Ahmed Aboul-Ela

**Name of the Vulnerable Software and Affected Versions** BeyondTrust Secure Remote Access Base Software versions prior to 6.0.2 **Description** A cross-site scripting (XSS) issue allows the injection of specially-crafted web requests without proper sanitization. This occurs when an unauthenticated, crafted web request is sent to the server, potentially allowing an attacker to achieve full admin access to the appliance by tricking the administrator into creating a new admin account through an XSS/CSRF attack involving a crafted request to the "/appliance/users?action=edit" endpoint. **Recommendations** For BeyondTrust Secure Remote Access Base Software versions prior to 6.0.2, update to a version newer than 6.0.1 to resolve the issue. As a temporary workaround, consider restricting access to the "/appliance/users?action=edit" endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software (affected versions not specified) **Description** A flaw exists in the web services interface of Cisco ASA and FTD Software due to insufficient validation of input. This allows an unauthenticated, remote attacker to perform directory traversal attacks and read sensitive files on a targeted system. The issue stems from improper input validation of URLs within HTTP requests. An attacker can exploit this by sending a crafted HTTP request containing directory traversal sequences. Successful exploitation allows viewing arbitrary files within the web services file system, which is enabled when WebVPN or AnyConnect features are configured. This issue cannot be used to access ASA or FTD system files or the underlying operating system files. Reports indicate widespread exploitation of this issue, with attackers targeting Cisco IOS decoys and honeypots. Several tools and scripts have been developed to scan for and exploit this vulnerability. The vulnerability has been actively exploited and is considered highly dangerous. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Elastix versions 2.5.0 and earlier **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `transactionID` parameter in the /a2billing/customer/iridium threed.php endpoint. **Recommendations** For Elastix versions 2.5.0 and earlier, update to a version later than 2.5.0 to resolve the issue. As a temporary workaround, consider restricting access to the /a2billing/customer/iridium threed.php endpoint to minimize the risk of exploitation. Avoid using the `transactionID` parameter in the affected endpoint until the issue is resolved.