Jakub Buczak

Incorrect permission assignment for a critical resource in Armoury Crate allows a local user to bypass the driver’s validation mechanism, resulting in unauthorized read and write access to physical memory.Refer to the '  Security Update for Armoury Crate App   ' section on the ASUS Security Advisory for more information.

**Name of the Vulnerable Software and Affected Versions** Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure (affected versions not specified) **Description** A stored cross-site scripting (XSS) attack could be conducted by an unauthenticated, remote attacker against a user of the web-based management interface on an affected device. This issue is due to insufficient validation of user-supplied input by the interface. An attacker could exploit this by injecting malicious code into specific pages, potentially allowing the execution of arbitrary script code in the context of the affected interface or access to sensitive, browser-based information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.