Brian Mariani

Brian Mariani from DigitalCanion SA has discovered a  vulnerability in the domain creation functionality of koozali's SME Server version 11.0rc1-215, allowing an attacker with high privileges to inject reserved Apache configuration directives, corrupting httpd.conf and preventing Apache from starting after a server reboot, resulting in a denial-of-service (DoS) condition affecting the web server and its hosted virtual hosts.

Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of koozali's SME Server version 11.0rc1-215 allowing an unauthenticated attacker to access files outside of the intended directory, leading to exfiltration of files located outside the intended system logs directory, including potentially sensitive system and application files.

**Name of the Vulnerable Software and Affected Versions** SMA1000 Appliance Management Console (AMC) (affected versions not specified) **Description** A Zip Slip issue in the SMA1000 Appliance Management Console (AMC) interface enables an attacker to extract files outside the intended destination directory by using a specially crafted archive. This can lead to remote code execution, which is the ability of an attacker to execute arbitrary commands on a remote machine over a network. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SMA1000 (affected versions not specified) **Description** A post-authentication Stored Cross-Site Scripting (XSS) issue exists in the Appliance Management Console (AMC). This allows a remote authenticated attacker with administrator privileges to store and execute arbitrary JavaScript code within the console under specific conditions. Stored Cross-Site Scripting is a flaw where a malicious script is permanently stored on the target server, which is then served to other users. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mitel MiVoice Office 400 (affected versions not specified) **Description** A stored Cross-Site Scripting (XSS) issue allows an authenticated malicious user to inject persistent JavaScript or HTML content into the web application. The flaw is located in the web portal on TCP port 443, specifically within the `Description` field under Configuration → Domains. The application does not properly validate or sanitize user input before storing and rendering it. An attacker can use this to modify page content and behavior for other users, potentially altering the interface or creating phishing scenarios within the trusted context of the application. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `Description` field in the Configuration → Domains section until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Mitel MiVoice Office 400 (affected versions not specified) **Description** A stored Cross-Site Scripting (XSS) flaw allows an authenticated malicious user to inject persistent JavaScript or HTML content into the web portal listening on TCP port 443. The issue occurs within the Configuration → Users → Users List section, specifically in the `Microsoft Exchange mailbox` field, due to a failure to properly validate or sanitize user-supplied input. When the affected user properties are accessed, the injected payload executes, which can prevent access to those properties and lead to a denial-of-service condition within the application's user-management functionality. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `Microsoft Exchange mailbox` field in the user list until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Mitel MiVoice Office 400 (affected versions not specified) **Description** A flaw allows an attacker to force the system to load a malicious .so file (a shared object library) instead of the intended legitimate module. This occurs because the loading mechanism uses a predictable module name and fails to verify the file's origin or integrity. Consequently, a privileged process may load the malicious shared object, executing the code within that process's context and privileges, leading to arbitrary code execution and full compromise of the Mitel Linux virtual machine. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mitel MiVoice Office 400 (affected versions not specified) **Description** An authenticated remote attacker can delete sensitive files on the system via a directory traversal flaw. This issue occurs within the web portal on TCP port 443, specifically under the Maintenance → File Management → File Browser section. Directory traversal is a technique that allows an attacker to access files and directories that are stored outside the web root folder. By exploiting this, an attacker can access and delete files belonging to the application and the underlying Linux system, which may lead to a denial-of-service condition. