Mohit Rawat

**Name of the Vulnerable Software and Affected Versions** Oracle Identity Manager versions 11.1.2.2.0 through 12.2.1.4.0 **Description** The issue exists due to insufficient input validation in the Identity Console component of Oracle Identity Manager. This can be exploited by a remote attacker to create, delete, or modify access to critical data using the HTTP protocol. Successful attacks may significantly impact additional products and can result in unauthorized access to critical data or complete access to all Identity Manager accessible data, as well as unauthorized update, insert, or delete access to some of Identity Manager accessible data. **Recommendations** For versions 11.1.2.2.0 through 12.2.1.4.0, update to a version that includes the fix for this issue to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Nagios Log Server version 2.1.3 **Description** The issue allows for cross-site scripting (XSS) attacks by exploiting a crafted name field on the /profile page, which is then mishandled on the /admin/users page. This enables any malicious user with limited access to store an XSS payload in their name field. When an administrator views this information, the XSS payload is triggered. **Recommendations** For Nagios Log Server version 2.1.3, consider restricting access to the /admin/users page until a fix is available, and avoid using the name field on the /profile page to store potentially malicious input. As a temporary workaround, consider validating and sanitizing user input in the name field to prevent the storage of XSS payloads.

**Name of the Vulnerable Software and Affected Versions** Cloudera Manager versions 5.x through 5.15.0 **Description** An issue in Cloudera Manager allows for potential cross-site scripting (XSS) due to the lack of validation of the `returnUrl` parameter. This parameter is used to redirect the user to another page in Cloudera Manager after completing a wizard. As a result, an attacker could redirect the user to an external site or execute malicious JavaScript functions. The fix involves restricting the `returnUrl` parameter to prevent external redirects, with exceptions for explicitly configured SAML Login/Logout URLs. **Recommendations** For Cloudera Manager versions 5.x through 5.15.0, update the software to a version that includes the fix, which restricts the `returnUrl` parameter to prevent external redirects, allowing only explicitly configured SAML Login/Logout URLs as exceptions.

**Name of the Vulnerable Software and Affected Versions** IBM Cognos Analytics version 11.0 **Description** The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session. **Recommendations** For IBM Cognos Analytics version 11.0, update to a version that includes a fix for this issue to prevent cross-site scripting attacks.

**Name of the Vulnerable Software and Affected Versions** IBM Cognos Analytics version 11.0 **Description** The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session. **Recommendations** For IBM Cognos Analytics version 11.0, consider disabling the Web UI functionality until a patch is available to prevent potential exploitation.

**Name of the Vulnerable Software and Affected Versions** IBM Cognos Analytics version 11.0 **Description** The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session. **Recommendations** For IBM Cognos Analytics version 11.0, update to a version that includes the fix for the issue, as referenced in IBM Reference #: 1998887.

**Name of the Vulnerable Software and Affected Versions** IBM Cognos Business Intelligence versions 10.1.1 before IF19 IBM Cognos Business Intelligence versions 10.2 before IF20 IBM Cognos Business Intelligence versions 10.2.1 before IF17 IBM Cognos Business Intelligence versions 10.2.1.1 before IF16 IBM Cognos Business Intelligence versions 10.2.2 before IF12 **Description** A cross-site scripting (XSS) issue allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. This can lead to the execution of malicious code on the user's browser. **Recommendations** For IBM Cognos Business Intelligence version 10.1.1, update to IF19 or later. For IBM Cognos Business Intelligence version 10.2, update to IF20 or later. For IBM Cognos Business Intelligence version 10.2.1, update to IF17 or later. For IBM Cognos Business Intelligence version 10.2.1.1, update to IF16 or later. For IBM Cognos Business Intelligence version 10.2.2, update to IF12 or later.