Sylvain Heiniger

Name of the Vulnerable Software and Affected Versions: Avaya Equinox Conferencing versions 9.x through 9.1.10 Description: An XML External Entities (XXE) issue in the Media Server component could allow an authenticated, remote attacker to gain read access to information stored on an affected system or potentially lead to a denial of service. Recommendations: For Avaya Equinox Conferencing versions 9.x through 9.1.10, update to version 9.1.11 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Avaya Equinox Conferencing Management component versions 3.x before 3.17 Description: A vulnerability was discovered in the Management component of Avaya Equinox Conferencing that could potentially allow an unauthenticated, remote attacker to gain access to screen sharing and whiteboard sessions. Recommendations: For versions 3.x before 3.17, update to version 3.17 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: AdRem NetCrunch version 10.6.0.4587 Description: The issue is related to improper session handling in the NetCrunch web client, which can lead to an authentication bypass or escalation of privileges. Recommendations: For AdRem NetCrunch version 10.6.0.4587, consider disabling the NetCrunch web client until a patch is available to prevent potential authentication bypass or escalation of privileges.

Name of the Vulnerable Software and Affected Versions: AdRem NetCrunch version 10.6.0.4587 Description: The issue is related to a hardcoded SSL private key vulnerability in the NetCrunch web client. This hardcoded key is used across different customers' installations when no other SSL certificate is installed. As a result, remote attackers can defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation. Recommendations: For AdRem NetCrunch version 10.6.0.4587, consider replacing the hardcoded SSL private key with a unique certificate for each installation to prevent exploitation. Additionally, restrict access to the NetCrunch web client until a proper SSL certificate is installed.

Name of the Vulnerable Software and Affected Versions: AdRem NetCrunch version 10.6.0.4587 Description: The issue allows credentials disclosure, enabling every user to read private keys, private keys' passwords, and root passwords for BSD, Linux, MacOS, and Solaris stored in the credential manager. Additionally, every administrator can access ESX and Windows passwords stored in the credential manager. Recommendations: For AdRem NetCrunch version 10.6.0.4587, consider restricting access to the credential manager to minimize the risk of exploitation. As a temporary workaround, limit the privileges of users and administrators to prevent unauthorized access to sensitive credentials. At the moment, there is no information about a newer version that contains a fix for this vulnerability.