Philip Huppert

**Name of the Vulnerable Software and Affected Versions** Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers (affected versions not specified) **Description** A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious HTTP POST requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux shell as root. **Recommendations** For Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers, update to the latest firmware version to address this vulnerability. As a temporary workaround, consider restricting access to the web-based management interface to minimize the risk of exploitation. Avoid using the web-based management interface until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Shibboleth XMLTooling-C versions prior to 1.6.3 Shibboleth Service Provider versions prior to 2.6.0 **Description** The issue concerns the mishandling of digital signatures of user attribute data. This allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD. **Recommendations** For Shibboleth XMLTooling-C versions prior to 1.6.3, update to version 1.6.3 or later. For Shibboleth Service Provider versions prior to 2.6.0, update to version 2.6.0 or later.