Sergey Bobrov

**Name of the Vulnerable Software and Affected Versions** Xibo versions prior to 4.1.0 **Description** Xibo is an open source digital signage platform with a web content management system (CMS). A cross-site scripting issue allows authorized users to execute arbitrary JavaScript via the file preview function. Users can upload HTML/CSS/JS files into the Xibo Library via the Generic File module to be referenced on Displays and in Layouts. When previewing these resources from the Library and Layout editor, they are executed in the user's browser. This behavior has been changed in version 4.1.0 to disable previewing of generic files. Users are encouraged to use the new developer tools in 4.1 to design their widgets which require this type of functionality. **Recommendations** For versions prior to 4.1.0, update to version 4.1.0 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the file preview function for generic files until the update is applied. Additionally, users are advised to use the new developer tools in 4.1 to design their widgets which require this type of functionality.

**Name of the Vulnerable Software and Affected Versions** Xibo versions prior to 4.1.0 **Description** A cross-site scripting issue in Xibo CMS allows authorized users to execute JavaScript via the DataSet functionality. This occurs when a user designs a DataSet with an HTML column containing JavaScript, which is then executed on the Data Entry page and in any Layouts referencing it. The behavior was changed in version 4.1.0 to display HTML, CSS, and JavaScript as code on the Data Entry page. **Recommendations** For versions prior to 4.1.0, update to version 4.1.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the DataSet functionality with HTML columns until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Xibo versions prior to 3.3.12 Xibo versions prior to 4.0.14 **Description** A SQL injection issue was discovered in the "report/data/proofofplayReport" API endpoint inside the Xibo content management system. This allows an authenticated user to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values into the `sortBy` parameter. **Recommendations** For versions prior to 3.3.12, upgrade to version 3.3.12 to resolve the issue. For versions prior to 4.0.14, upgrade to version 4.0.14 to resolve the issue. As a temporary workaround, consider restricting access to the "report/data/proofofplayReport" API endpoint until a patch is applied. Avoid using the `sortBy` parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Xibo versions prior to 3.3.12 Xibo versions prior to 4.0.14 **Description** A SQL injection issue was discovered in the API routes of Xibo, a content management system, specifically in the components responsible for filtering DataSets. This allows an authenticated user to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values into the APIs for importing JSON and importing a Layout containing DataSet data. **Recommendations** For versions prior to 3.3.12, upgrade to version 3.3.12 to resolve the issue. For versions prior to 4.0.14, upgrade to version 4.0.14 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Xibo versions prior to 3.3.12 Xibo versions prior to 4.0.14 **Description** A SQL injection issue was discovered in the API route responsible for Adding/Editing DataSet Column Formulas. This allows an authenticated user to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values into the `formula` parameter. **Recommendations** For versions prior to 3.3.12, upgrade to version 3.3.12 to resolve the issue. For versions prior to 4.0.14, upgrade to version 4.0.14 to resolve the issue. As a temporary workaround, consider restricting access to the `formula` parameter in the affected API endpoint until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Xibo versions prior to 3.3.12 Xibo versions prior to 4.0.14 **Description** A SQL injection issue was discovered in the API routes of Xibo, a content management system, specifically in the components responsible for filtering DataSets. This allows an authenticated user to obtain arbitrary data from the Xibo database by injecting specially crafted values into the API for viewing DataSet data. **Recommendations** For versions prior to 3.3.12, upgrade to version 3.3.12 to resolve the issue. For versions prior to 4.0.14, upgrade to version 4.0.14 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Thruk versions prior to 3.16 **Description** This issue allows authorized users with network access to inject arbitrary commands via the URL parameter during PDF report generation. The Thruk web application does not properly process the `url` parameter when generating a PDF report. An authorized attacker with access to the reporting functionality could inject arbitrary commands that would be executed when the script `/script/html2pdf.sh` is called. The vulnerability can be exploited by an authorized user with network access. **Recommendations** For versions prior to 3.16, upgrade to version 3.16 to address the issue. As a temporary workaround, consider restricting access to the reporting functionality to minimize the risk of exploitation. Avoid using the vulnerable URL parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Red Hat Ceph Storage RadosGW (Ceph Object Gateway) versions prior to 14.2.21 **Description** A flaw was found in the Red Hat Ceph Storage RadosGW related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. This issue is also related to insufficient input validation, which may allow a remote attacker to impact data integrity. **Recommendations** For versions prior to 14.2.21, update to version 14.2.21 or later to resolve the issue. As a temporary workaround, consider restricting access to the CORS configuration file to minimize the risk of exploitation. Avoid using the newline character in the ExposeHeader tag until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Apache HTTP Server versions 2.2.0 through 2.2.31 Apache HTTP Server versions 2.4.1 through 2.4.23 **Description** The issue allows for possible CRLF injection, enabling HTTP response splitting attacks for sites using mod userdir. This was mitigated by changes in versions 2.4.25 and 2.2.32, which prohibit CR or LF injection into the "Location" or other outbound header key or value. **Recommendations** For Apache HTTP Server versions 2.2.0 through 2.2.31, update to version 2.2.32 to resolve the issue. For Apache HTTP Server versions 2.4.1 through 2.4.23, update to version 2.4.25 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Android versions prior to 2016-11-01 **Description** An elevation of privilege issue in the AOSP Launcher could allow a local malicious application to create shortcuts with elevated privileges without user consent. This is a local bypass of user interaction requirements, providing access to functionality that would normally require user initiation or permission. **Recommendations** For Android versions prior to 2016-11-01, update to a version released after 2016-11-01 to resolve the issue. As a temporary workaround, consider restricting the installation of applications from unknown sources to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Django versions prior to 1.8.15 Django versions 1.9.x prior to 1.9.10 **Description** The issue allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies, specifically when used on a site with Google Analytics. **Recommendations** For Django versions prior to 1.8.15, update to version 1.8.15 or later. For Django versions 1.9.x prior to 1.9.10, update to version 1.9.10 or later.

