Christopher Schneider

**Name of the Vulnerable Software and Affected Versions** APOC versions prior to 5.5.0 APOC versions 4.4.0 through 4.4.0.13 **Description** A XML External Entity (XXE) vulnerability was found in the apoc.import.graphml procedure of APOC core plugin in Neo4j graph database. This occurs when the XML parser allows external entities to be resolved. The XML parser used by the apoc.import.graphml procedure was not configured in a secure way, allowing external entities to be used to read local files, send HTTP requests, and perform denial-of-service attacks on the application. Abusing the XXE vulnerability enabled assessors to read local files remotely, although this was limited to one-line files due to the level of privileges assessors had. With the ability to write to the database, any file could have been read. Additionally, assessors noted that the server could be crashed by passing in improperly formatted XML. **Recommendations** For APOC versions prior to 5.5.0, update to version 5.5.0 or later. For APOC versions 4.4.0 through 4.4.0.13, update to version 4.4.0.14 or later. If you cannot upgrade the library, control the allowlist of the procedures that can be used in your system.

Name of the Vulnerable Software and Affected Versions: Cisco Unified Communications Manager (affected versions not specified) Cisco Unified Communications Manager Session Management Edition (affected versions not specified) Cisco Unified Communications Manager IM & Presence Service (affected versions not specified) Cisco Unity Connection (affected versions not specified) Cisco Prime License Manager (affected versions not specified) Description: The issue is related to improper sanitization of user-supplied input in the SOAP API endpoint, which could allow an authenticated, remote attacker to execute arbitrary code on an affected device. An attacker could exploit this by sending a SOAP API request with crafted parameters to an affected device, potentially allowing the execution of arbitrary code with root privileges on the underlying Linux operating system. Recommendations: For Cisco Unified Communications Manager, update to a version that includes the fix for this issue. For Cisco Unified Communications Manager Session Management Edition, update to a version that includes the fix for this issue. For Cisco Unified Communications Manager IM & Presence Service, update to a version that includes the fix for this issue. For Cisco Unity Connection, update to a version that includes the fix for this issue. For Cisco Prime License Manager, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the SOAP API endpoint until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Cisco Unified Communications Manager versions (affected versions not specified) Cisco Unified Communications Manager IM & Presence Service versions (affected versions not specified) Cisco Unified Communications Manager Session Management Edition versions (affected versions not specified) Cisco Unity Connection versions (affected versions not specified) **Description** The web-based management interface of the affected Cisco products does not properly validate user-supplied input, allowing an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against an interface user. An attacker could exploit this issue by persuading an interface user to click a crafted link, potentially executing arbitrary script code in the context of the affected interface or accessing sensitive browser-based information. **Recommendations** For Cisco Unified Communications Manager, update to a version that properly validates user-supplied input. For Cisco Unified Communications Manager IM & Presence Service, update to a version that properly validates user-supplied input. For Cisco Unified Communications Manager Session Management Edition, update to a version that properly validates user-supplied input. For Cisco Unity Connection, update to a version that properly validates user-supplied input. As a temporary workaround, consider restricting access to the web-based management interface to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SD-WAN Orchestrator versions 3.3.2 through 3.3.2 P3 SD-WAN Orchestrator versions 3.4.x through 3.4.4 SD-WAN Orchestrator versions 4.0.x through 4.0.1 **Description** The SD-WAN Orchestrator handles system parameters in an insecure way. An authenticated SD-WAN Orchestrator user with high privileges may be able to execute arbitrary code on the underlying operating system. **Recommendations** For SD-WAN Orchestrator version 3.3.2, update to version 3.3.2 P3 or later. For SD-WAN Orchestrator version 3.4.x, update to version 3.4.4 or later. For SD-WAN Orchestrator version 4.0.x, update to version 4.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** VMware SD-WAN Orchestrator versions 3.3.2 through 3.3.2 P3 VMware SD-WAN Orchestrator versions 3.4.x through 3.4.4 VMware SD-WAN Orchestrator versions 4.0.x through 4.0.1 **Description** The issue is related to the lack of protection against SQL query structure exploitation in the VMware SD-WAN Orchestrator platform. This can allow a remote attacker to gain unauthorized access to protected information. An authenticated SD-WAN Orchestrator user may inject code into SQL queries, potentially leading to information disclosure. **Recommendations** For versions 3.3.2 through 3.3.2 P3, update to version 3.3.2 P3 or later. For versions 3.4.x through 3.4.4, update to version 3.4.4 or later. For versions 4.0.x through 4.0.1, update to version 4.0.1 or later.