Vladimir Razov

**Name of the Vulnerable Software and Affected Versions** Moxa NPort W2150A/W2250A Series firmware versions prior to 2.3 **Description** The issue is related to a stack-based buffer overflow in the built-in web server of the Moxa NPort W2150A/W2250A Series. This can be exploited by a remote attacker sending a crafted payload to the web service, potentially resulting in denial of service. **Recommendations** For Moxa NPort W2150A/W2250A Series firmware versions prior to 2.3, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to the built-in web server until a patch is available.

**Name of the Vulnerable Software and Affected Versions** MediaCMS versions prior to 4.1.0 **Description** The issue is related to insufficient input validation while uploading media content, which can lead to remote code execution under special conditions. This can be exploited if the portal allows users to upload content. The vulnerability has been patched in version 4.1.0. **Recommendations** For versions prior to 4.1.0, upgrade to version 4.1.0 to fix the issue. As a temporary workaround, consider restricting access to the media upload feature until the upgrade is applied. Avoid using the `media upload` feature in the affected API endpoint until the issue is resolved. At the moment, there are no known workarounds for this vulnerability other than upgrading to the patched version.

**Name of the Vulnerable Software and Affected Versions** Apache Superset versions 1.5.2 and prior Apache Superset version 2.0.0 **Description** The issue is related to the dashboard rendering not sufficiently sanitizing the content of markdown components, leading to possible XSS attack vectors. These attacks can be performed by authenticated users with create dashboard permissions. **Recommendations** For Apache Superset versions 1.5.2 and prior, update to a version later than 1.5.2 to resolve the issue. For Apache Superset version 2.0.0, consider disabling the markdown component rendering in dashboards until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Apache Superset versions 1.5.2 and prior Apache Superset version 2.0.0 **Description** The issue arises from upload data forms not correctly rendering user input, leading to possible XSS attack vectors. These attacks can be performed by authenticated users who have permissions to update database connections. **Recommendations** For Apache Superset versions 1.5.2 and prior, update to a version later than 1.5.2 to resolve the issue. For Apache Superset version 2.0.0, consider disabling upload data forms until a patch is available. Restrict access to database connection update permissions to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Apache Superset versions 1.5.2 and prior Apache Superset version 2.0.0 **Description** The issue concerns two legacy REST API endpoints for approval and request access that are vulnerable to cross-site request forgery. **Recommendations** For Apache Superset versions 1.5.2 and prior, update to a version that is not affected by this issue. For Apache Superset version 2.0.0, update to a version that is not affected by this issue. As a temporary workaround, consider restricting access to the vulnerable API endpoints until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Apache Superset versions 1.5.2 and prior Apache Superset version 2.0.0 **Description** An authenticated attacker with update datasets permission could change a dataset link to an untrusted site. Users could be redirected to this site when clicking on that specific dataset. **Recommendations** For Apache Superset versions 1.5.2 and prior, consider restricting the update datasets permission to trusted users until a patch is available. For Apache Superset version 2.0.0, consider restricting the update datasets permission to trusted users until a patch is available. As a temporary workaround, consider monitoring and validating dataset links to prevent redirection to untrusted sites.

**Name of the Vulnerable Software and Affected Versions** Nokia NetAct versions prior to 22 FP2211 **Description** The issue is related to the lack of input validation when creating a working set in the NetAct system, allowing an attacker to inject a client-side template payload. This can lead to the execution of arbitrary JavaScript code. The attack can be performed by an internal user, as exploiting this issue from the outside is difficult due to the need for dynamically created parameters such as `Jsession-id`, `CSRF token`, and `Nxsrf token`. **Recommendations** For versions prior to 22 FP2211, update to version 22 FP2211 or later to resolve the issue. As a temporary workaround, consider restricting access to the Working Set Manager page to minimize the risk of exploitation. Additionally, ensure that all users are aware of the potential risk and take necessary precautions to avoid injecting malicious payloads when creating working sets.

**Name of the Vulnerable Software and Affected Versions** Nokia NetAct versions prior to 22 SP1037 **Description** An issue was discovered in the Site Configuration Tool tab of Nokia NetAct, where attackers can upload a ZIP file that, when processed, exploits Stored XSS. The upload option of the Site Configuration tool does not validate the file contents. The application is in a demilitarised zone behind a perimeter firewall and without exposure to the internet. The attack can only be performed by an internal user. **Recommendations** For versions prior to 22 SP1037, update to version 22 SP1037 or later to resolve the issue. As a temporary workaround, consider disabling the file upload option in the Site Configuration Tool tab until a patch is available. Restrict access to the Site Configuration Tool to minimize the risk of exploitation. Avoid using the upload option for ZIP files in the affected tool until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Nokia NetAct versions prior to 22 FP2211 **Description** An XXE issue was discovered in Nokia NetAct via an XML document to a Performance Manager page, where input validation and a proper XML parser configuration are missing. This could allow an attacker to gain unauthorized access to protected information or perform an SSRF attack. For an external attacker, it is very difficult to exploit this issue, as dynamically created parameters such as `Jsession-id`, `CSRF token`, and `Nxsrf token` would be needed. The attack can realistically only be performed by an internal user. **Recommendations** For Nokia NetAct versions prior to 22 FP2211, update to version 22 FP2211 or later to resolve the issue. As a temporary workaround, consider restricting access to the Performance Manager page and ensuring proper input validation and XML parser configuration to minimize the risk of exploitation. Restrict access to dynamically created parameters such as `Jsession-id`, `CSRF token`, and `Nxsrf token` to prevent unauthorized access.

**Name of the Vulnerable Software and Affected Versions** Nokia NetAct versions prior to 22 FP2211 **Description** An XXE issue was discovered via an XML document to the Configuration Dashboard page, where input validation and a proper XML parser configuration are missing. This makes it difficult for an external attacker to exploit, as dynamically created parameters such as `Jsession-id`, `CSRF token`, and `Nxsrf token` would be needed. The attack can realistically only be performed by an internal user. The issue is related to incorrect restriction of XML links to external objects, which may allow an attacker to gain unauthorized access to protected information or perform an SSRF attack. **Recommendations** For Nokia NetAct versions prior to 22 FP2211, consider implementing proper input validation and configuring an XML parser to mitigate the risk of exploitation. As a temporary workaround, restrict access to the Configuration Dashboard page to minimize the risk of internal users exploiting this issue. Ensure that all dynamically created parameters, such as `Jsession-id`, `CSRF token`, and `Nxsrf token`, are properly validated and secured.

**Name of the Vulnerable Software and Affected Versions** Nokia NetAct versions prior to 22 FP2211 **Description** The issue is related to insufficient protection of the web page structure when creating tasks. It allows an attacker to perform cross-site scripting (XSS) attacks by injecting scripts. The vulnerability can be exploited on the Scheduled Search tab under the Alarm Reports Dashboard page, where users can create a script to inject XSS due to missing input validation during the creation of a scheduled task. For an external attacker, it is very difficult to exploit this, because a few dynamically created parameters such as `Jsession-id`, a `CSRF token`, and an `Nxsrf token` would be needed. The attack can realistically only be performed by an internal user. **Recommendations** For Nokia NetAct versions prior to 22 FP2211, update to version 22 FP2211 or later to resolve the issue. As a temporary workaround, consider restricting access to the Scheduled Search tab under the Alarm Reports Dashboard page to minimize the risk of exploitation. Additionally, restrict the ability to create scripts that can inject XSS on this page until the issue is resolved.