**Name of the Vulnerable Software and Affected Versions** Oracle Fusion Middleware version 10.1.3.5 **Description** The issue affects the integrity of the system via vectors related to HTTP Request Handling. It is related to an error in processing the Request-URI, which can be exploited to access arbitrary scripts outside the application directory using directory traversal constructs in Windows operating systems. **Recommendations** For Oracle Fusion Middleware version 10.1.3.5, consider restricting access to the HTTP Request Handling component until a patch is available. As a temporary workaround, limit the use of the Request-URI processing functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle Fusion Middleware version 10.1.3.5 **Description** The issue is related to HTTP Request Handling in the Oracle Containers for J2EE component. It allows remote attackers to affect integrity. The vulnerability is also described as being related to insufficient checking of values in HTTP headers, which can be exploited by adding special CRLF symbols to the header value, allowing an attacker to form a fake HTTP response and display arbitrary data to the user in the context of the vulnerable application. **Recommendations** For Oracle Fusion Middleware version 10.1.3.5, consider restricting access to the HTTP Request Handling component until a patch is available. As a temporary workaround, avoid using HTTP headers that can be manipulated by an attacker. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle Fusion Middleware version 10.1.3.5 **Description** The issue affects confidentiality and is related to HTTP Request Handling. It involves incorrect handling of a null byte in the path when forwarding a request to another static page or JSP script using functions like `pageContext.forward` or `jsp:forward`. This can disrupt the logic of script processing by global servlets, potentially allowing an attacker to form a request to process a JSP script as SHTML, thereby obtaining the script's source code. On Windows operating systems, in combination with a directory traversal vulnerability, this could lead to the execution of arbitrary commands when a file containing SHTML code is called as an SHTML script. **Recommendations** For Oracle Fusion Middleware version 10.1.3.5, consider restricting access to vulnerable functions like `pageContext.forward` or `jsp:forward` until a patch is available. Additionally, avoid using the `jsp:forward` function to forward requests to static pages or JSP scripts that could be manipulated by an attacker. As a temporary workaround, consider disabling the execution of SHTML scripts to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Siemens WinCC (TIA Portal) versions 11 through 12 before 12 SP1 **Description** A cross-site request forgery (CSRF) issue exists due to improper configuration of SIMATIC HMI panels by the WinCC product, allowing remote attackers to hijack the authentication of victims. **Recommendations** For versions 11 through 12 before 12 SP1, update to version 12 SP1 or later to resolve the issue. As a temporary workaround, consider restricting access to the SIMATIC HMI panels to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Siemens WinCC (TIA Portal) versions 11 and 12 before 12 SP1 **Description** The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks by leveraging improper configuration of SIMATIC HMI panels. This is due to an open redirect vulnerability in the affected software. **Recommendations** For versions 11 and 12 before 12 SP1, update to version 12 SP1 or later to resolve the issue. As a temporary workaround, consider restricting access to the SIMATIC HMI panels to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Siemens WinCC versions prior to 7.2 SIMATIC PCS7 versions prior to 8.0 SP1 **Description** A directory traversal issue in the web server allows remote authenticated users to read arbitrary files by querying a pathname. **Recommendations** For Siemens WinCC versions prior to 7.2, update to version 7.2 or later. For SIMATIC PCS7 versions prior to 8.0 SP1, update to version 8.0 SP1 or later.

**Name of the Vulnerable Software and Affected Versions** Siemens WinCC (TIA Portal) version 11 **Description** A cross-site scripting (XSS) issue exists in the HMI web application, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL. This could potentially lead to unauthorized actions on the web application. **Recommendations** For version 11, update to a newer version that contains a fix for this issue, or as a temporary workaround, consider restricting access to the HMI web application to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Siemens WinCC (TIA Portal) version 11 **Description** A cross-site scripting (XSS) issue exists in the HMI web application, allowing remote authenticated users to inject arbitrary web script or HTML via unspecified data. This could potentially lead to unauthorized actions on the web application. **Recommendations** For version 11, update to a newer version that contains a fix for this issue, or consider disabling access to the HMI web application until a patch is available. Restrict access to the web application to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Siemens WinCC (TIA Portal) version 11 **Description** The issue allows remote authenticated users to read HMI web-application source code and user-defined scripts via a crafted URL. **Recommendations** For version 11, update to a version that fixes this issue, however, at the moment, there is no information about a newer version that contains a fix for this vulnerability.