Ben Leonard-Lagarde

The vulnerable software is Cisco Meeting Management, which has a flaw in its REST API that allows a remote, authenticated attacker with low privileges to elevate privileges to administrator on an affected device. This is possible due to improper authorization enforcement, which can be exploited by sending API requests to a specific endpoint. A successful exploit could allow the attacker to gain administrator-level control over edge nodes managed by Cisco Meeting Management. The vulnerable versions are 3.9 or earlier, and users should upgrade to a fixed release to prevent attacks. Over 100 devices are potentially affected, according to ZoomEye search results. An exploit for this flaw is available, and users are urged to update immediately to prevent attacks. https://t.co/N8IJM5YWq7 and https://t.co/5RDw3PoTe9 provide more information about the exploit. #Cisco #CiscoMeetingManagement #RESTAPI #PrivilegeEscalation #Cybersecurity #InfoSec #CyberThreats #MeetingManagement

**Name of the Vulnerable Software and Affected Versions** Avaya Aura System Manager versions 10.1.x.x through 10.2.x.x **Description** An improper access control issue was found in Avaya Aura System Manager, allowing a command-line interface user with administrative privileges to read arbitrary files on the system. **Recommendations** For versions 10.1.x.x through 10.2.x.x, consider restricting access to sensitive files and directories to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Avaya Aura System Manager versions 10.1.x.x through 10.2.x.x Avaya Aura System Manager versions prior to 10.1 **Description** A SQL injection issue was discovered, allowing a command line interface user with administrative privileges to execute arbitrary queries against the Avaya Aura System Manager database. **Recommendations** For versions 10.1.x.x through 10.2.x.x, update to a version that includes a fix for this issue. For versions prior to 10.1, consider upgrading to a supported version to mitigate the risk. As a temporary workaround, consider restricting administrative access to the command line interface until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Oracle Enterprise Manager Base Platform version 13.5.0.0 **Description** The issue is related to insufficient input validation in the Host Management component of the Oracle Enterprise Manager Base Platform. This allows a low-privileged attacker with logon access to the infrastructure where the platform executes to compromise it. Successful attacks can result in the takeover of the Oracle Enterprise Manager Base Platform and may significantly impact additional products. **Recommendations** For version 13.5.0.0, update to a newer version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ePO versions prior to 5.10 SP1 Update 1 **Description** A reflected cross-site scripting (XSS) vulnerability allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link. This would lead to limited access to sensitive information and limited ability to alter some information in ePO. **Recommendations** For versions prior to 5.10 SP1 Update 1, update to version 5.10 SP1 Update 1 or later to resolve the issue. As a temporary workaround, consider restricting access to links from untrusted sources to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Splunk App for Stream versions prior to 8.1.1 **Description** A low-privileged user could use a vulnerability in the `streamfwd` process within the Splunk App for Stream to escalate their privileges on the machine that runs the Splunk Enterprise instance, up to and including the root user. **Recommendations** For versions prior to 8.1.1, update to version 8.1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the `streamfwd` process to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** IBM QRadar SIEM versions 7.3 through 7.5 **Description** The issue allows for local privilege escalation. If combined with other unknown vulnerabilities, it could potentially lead to privilege escalation. **Recommendations** For versions 7.3 through 7.5, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Callback Assist versions 4.0.x before 4.7.1.1 Patch 7 Description: An XML External Entities (XXE) issue could allow an authenticated, remote attacker to gain read access to information stored on an affected system. Recommendations: For versions 4.0.x before 4.7.1.1 Patch 7, update to version 4.7.1.1 Patch 7 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Avaya Aura Orchestration Designer versions prior to 7.2.3 Description: An XML External Entities (XXE) issue in the web-based user interface could allow an authenticated, remote attacker to gain read access to information stored on an affected system. Recommendations: For versions prior to 7.2.3, update to version 7.2.3 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Avaya Session Border Controller for Enterprise versions 7.x through 8.1.1.x Description: A command injection issue could allow an authenticated, remote attacker to send specially crafted messages and execute arbitrary commands with the affected system privileges. Recommendations: For Avaya Session Border Controller for Enterprise versions 7.x through 8.1.1.x, update to a version that includes a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Avaya Control Manager versions 7.x and 8.0.x prior to 8.0.4.0 **Description** A SQL injection issue in the reporting component could allow an unauthenticated attacker to execute arbitrary SQL commands and retrieve sensitive data related to other users on the system. **Recommendations** For Avaya Control Manager versions 7.x and 8.0.x prior to 8.0.4.0, update to version 8.0.4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the reporting component to minimize the risk of exploitation.