Elliot Kendall

**Name of the Vulnerable Software and Affected Versions** AWStats Totals versions 1.0 through 1.14 **Description** The issue allows remote attackers to inject arbitrary web script or HTML via the `month` and `year` parameters. This can lead to cross-site scripting (XSS) attacks. **Recommendations** For AWStats Totals versions 1.0 through 1.14, as a temporary workaround, consider restricting access to the vulnerable parameters `month` and `year` to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Data Domain OS versions prior to 4.0.3.6 Description: The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in certain arguments to various commands. This is demonstrated by the interface argument to the (1) ifconfig and (2) ping commands. Recommendations: For versions prior to 4.0.3.6, update to version 4.0.3.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the command line administration interface to minimize the risk of exploitation. Avoid using shell metacharacters in arguments to commands such as ifconfig and ping until the issue is resolved.