Ory Segal

**Name of the Vulnerable Software and Affected Versions** Docker Skeleton Runtime for Apache OpenWhisk versions 1.3.0 and earlier **Description** The issue allows an attacker to replace the user function inside the container if the user code is vulnerable to code exploitation. This can occur in a Docker action that inherits the Docker tag openwhisk/dockerskeleton:1.3.0 or earlier. **Recommendations** For Docker Skeleton Runtime for Apache OpenWhisk versions 1.3.0 and earlier, consider updating to a newer version that contains a fix for this issue, although the specific fixed version is not provided in the available data. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Nuuo NT-4040 Titan firmware NT-4040 01.07.0000.0015 1120 **Description** The issue concerns the use of non-random default credentials, specifically `admin:admin` and `localdisplay:111111`, which can be exploited by a remote network attacker to gain privileged access to a vulnerable device. **Recommendations** For Nuuo NT-4040 Titan firmware NT-4040 01.07.0000.0015 1120, change the default credentials `admin:admin` and `localdisplay:111111` to strong, unique credentials to prevent unauthorized access.

**Name of the Vulnerable Software and Affected Versions** Intellian Satellite TV antennas t-Series and v-Series version 1.07 **Description** The issue concerns the use of non-random default credentials, specifically `ftp/ftp` or `intellian:12345678`, which can be exploited by a remote network attacker to gain elevated access to a vulnerable device. **Recommendations** For version 1.07, change the default credentials `ftp/ftp` and `intellian:12345678` to unique and strong passwords to prevent unauthorized access.

**Name of the Vulnerable Software and Affected Versions** Green Packet DX-350 **Description** The issue concerns the use of non-random default credentials, specifically `root:wimax`, which can be exploited by a remote network attacker to gain privileged access to a vulnerable device. **Recommendations** For Green Packet DX-350, change the default credentials to strong, unique ones to prevent unauthorized access.

**Name of the Vulnerable Software and Affected Versions** Synology NAS servers DS107 version 3.1-1639 and prior Synology NAS servers DS116 versions prior to 5.2-5644-1 Synology NAS servers DS213 versions prior to 5.2-5644-1 **Description** The issue concerns the use of non-random default credentials in Synology NAS servers. Specifically, the default credentials are `guest:` (blank) and `admin:` (blank). A remote network attacker can exploit this to gain privileged access to a vulnerable device. **Recommendations** For DS107 version 3.1-1639 and prior, change the default credentials for `guest` and `admin` to secure passwords. For DS116 versions prior to 5.2-5644-1, update to version 5.2-5644-1 or later and change the default credentials for `guest` and `admin` to secure passwords. For DS213 versions prior to 5.2-5644-1, update to version 5.2-5644-1 or later and change the default credentials for `guest` and `admin` to secure passwords.

Name of the Vulnerable Software and Affected Versions: BEA Systems WebLogic version 8.1 SP1 Description: The issue allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header. This causes the server to incorrectly handle and forward the body of the request, resulting in the receiving server processing it as a separate HTTP request. Recommendations: For BEA Systems WebLogic version 8.1 SP1, consider restricting access to the server until a patch is available to prevent HTTP Request Smuggling attacks. As a temporary workaround, disabling the handling of requests with both "Transfer-Encoding: chunked" and Content-Length headers may help minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Microsoft IIS versions 5.0 through 6.0 Description: The issue allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a `Transfer-Encoding: chunked` header and a `Content-Length` header. This causes the server to incorrectly handle and forward the body of the request, resulting in the receiving server processing it as a separate HTTP request, also known as "HTTP Request Smuggling." Recommendations: For Microsoft IIS versions 5.0 through 6.0, consider disabling the handling of HTTP requests with both `Transfer-Encoding: chunked` and `Content-Length` headers as a temporary workaround until a patch is available. Restrict access to sensitive web application areas to minimize the risk of exploitation. Avoid using vulnerable configurations that allow for web cache poisoning and XSS attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: IBM WebSphere versions 5.0 through 5.1 Description: The issue allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header. This causes the server to incorrectly handle and forward the body of the request, resulting in the receiving server processing it as a separate HTTP request. Recommendations: For IBM WebSphere versions 5.0 through 5.1, consider restricting access to the HTTP request handling mechanism to minimize the risk of exploitation. As a temporary workaround, avoid using the `Transfer-Encoding: chunked` header and the Content-Length header in the same HTTP request until a patch is available.

Name of the Vulnerable Software and Affected Versions: SunONE web server version 6.1 SP1 Description: The issue allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct cross-site scripting (XSS) attacks. This is achieved via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header. The vulnerable software incorrectly handles and forwards the body of the request, causing the receiving server to process it as a separate HTTP request, also known as "HTTP Request Smuggling." Recommendations: For SunONE web server version 6.1 SP1, consider disabling the handling of HTTP requests with both "Transfer-Encoding: chunked" and Content-Length headers as a temporary workaround until a patch is available. Restrict access to sensitive areas of the web application to minimize the risk of exploitation. Avoid using the vulnerable web server for critical applications until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PhpBB versions 2.0.4 through 2.0.9 **Description** The issue allows remote attackers to perform HTTP Response Splitting attacks, modifying expected HTML content from the server. This can be achieved via the `mode` parameter to "privmsg.php" or the `redirect` parameter to "login.php". **Recommendations** For versions 2.0.4 through 2.0.9, consider restricting access to the `privmsg.php` and `login.php` scripts until a patch is available. As a temporary workaround, avoid using the `mode` parameter in "privmsg.php" and the `redirect` parameter in "login.php" to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Microsoft SharePoint Portal Server 2001 **Description** The issue allows remote attackers to process arbitrary web content and steal cookies via certain server scripts. This is due to multiple cross-site scripting (XSS) vulnerabilities. **Recommendations** For Microsoft SharePoint Portal Server 2001, consider disabling scripts that process web content from untrusted sources as a temporary workaround until a patch is available. Restrict access to sensitive server scripts to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Microsoft Exchange Server 5.5 Outlook Web Access (OWA) Description: A cross-site scripting (XSS) issue exists in the HTML encoding for the Compose New Message form, allowing remote attackers to execute arbitrary web script. Recommendations: For Microsoft Exchange Server 5.5 Outlook Web Access (OWA), consider disabling the Compose New Message form until a fix is available to prevent potential exploitation.

Name of the Vulnerable Software and Affected Versions: cPanel version 6.4.2 Description: A cross-site scripting (XSS) issue allows remote attackers to insert arbitrary HTML, potentially gaining cPanel administrator privileges. This occurs when a script in a URL is logged but not properly quoted when displayed via the Error Log or Latest Visitors screens. Recommendations: For cPanel version 6.4.2, update to a version that addresses this issue to prevent potential exploitation.