Tyler Cui

**Nome do software vulnerável e versões afetadas** IBM Partner Engagement Manager versão 2.0 **Descrição** O problema é causado por uma falha de deserialização insegura, permitindo que um invasor remoto execute código arbitrário no sistema ao enviar dados especialmente criados para esse fim. **Recomendações** Para o IBM Partner Engagement Manager versão 2.0, considere desativar a funcionalidade de deserialização como uma solução temporária até que um patch esteja disponível. Restrinja o acesso ao sistema para minimizar o risco de exploração.

**Name of the Vulnerable Software and Affected Versions** D-Link DIR-140L and DIR-640L devices **Description** The issue is related to the storage of credentials in an open manner, allowing remote unauthenticated attackers to discover admin credentials. This can enable a remote attacker to reveal protected information, specifically the admin password. **Recommendations** For D-Link DIR-140L and DIR-640L devices, consider restricting access to the dirary0.js script until a patch is available. As a temporary workaround, avoid using the default admin credentials and change them to strong, unique passwords to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** D-Link devices (DSL, DIR, DWR) (affected versions not specified) **Description** The issue is related to the lack of protection for sensitive data in the web interface of D-Link router firmware. It allows remote unauthenticated attackers to discover admin credentials, potentially revealing protected information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** D-Link DSL-2770L (affected versions not specified) **Description** The issue is related to the lack of protection for service data in the web interface of D-Link router firmware. It allows remote unauthenticated attackers to discover admin credentials, potentially revealing protected information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Splunk versions prior to 5.0.8 **Description** A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is due to an unspecified vector in Splunk Web. **Recommendations** For versions prior to 5.0.8, update to version 5.0.8 or later to resolve the issue.