Will Aoki

Name of the Vulnerable Software and Affected Versions: OCS Inventory NG version 1.01 Description: The issue in the web interface of OCS Inventory NG allows remote attackers to enumerate valid usernames by generating different error messages depending on whether a username is valid. Recommendations: For OCS Inventory NG version 1.01, consider modifying the error handling mechanism to prevent disclosure of valid usernames. As a temporary workaround, restrict access to the web interface to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: snmptrapfmt version 3.0 Description: The issue allows local users to overwrite arbitrary files via a symlink attack on a temporary log file, potentially leading to disruption of protected information integrity. This can be exploited by a local attacker. Recommendations: For snmptrapfmt version 3.0, consider restricting access to the temporary log file to prevent a symlink attack until a patch is available. As a temporary workaround, restrict the use of snmptrapfmt to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.