Casey Erdmann

**Name of the Vulnerable Software and Affected Versions** AdTran Personal Phone Manager versions 10.8.1 and earlier **Description** The AdTran Personal Phone Manager software is vulnerable to an authenticated stored cross-site scripting (XSS) issue. This issue impacts versions 10.8.1 and below, and potentially later versions as well, since they have not previously been disclosed. The affected appliances, NetVanta 7060 and NetVanta 7100, are considered End of Life and will not be patched. **Recommendations** For versions 10.8.1 and earlier, as the affected appliances are End of Life and will not receive a patch, consider disabling the software or restricting access to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AdTran Personal Phone Manager versions 10.8.1 and earlier **Description** The AdTran Personal Phone Manager software is vulnerable to multiple reflected cross-site scripting (XSS) issues. These issues impact versions 10.8.1 and below, and potentially later versions as well, since they have not previously been disclosed. The affected appliances, NetVanta 7060 and NetVanta 7100, are considered End of Life and will not be patched. **Recommendations** For versions 10.8.1 and earlier, consider disabling any features that may be susceptible to cross-site scripting attacks until a patch is available, however, since the affected appliances are End of Life, a patch will not be provided. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AdTran Personal Phone Manager version 10.8.1 **Description** The issue allows for exfiltration of data over DNS, potentially enabling exposed AdTran Personal Phone Manager web servers to be used as DNS redirectors to tunnel arbitrary data over DNS. The affected appliances, NetVanta 7060 and NetVanta 7100, are considered End of Life and will not receive a patch for this issue. **Recommendations** For AdTran Personal Phone Manager version 10.8.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Liferay Portal CE versions 7.1.0 through 7.2.1 GA2 **Description** The First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are vulnerable to a persistent XSS issue. Any user can modify these fields with a particular XSS payload, and it will be stored in the database. The payload will then be rendered when a user utilizes the search feature to search for other users, specifically if a user with modified fields occurs in the search results. **Recommendations** For versions 7.1.0 through 7.2.1 GA2, update to Liferay Portal CE version 7.3.0 GA1 to resolve the issue. As a temporary workaround, consider restricting access to the MyAccountPortlet or disabling the search feature until a patch is available. Avoid using the `First Name`, `Middle Name`, and `Last Name` fields in the MyAccountPortlet until the issue is resolved.