Evgeny Ermakov

**Name of the Vulnerable Software and Affected Versions** Nortek Linear eMerge E3 series versions V0.32-07e and prior **Description** A Command Injection issue allows a remote attacker to execute arbitrary code on a target machine with elevated privileges. The vulnerability is related to the incorrect neutralization of special elements used in a command, which can be exploited by a remote attacker to elevate privileges and execute arbitrary code. **Recommendations** For versions V0.32-07e and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Automated Logic Corporation (ALC) Liebert SiteScan Web versions 6.5 and prior ALC WebCTRL versions 6.5 and prior Carrier i-Vu versions 6.5 and prior **Description** An issue was discovered that allows an attacker to enter malicious input through a weakly configured XML parser, causing the application to execute arbitrary code or disclose file contents from a server or connected network. **Recommendations** For ALC Liebert SiteScan Web versions 6.5 and prior, consider disabling the XML parser until a patch is available. For ALC WebCTRL versions 6.5 and prior, restrict access to the XML parsing functionality to minimize the risk of exploitation. For Carrier i-Vu versions 6.5 and prior, avoid using weakly configured XML parsers in the application until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Liebert SiteScan versions prior to 6.5 **Description** The issue is related to an XML External Entity (XXE) problem, which is caused by incorrect restriction of XML links to external objects. This can allow a remote attacker to gain access to confidential information by using specially crafted XML requests. An attacker may enter malicious input to Liebert SiteScan through a weakly configured XML parser, causing the application to execute arbitrary code or disclose file contents from a server or connected network. **Recommendations** For versions prior to 6.5, consider disabling the XML parser or restricting its use until a patch is available to prevent exploitation of the XXE issue. Restrict access to the Liebert SiteScan web interface to minimize the risk of exploitation. Avoid using weakly configured XML parsers in the Liebert SiteScan application until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Invensys Wonderware Information Server (WIS) versions 4.0 SP1 through 5.0 **Description** The issue allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. **Recommendations** For versions 4.0 SP1 through 5.0, as a temporary workaround, consider restricting access to XML documents or disabling the processing of external entities until a patch is available.

**Name of the Vulnerable Software and Affected Versions** RDoc versions 2.3.0 through 3.12 RDoc versions 4.x before 4.0.0.preview2.1 **Description** The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, due to improper document generation by darkfish.js in RDoc. **Recommendations** For RDoc versions 2.3.0 through 3.12, update to a version outside of this range to resolve the issue. For RDoc versions 4.x before 4.0.0.preview2.1, update to version 4.0.0.preview2.1 or later to resolve the issue.