.42 **Description** The issue allows remote attackers to bypass request filtering, which can lead to cross-site scripting (XSS) attacks or cause a denial of service. This can be achieved by exploiting the improper handling of comment enclosures, for example, via an xss:expression STYLE attribute in a closing XSS HTML tag. **Recommendations** For Microsoft ASP .NET Framework version 2.0.50727.42, consider updating to a newer version that properly handles comment enclosures to prevent request filtering bypass and subsequent attacks. As a temporary workaround, restrict access to potentially vulnerable endpoints to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** F5 Networks FirePass 1000 SSL VPN versions 5.5 and earlier **Description** A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `sid` parameter in the my.acctab.php3 file. This could potentially lead to unauthorized actions on the affected system. **Recommendations** For F5 Networks FirePass 1000 SSL VPN versions 5.5 and earlier, avoid using the `sid` parameter in the my.acctab.php3 file until a fix is available. As a temporary workaround, consider restricting access to the my.acctab.php3 file to minimize the risk of exploitation.