Piotr Madej

**Name of the Vulnerable Software and Affected Versions** Dell EMC NetWorker versions 18.x through 19.4.0.1 **Description** The issue is related to an Improper Certificate Validation vulnerability in the client components of Dell EMC NetWorker, which uses SSL encrypted connections to communicate with the application server. An unauthenticated attacker in the same network collision domain as the client could potentially exploit this vulnerability to perform man-in-the-middle attacks, intercepting and tampering with the traffic between the client and the application server. **Recommendations** For versions 18.x through 19.4.0.1, consider disabling the SSL encrypted connection in the NetWorker Management Console client until a patch is available. Restrict access to the NetWorker Management Console to minimize the risk of exploitation. Avoid using the vulnerable client components in the affected versions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions (affected versions not specified) **Description** This issue concerns a remote code execution flaw in the Windows Print Spooler service, also known as PrintNightmare. The vulnerability allows remote attackers to execute arbitrary code on affected systems. Exploitation can occur without authentication. Multiple reports indicate the vulnerability remains active on many machines within Active Directory networks, potentially allowing attackers to deliver payloads via the SMB protocol. The vulnerability affects the system, allowing attackers to impact its functionality. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Oracle Database Server versions 11.2.0.4, 12.1.0.2, 12.2.0.1, and 18c Description: The issue is related to insufficient input validation in the SQL Developer Install component of Oracle Database Server. This vulnerability can be easily exploited by a low-privileged attacker with Client Computer User Account privilege and logon to the infrastructure where SQL Developer Install executes. Successful attacks require human interaction from a person other than the attacker and can result in unauthorized read access to a subset of SQL Developer Install accessible data. Recommendations: For versions 11.2.0.4, 12.1.0.2, 12.2.0.1, and 18c, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Microsoft Edge (affected versions not specified) Description: A remote code execution issue exists due to improper access of objects in memory. This could allow an attacker to execute arbitrary code in the context of the current user, potentially gaining the same user rights as the current user. If the current user has administrative rights, the attacker could take control of the affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. The vulnerability can be exploited through a specially crafted website, and an attacker could convince a user to view the website, possibly through email or instant messaging enticement. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Hitachi Command Suite versions prior to 8.7.1-00 Hitachi Automation Director versions prior to 8.5.0-00 **Description** A vulnerability allows authenticated remote users to expose technical information through error messages. This issue affects products including Hitachi Device Manager and Hitachi Compute Systems Manager. **Recommendations** For Hitachi Command Suite versions prior to 8.7.1-00, update to version 8.7.1-00 or later. For Hitachi Automation Director versions prior to 8.5.0-00, update to version 8.5.0-00 or later.

**Name of the Vulnerable Software and Affected Versions** Hitachi Command Suite versions prior to 8.6.2-00 Hitachi Automation Director versions prior to 8.6.2-00 Hitachi Infrastructure Analytics Advisor versions prior to 4.2.0-00 **Description** A vulnerability allows authenticated remote users to load an arbitrary Cascading Style Sheets (CSS) token sequence. This issue affects various components of Hitachi Command Suite, including Hitachi Device Manager, Hitachi Tiered Storage Manager, Hitachi Replication Manager, Hitachi Tuning Manager, Hitachi Global Link Manager, and Hitachi Compute Systems Manager. **Recommendations** For Hitachi Command Suite versions prior to 8.6.2-00, update to version 8.6.2-00 or later. For Hitachi Automation Director versions prior to 8.6.2-00, update to version 8.6.2-00 or later. For Hitachi Infrastructure Analytics Advisor versions prior to 4.2.0-00, update to version 4.2.0-00 or later.

**Name of the Vulnerable Software and Affected Versions** Hitachi Command Suite versions 7.x through 8.x before 8.6.5-00 **Description** A vulnerability allows an unauthenticated remote user to read internal information. **Recommendations** For Hitachi Command Suite versions 7.x through 8.x before 8.6.5-00, update to version 8.6.5-00 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Hitachi Command Suite version 8.5.3 **Description** An Information Exposure issue was discovered, allowing a remote attacker to potentially exploit a flaw in the permission of messaging. This could enable information exposure via a crafted message. **Recommendations** For Hitachi Command Suite version 8.5.3, at the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: Internet Explorer versions 9 through 11 Description: A remote code execution issue exists due to improper memory object access. This could lead to memory corruption, allowing an attacker to execute arbitrary code in the context of the current user. If the user has administrative rights, the attacker could gain control of the system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. Recommendations: For Internet Explorer 9, update to a version that includes the fix for this issue. For Internet Explorer 10, update to a version that includes the fix for this issue. For Internet Explorer 11, update to a version that includes the fix for this issue.