Jakub Brzozowski

**Name of the Vulnerable Software and Affected Versions** Dell Common Event Enabler versions 8.9.10.0 and prior **Description** The issue is related to an insecure deserialization vulnerability in CAVATools. A local unauthenticated attacker could potentially exploit this, leading to arbitrary code execution in the context of the logged-in user. Exploitation requires a victim to open a malicious file. **Recommendations** For versions 8.9.10.0 and prior, update to a version that contains a fix for this issue to prevent arbitrary code execution. As a temporary workaround, consider avoiding the use of CAVATools until a patch is available. Restrict access to malicious files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Dell Repository Manager versions prior to 3.4.5 **Description** The issue concerns a Path Traversal vulnerability in the API module. A local attacker with low privileges could potentially exploit this to gain unauthorized write access to files on the server filesystem with the privileges of the running web application. **Recommendations** For versions prior to 3.4.5, update to version 3.4.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the API module to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: SolarWinds Platform (affected versions not specified) Description: The issue is related to a stored cross-site scripting vulnerability in the web console of the SolarWinds Platform. This vulnerability can be exploited by a remote attacker, allowing them to conduct cross-site scripting attacks. A high-privileged user and user interaction are required to exploit this vulnerability. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dell PowerProtect DD versions prior to 7.13.0.10 Dell PowerProtect DD version 6.2.1.110 Dell PowerProtect DD LTS versions prior to 7.7.5.25 Dell PowerProtect DD LTS versions prior to 7.10.1.15 **Description** The issue is related to an SQL Injection vulnerability. A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of certain SQL commands on the application's backend database, causing unauthorized read access to application data. This is due to a lack of protection of the SQL query structure. **Recommendations** For versions prior to 7.13.0.10, update to version 7.13.0.10 or later. For version 6.2.1.110, update to a version later than 6.2.1.110. For LTS versions prior to 7.7.5.25, update to version 7.7.5.25 or later. For LTS versions prior to 7.10.1.15, update to version 7.10.1.15 or later.

**Name of the Vulnerable Software and Affected Versions** Dell PowerProtect DD versions prior to 7.13.0.10 Dell PowerProtect DD LTS versions prior to 7.7.5.25 Dell PowerProtect DD LTS versions prior to 7.10.1.15 Dell PowerProtect DD version 6.2.1.110 **Description** The issue is related to an improper access control vulnerability. A local malicious user with low privileges could potentially exploit this vulnerability, leading to escalation of privilege. **Recommendations** For versions prior to 7.13.0.10, update to version 7.13.0.10 or later. For LTS versions prior to 7.7.5.25, update to version 7.7.5.25 or later. For LTS versions prior to 7.10.1.15, update to version 7.10.1.15 or later. For version 6.2.1.110, update to a version later than 6.2.1.110.

**Name of the Vulnerable Software and Affected Versions** Dell PowerProtect DD versions prior to 7.13.0.10 Dell PowerProtect DD LTS versions prior to 7.7.5.25 Dell PowerProtect DD LTS versions prior to 7.10.1.15 Dell PowerProtect DD version 6.2.1.110 **Description** The issue concerns an OS command injection vulnerability in the CLI of Dell PowerProtect DD. A local low-privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application. Exploitation may lead to a system takeover by an attacker. **Recommendations** For versions prior to 7.13.0.10, update to version 7.13.0.10 or later. For LTS versions prior to 7.7.5.25, update to version 7.7.5.25 or later. For LTS versions prior to 7.10.1.15, update to version 7.10.1.15 or later. For version 6.2.1.110, update to a version later than 6.2.1.110. As a temporary workaround, consider restricting access to the CLI to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Dell PowerProtect DD versions prior to 7.13.0.10 Dell PowerProtect DD LTS 7.7.5.25 Dell PowerProtect DD LTS 7.10.1.15 Dell PowerProtect DD version 6.2.1.110 **Description** A remote unauthenticated attacker could potentially exploit a DOM-based Cross-Site Scripting vulnerability, leading to the injection of malicious HTML or JavaScript code to a victim user's DOM environment in the browser. Exploitation may lead to information disclosure, session theft, or client-side request forgery. This vulnerability allows for full account takeover using the DataDomain REST API. **Recommendations** For versions prior to 7.13.0.10, update to version 7.13.0.10 or later. For LTS 7.7.5.25, update to a version later than 7.7.5.25. For LTS 7.10.1.15, update to a version later than 7.10.1.15. For version 6.2.1.110, update to a version later than 6.2.1.110. As a temporary workaround, consider restricting access to the DataDomain REST API until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Cisco Smart Software Manager On-Prem (affected versions not specified) **Description** A vulnerability in the web-based management interface of Cisco Smart Software Manager On-Prem could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This issue exists because the web-based management interface inadequately validates user input. An attacker could exploit this vulnerability by authenticating to the application as a low-privileged user and sending crafted SQL queries to an affected system. A successful exploit could allow the attacker to read sensitive data on the underlying database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OctoPrint versions prior to 1.6.0 **Description** The issue is related to incorrect access control in the Logging subsystem, which attempts to manage files that are not `*.log` files. This could potentially lead to unauthorized access or manipulation of files. **Recommendations** For versions prior to 1.6.0, update to version 1.6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Logging subsystem until a patch is available.

**Name of the Vulnerable Software and Affected Versions** OctoPrint versions prior to 1.6.0 **Description** The issue allows for XSS because API error messages include the values of input parameters, such as `username` or other user-provided data. This can lead to malicious scripts being executed on the client-side. **Recommendations** For versions prior to 1.6.0, update to version 1.6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to API endpoints that include user-provided input parameters in error messages until a patch is available.