Christian Weiler

**Name of the Vulnerable Software and Affected Versions** Nagios XI versions prior to 5.7.2 **Description** Nagios XI versions prior to 5.7.2 are susceptible to cross-site scripting (XSS) through the Manage Users page within the Admin interface. This is due to inadequate validation or escaping of user-provided input, potentially enabling an attacker to inject and execute arbitrary script within a victim’s browser. **Recommendations** Update to version 5.7.2 or later.

**Name of the Vulnerable Software and Affected Versions** Nagios XI versions prior to 5.7.3 **Description** Nagios XI versions prior to 5.7.3 have a privilege escalation issue in the `getprofile.sh` helper script. The script handles profile retrieval and initialization with insecure file and command handling, and lacks sufficient validation of attacker-controlled inputs. In some deployments, the script runs with elevated privileges. A local attacker with low-level access could exploit these weaknesses to execute arbitrary commands or modify privileged files, leading to privilege escalation. **Recommendations** Update to a version of Nagios XI at or above 5.7.3.

**Name of the Vulnerable Software and Affected Versions** Nagios XI versions prior to 5.7.3 **Description** Nagios XI versions prior to 5.7.3 contain a command injection issue in the report PDF download/export functionality. Insufficient validation or improper escaping of user-supplied values used in the PDF generation pipeline or the wrapper that invokes offline/pdf helper utilities allows an authenticated attacker who can trigger PDF exports to inject shell metacharacters or arguments. **Recommendations** Update to version 5.7.3 or later.

**Name of the Vulnerable Software and Affected Versions** ScienceLogic SL1 (affected versions not specified) **Description** A command injection issue exists in the dashboard scheduler feature, where unsanitized user-controlled input is passed directly to a shell command, allowing the injection of arbitrary commands to the underlying operating system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ScienceLogic SL1 (affected versions not specified) **Description** A command injection issue exists in the ARP ping device tool feature of the ScienceLogic SL1. This feature takes unsanitized user-controlled input and passes it directly to a shell command, allowing for the injection of arbitrary commands to the underlying operating system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ScienceLogic SL1 (affected versions not specified) **Description** A command injection issue exists in the "dash export" feature, where unsanitized user-controlled input is passed directly to a shell command, allowing the injection of arbitrary commands to the underlying operating system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ScienceLogic SL1 (affected versions not specified) **Description** A command injection issue exists in the ticket report generate feature, allowing arbitrary commands to be injected into the underlying operating system due to unsanitized user-controlled input being passed directly to a shell command. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Talend Data Catalog versions prior to 8.0-20230413 **Description** The issue concerns the remote harvesting server, which contains a "/upgrade" endpoint that allows an unauthenticated WAR file to be deployed on the server. A mitigation measure is to place the remote harvesting server behind a firewall that only allows access to the Talend Data Catalog server. **Recommendations** For versions prior to 8.0-20230413, update to version 8.0-20230413 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/upgrade" endpoint until a patch is available. Place the remote harvesting server behind a firewall that only allows access to the Talend Data Catalog server to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Talend Data Catalog versions prior to 8.0-20230110 **Description** The issue concerns XML External Entity (XXE) attacks. Specifically, the /MIMBWebServices/license endpoint of the remote harvesting server is affected. **Recommendations** For versions prior to 8.0-20230110, update to version 8.0-20230110 or later to resolve the issue. As a temporary workaround, consider restricting access to the "license" endpoint in the /MIMBWebServices path to minimize the risk of exploitation.