Nicolas Verdier

**Name of the Vulnerable Software and Affected Versions** Bitdefender GravityZone Update Server (affected versions not specified) **Description** A server-side request forgery (SSRF) issue exists in the Bitdefender GravityZone Update Server when operating in Relay Mode. The HTTP proxy component on port 7074 uses a domain allowlist to restrict outbound requests but fails to properly sanitize hostnames containing null-byte (%00) sequences. By manipulating a request to a domain such as `evil.com%00.bitdefender.com`, an attacker can bypass the allowlist check, causing the proxy to forward requests to arbitrary external or internal systems. **Recommendations** As a temporary workaround, consider restricting access to the HTTP proxy component on port 7074 to minimize the risk of exploitation. Avoid using the proxy in Relay Mode until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Bitdefender GravityZone Console (affected versions not specified) **Description** A vulnerability exists in the sendMailFromRemoteSource method in Emails.php, which unsafely uses the php unserialize() function on user-supplied input without validation. This allows an attacker to craft a malicious serialized payload, triggering PHP object injection, performing a file write, and gaining arbitrary command execution on the host system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Bitdefender GravityZone Console versions prior to 6.41.2.1 **Description** A server-side request forgery (SSRF) issue allows an attacker to bypass input validation logic using leading characters in DNS requests. This could potentially be used for the execution of third-party code when paired with other vulnerabilities. **Recommendations** For versions prior to 6.41.2.1, update to version 6.41.2.1 or later to resolve the issue. As a temporary workaround, consider restricting DNS requests to prevent exploitation of the SSRF vulnerability.

Name of the Vulnerable Software and Affected Versions: GravityZone Console versions prior to 6.38.1-2 Description: A host whitelist parser issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue is related to insufficient checking of incoming requests, which can be exploited by a remote attacker to perform an SSRF attack. Recommendations: For GravityZone Console versions prior to 6.38.1-2, update to version 6.38.1-2 or later to resolve the issue. As a temporary workaround, consider restricting access to the proxy service to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Bitdefender Endpoint Security for Linux version 7.0.5.200089 Bitdefender Endpoint Security for Windows version 7.9.9.380 GravityZone Control Center (On Premises) version 6.36.1 **Description** An Incorrect Regular Expression vulnerability in Bitdefender GravityZone Update Server allows an attacker to cause a Server Side Request Forgery and reconfigure the relay. **Recommendations** For Bitdefender Endpoint Security for Linux version 7.0.5.200089, update to a version that includes the fix for the Incorrect Regular Expression vulnerability. For Bitdefender Endpoint Security for Windows version 7.9.9.380, update to a version that includes the fix for the Incorrect Regular Expression vulnerability. For GravityZone Control Center (On Premises) version 6.36.1, update to a version that includes the fix for the Incorrect Regular Expression vulnerability. As a temporary workaround, consider restricting access to the vulnerable component in the GravityZone Update Server to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Bitdefender Endpoint Security for Linux version 7.0.5.200089 Bitdefender Endpoint Security for Windows version 7.9.9.380 GravityZone Control Center (On Premises) version 6.36.1 **Description** The issue is related to an Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in the UpdateServer component of Bitdefender GravityZone. This vulnerability allows an attacker to execute arbitrary code on vulnerable instances. **Recommendations** For Bitdefender Endpoint Security for Linux version 7.0.5.200089, update to a version that includes a fix for the UpdateServer component vulnerability. For Bitdefender Endpoint Security for Windows version 7.9.9.380, update to a version that includes a fix for the UpdateServer component vulnerability. For GravityZone Control Center (On Premises) version 6.36.1, update to a version that includes a fix for the UpdateServer component vulnerability. As a temporary workaround, consider disabling the UpdateServer component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Products.CMFCore versions prior to 3.2 **Description** The use of Python's marshal module to handle unchecked input in a public method on `PortalFolder` objects can lead to an unauthenticated denial of service and crash situation. The code in question is exposed by all portal software built on top of `Products.CMFCore`, such as Plone. All deployments are vulnerable. **Recommendations** For versions prior to 3.2, update to version 3.2 to resolve the issue. As a temporary workaround, users can make the affected `decodeFolderFilter` method unreachable by editing the `PortalFolder.py` module in `Products.CMFCore` by hand and then restarting Zope. To do this, go to line 233 of `PortalFolder.py` and remove both the `@security.public` decorator for `decodeFolderFilter` as well as the method's entire docstring.

