Jonathan Lein

**Name of the Vulnerable Software and Affected Versions** Windows NTLM (affected versions not specified) **Description** Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an attacker to perform spoofing over a network, which can affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco ISE (affected versions not specified) Cisco ISE-PIC (affected versions not specified) **Description** Insufficient validation of user-supplied input allows an authenticated remote attacker with valid administrative credentials to execute arbitrary commands on the underlying operating system of an affected device. This is achieved by sending a crafted HTTP request. A successful exploit can grant user-level access to the operating system, which can then be elevated to root privileges. In single-node deployments, this may lead to a denial of service (DoS) condition, rendering the node unavailable and preventing unauthenticated endpoints from accessing the network. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco ISE versions 3.1 through 3.5 Cisco ISE-PIC (affected versions not specified) **Description** An issue in the web interface of the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an authenticated remote attacker to execute arbitrary commands on the underlying operating system. This is caused by insufficient validation of user-supplied input and a lack of data sanitization at the management level. An attacker with valid administrative credentials, including read-only access, can exploit this by sending a crafted HTTP request. Successful exploitation provides user-level access to the operating system, which can then be elevated to root privileges. In single-node ISE deployments, this may lead to a denial of service (DoS) condition, preventing unauthenticated endpoints from accessing the network until the node is restored. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco ISE (affected versions not specified) Cisco ISE-PIC (affected versions not specified) **Description** Improper validation of user-supplied input allows an authenticated remote attacker with valid administrative credentials to perform path traversal attacks on the underlying operating system. By sending a crafted HTTP request, an attacker can read arbitrary sensitive files from the affected system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows NTLM (affected versions not specified) **Description** A flaw exists in Windows NTLM that permits external control of file names or paths, potentially enabling a local attacker to perform spoofing. This issue allows attackers to affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.