Andrey Medov

The issue is an OS command injection vulnerability in FortiWeb's management interface. This vulnerability may allow a remote authenticated attacker to execute arbitrary commands on the system via the SAML server configuration page. The vulnerability exists due to the lack of measures to neutralize special elements used in the OS command.

The issue is related to an improper neutralization of input during web page generation in the FortiWeb GUI interface. This may allow an unauthenticated, remote attacker to perform a reflected cross site scripting attack (XSS) by injecting malicious payload in different vulnerable API end-points.

Name of the Vulnerable Software and Affected Versions: FortiWeb versions 6.3.0 through 6.3.5 Description: A format string vulnerability may allow an authenticated, remote attacker to read the content of memory and retrieve sensitive data via the `redir` parameter. Recommendations: For FortiWeb versions 6.3.0 through 6.3.5, consider restricting access to the `redir` parameter until a patch is available. As a temporary workaround, avoid using the `redir` parameter in affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: FortiWeb versions 6.3.0 through 6.3.7 FortiWeb versions prior to 6.2.4 Description: A stack-based buffer overflow issue may allow a remote, unauthenticated attacker to crash the httpd daemon thread by sending a request with a crafted `cookie` header. Recommendations: For FortiWeb versions 6.3.0 through 6.3.7, update to a version outside of this range to resolve the issue. For FortiWeb versions prior to 6.2.4, update to version 6.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the httpd daemon thread to minimize the risk of exploitation.

A blind SQL injection in the user interface of FortiWeb may allow an unauthenticated, remote attacker to execute arbitrary SQL queries or commands by sending a request with a crafted `Authorization` header containing a malicious SQL statement. The vulnerability is related to the lack of protection of the SQL query structure. Rapid7 revealed that this vulnerability grants complete control over the affected device.

Name of the Vulnerable Software and Affected Versions: FortiWeb versions 6.3.0 through 6.3.5 FortiWeb versions prior to 6.2.4 Description: A stack-based buffer overflow issue may allow an unauthenticated, remote attacker to overwrite the content of the stack and potentially execute arbitrary code by sending a crafted request with a large `certname`. This could enable the attacker to execute arbitrary code. Recommendations: For FortiWeb versions 6.3.0 through 6.3.5, update to a version outside of this range to resolve the issue. For FortiWeb versions prior to 6.2.4, update to version 6.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable function related to the `certname` parameter until a patch is available.

Name of the Vulnerable Software and Affected Versions: Citrix XenMobile Server versions 10.12 before RP2 Citrix XenMobile Server versions 10.11 before RP4 Citrix XenMobile Server versions 10.10 before RP6 Citrix XenMobile Server versions prior to 10.9 RP5 Description: The issue is related to improper access control in Citrix XenMobile Server, which can allow a remote attacker to gain unauthorized access to protected information. This is due to incorrect restriction of the directory path name with limited access. The exploitation of this issue may enable the attacker to read arbitrary files. Recommendations: For Citrix XenMobile Server version 10.12 before RP2, update to RP2 or later to resolve the issue. For Citrix XenMobile Server version 10.11 before RP4, update to RP4 or later to resolve the issue. For Citrix XenMobile Server version 10.10 before RP6, update to RP6 or later to resolve the issue. For Citrix XenMobile Server versions prior to 10.9 RP5, update to 10.9 RP5 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: IBM Maximo Asset Management versions 7.6.0 through 7.6.1 Description: The issue is related to an unsafe deserialization in Java, which could allow a remote authenticated attacker to execute arbitrary code on the system. This can be achieved by sending a specially-crafted request, enabling the attacker to exploit the vulnerability and execute arbitrary code. Recommendations: For IBM Maximo Asset Management versions 7.6.0 and 7.6.1, consider disabling the deserialization mechanism in Java as a temporary workaround until a patch is available. Restrict access to the system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: IBM Maximo Asset Management versions 7.6.0 through 7.6.1 Description: The issue is related to insufficient validation of incoming requests, which may allow a remote attacker to perform a Server Side Request Forgery (SSRF) attack. This could enable an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. Recommendations: For versions 7.6.0 and 7.6.1, consider restricting access to vulnerable components or functions until a patch is available. As a temporary workaround, disabling the functionality that allows server-side requests may help minimize the risk of exploitation.

The management interface in the affected software allows remote attackers to bypass authentication via crafted login parameters. This is due to deficiencies in the authentication procedure. An attacker can exploit this issue to gain access to the device using a specially formed username.

The issue affects confidentiality and is related to HTTP Request Handling. It involves incorrect handling of a null byte in the path when forwarding a request to another static page or JSP script using functions like `pageContext.forward` or `jsp:forward`. This can disrupt the logic of script processing by global servlets, potentially allowing an attacker to form a request to process a JSP script as SHTML, thereby obtaining the script's source code. On Windows operating systems, in combination with a directory traversal vulnerability, this could lead to the execution of arbitrary commands when a file containing SHTML code is called as an SHTML script.

The issue is related to a buffer overflow in the DiagAgent web server, which can be exploited by remote attackers to cause a denial of service, resulting in an agent outage. This can be achieved by sending crafted input to the vulnerable server.

The issue allows remote authenticated users to read arbitrary files via a crafted parameter in a URL, due to multiple directory traversal vulnerabilities.

The issue concerns the XPath functionality in web applications, which does not properly handle special characters in parameters. This allows remote authenticated users to read or modify settings via a crafted URL, related to an "XML injection" attack.

The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a GET request. This can be achieved by including a malicious URL in the request.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities in unspecified web applications. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via vectors involving special characters in parameters.