**Name of the Vulnerable Software and Affected Versions** Zimbra Collaboration Suite versions 8.8.15 through 9.0 **Description** An issue was discovered in ProxyServlet.java in the /proxy servlet. The value of the `X-Forwarded-Host` header overwrites the value of the `Host` header in proxied requests. The value of the `X-Forwarded-Host` header is not checked against the whitelist of hosts that ZCS is allowed to proxy to, which is defined by the `zimbraProxyAllowedDomains` setting. **Recommendations** For versions 8.8.15 through 9.0, consider restricting the `X-Forwarded-Host` header to only allow trusted hosts, as defined in the `zimbraProxyAllowedDomains` setting, to prevent unauthorized proxy requests. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Bitdefender GravityZone versions prior to 3.3.8.272 Description: A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService component of Bitdefender Endpoint Security Tools allows an attacker to proxy requests to the relay server. Recommendations: For versions prior to 3.3.8.272, update to version 3.3.8.272 or later to resolve the issue. As a temporary workaround, consider restricting access to the EPPUpdateService component to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Bitdefender GravityZone versions prior to 3.3.8.272 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability, in the UpdateServer component of Bitdefender GravityZone. This allows an attacker to execute arbitrary code on vulnerable instances. Recommendations: For versions prior to 3.3.8.272, update to version 3.3.8.272 or later to resolve the issue. As a temporary workaround, consider restricting access to the UpdateServer component until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Bitdefender Endpoint Security Tools versions prior to 6.6.27.390 Bitdefender Endpoint Security Tools versions prior to 7.1.2.33 Bitdefender Unified Endpoint for Linux versions prior to 6.2.21.160 Bitdefender GravityZone versions prior to 6.24.1-1 **Description** A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService allows an attacker to use the Endpoint Protection relay as a proxy for any remote host. This issue is related to insufficient validation of incoming requests, which can allow a remote attacker to disclose protected information. **Recommendations** For Bitdefender Endpoint Security Tools versions prior to 6.6.27.390, update to version 6.6.27.390 or later. For Bitdefender Endpoint Security Tools versions prior to 7.1.2.33, update to version 7.1.2.33 or later. For Bitdefender Unified Endpoint for Linux versions prior to 6.2.21.160, update to version 6.2.21.160 or later. For Bitdefender GravityZone versions prior to 6.24.1-1, update to version 6.24.1-1 or later. As a temporary workaround, consider restricting access to the EPPUpdateService to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** The Plus Addons for Elementor Page Builder WordPress plugin versions prior to 4.1.12 **Description** The issue concerns a reflected Cross-Site Scripting problem. It is related to the `theplus more post` AJAX action, which did not properly sanitise some of its fields. This makes the plugin exploitable on both unauthenticated and authenticated users. **Recommendations** For versions prior to 4.1.12, update to version 4.1.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the `theplus more post` AJAX action until a patch is applied.

Name of the Vulnerable Software and Affected Versions: Tenable.sc and Tenable.sc Core versions 5.13.0 through 5.17.0 Description: The issue allows an authenticated, unprivileged user to perform Remote Code Execution (RCE) on the Tenable.sc server via Hypertext Preprocessor unserialization. Recommendations: For versions 5.13.0 through 5.17.0, update to a version that contains a fix for this issue to prevent Remote Code Execution (RCE) on the Tenable.sc server. As a temporary workaround, consider restricting access to the Hypertext Preprocessor unserialization functionality until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Bitdefender Endpoint Security Tools for Windows versions prior to 6.6.18.261 Bitdefender Endpoint Security SDK versions prior to 6.6.18.261 **Description** An improper authentication issue allows an unprivileged local attacker to escalate privileges or tamper with the product's security settings. **Recommendations** For Bitdefender Endpoint Security Tools for Windows versions prior to 6.6.18.261, update to version 6.6.18.261 or later. For Bitdefender Endpoint Security SDK versions prior to 6.6.18.261, update to version 6.6.18.261 or later.

**Name of the Vulnerable Software and Affected Versions** Oracle E-Business Suite versions 12.1.3 and 12.2.3 through 12.2.9 **Description** The issue is related to inadequate access control in the Preferences component of Oracle CRM Technical Foundation, allowing an unauthenticated attacker with network access via HTTPS to compromise the system. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. This can result in unauthorized access to critical data, complete access to all accessible data, as well as unauthorized update, insert, or delete access to some accessible data. **Recommendations** For versions 12.1.3 and 12.2.3 through 12.2.9, consider restricting access to the Preferences component until a patch is available. As a temporary workaround, limit the use of HTTPS protocol for remote access to minimize the risk of exploitation. Avoid relying on user interaction that may facilitate the attack, and ensure that all users are aware of the potential risks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle CRM Technical Foundation versions 12.1.3 and 12.2.3 through 12.2.9 **Description** The issue is related to inadequate access control in the Preferences component of Oracle CRM Technical Foundation. It allows a remote attacker to gain unauthorized access to modify, add, or delete data, or access protected information via the HTTPS protocol. Successful attacks may significantly impact additional products and can result in unauthorized access to critical data or complete access to all accessible data in Oracle CRM Technical Foundation, as well as unauthorized update, insert, or delete access to some accessible data. **Recommendations** For versions 12.1.3, update to a version that includes the fix for this issue. For versions 12.2.3 through 12.2.9, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Preferences component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Oracle E-Business Suite versions 12.1.3 and 12.2.3 through 12.2.9 **Description** The issue is related to inadequate access control in the Preferences component of Oracle CRM Technical Foundation, allowing an unauthenticated attacker with network access via HTTPS to compromise the system. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. This can result in unauthorized access to critical data, complete access to all accessible data, as well as unauthorized update, insert, or delete access to some accessible data. **Recommendations** For versions 12.1.3 and 12.2.3 through 12.2.9, consider restricting access to the Preferences component until a patch is available. As a temporary workaround, limit the use of HTTPS protocol for remote access to minimize the risk of exploitation. Avoid relying on user interaction that may facilitate the attack, and ensure that all users are aware of the potential risks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Alfresco Enterprise versions prior to 4.1.6.13 **Description** The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through various means, including an XHTML document, a <% tag, or the `taskId` parameter to the "share/page/task-edit" endpoint. **Recommendations** For versions prior to 4.1.6.13, update to version 4.1.6.13 or later to resolve the issue. As a temporary workaround, consider restricting access to the `taskId` parameter in the "share/page/task-edit" endpoint until a patch is applied. Avoid using the <% tag and ensure proper validation and sanitization of XHTML documents to minimize the risk of exploitation.