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mitel MiVoice Office 400 (affected versions not specified) **Description** A flaw in the web portal listening on TCP port 443 allows remote attackers to execute arbitrary code, potentially requiring authentication. The issue resides in the Configuration → Services → Music on Hold functionality, where the application fails to properly validate uploaded file types. While intended for WAV audio files, an attacker can upload a malicious shared object (.so) file. When the system processes this file, the attacker-controlled code is executed within the process context, which may lead to a full compromise of the underlying Linux system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the Configuration → Services → Music on Hold functionality to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined. (affected versions not specified) **Description** A path traversal issue exists that allows an attacker to view or download sensitive system files. This is possible through the portal at the endpoint 'https://<ip>:8443' by navigating to the Administration -> View Logs menus. Path traversal is a flaw that allows an attacker to access files and directories stored outside the web root folder. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A flaw in the backup restoration functionality allows an attacker with access to the configured backup repository to introduce arbitrary files into the system during restoration. The issue occurs because the restoration mechanism fails to properly validate paths, file types, integrity, and authenticity of files within a restored TGZ archive (a compressed archive file). Since the application does not perform file-signature verification before extraction, a specially crafted backup can be used to place arbitrary files on the underlying Linux system. Depending on the file location and permissions, this can lead to arbitrary code execution with root privileges and a full compromise of the virtual machine. The lack of enforced backup passwords further increases the risk of unauthorized repository access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mitel MiVoice Office 400 (affected versions not specified) **Description** A path traversal flaw exists in the Maintenance → System Logs functionality of the web management portal on TCP port 443. The application does not properly validate user-supplied file paths, enabling an attacker to manipulate the path and traverse the directory structure. This allows unauthorized access to and download of files outside the intended system logs directory, which may include sensitive system and application files. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Fireware OS (affected versions not specified) **Description** An uncontrolled resource consumption issue exists in the diagnostic tasks feature. A low-privileged, authenticated user can trigger a denial of service of the system diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task via the web UI. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** SonicWall Email Security (لم يتم تحديد الإصدارات المتأثرة) **الوصف** يوجد عيب في جهاز SonicWall Email Security يتعلق بعدم كفاية التحقق من صحة المدخلات. وقد يؤدي ذلك إلى تلف البيانات، مما قد يسمح لمهاجم عن بُعد يتمتع بامتيازات إدارية باستغلال هذه الثغرة عن طريق إرسال مدخلات مصممة خصيصًا لإلحاق الضرر بقاعدة بيانات التطبيق. **التوصيات** في الوقت الحالي، لا توجد معلومات عن إصدار أحدث يحتوي على إصلاح لهذه الثغرة الأمنية.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** SonicWall Email Security (لم يتم تحديد الإصدارات المتأثرة) **الوصف** توجد ثغرة أمنية من نوع «التنفيذ البرمجي عبر المواقع» (XSS) المخزنة في جهاز SonicWall Email Security. ويرجع ذلك إلى عدم كفاية عملية تنقية البيانات التي يقدمها المستخدم عند إنشاء صفحات الويب. ويمكن لمهاجم عن بُعد يتمتع بامتيازات إدارية تنفيذ تعليمات برمجية JavaScript تعسفية. ويجب أن يتم مصادقة المهاجم كمستخدم إداري لاستغلال هذه الثغرة. **التوصيات** في الوقت الحالي، لا توجد معلومات حول إصدار أحدث يحتوي على إصلاح لهذه الثغرة الأمنية.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** جهاز SonicWall Email Security (لم يتم تحديد الإصدارات المتأثرة) **الوصف** يحتوي جهاز SonicWall Email Security على ثغرة تتعلق بالتحقق غير السليم من صحة المدخلات. يمكن لمهاجم بعيد ومصادق عليه يتمتع بامتيازات المسؤول استغلال هذه الثغرة لتعطيل استجابة التطبيق، مما يؤدي إلى حالة رفض الخدمة (DoS). **التوصيات** في الوقت الحالي، لا توجد معلومات عن إصدار أحدث يحتوي على إصلاح لهذه الثغرة الأمنية.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** جهاز أمان البريد الإلكتروني (الإصدارات المتأثرة غير محددة) **الوصف** توجد ثغرة أمنية تتعلق بـ «عبور المسار» (Path Traversal) في جهاز أمان البريد الإلكتروني. تتيح هذه الثغرة للمهاجم التلاعب بمسارات نظام الملفات عن طريق إدخال تسلسلات معقدة لعبور الدلائل، مثل `../`، مما قد يتيح له الوصول إلى الملفات والدلائل خارج المسار المقيد المقصود. تتعلق هذه الثغرة بالتلاعب بمسارات نظام الملفات. **التوصيات** في الوقت الحالي، لا توجد معلومات عن إصدار أحدث يحتوي على تصحيح لهذه الثغرة الأمنية.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** جهاز SonicWall Email Security (لم يتم تحديد الإصدارات المتأثرة) **الوصف** يقوم جهاز SonicWall Email Security بتنزيل صور نظام الملفات الجذرية دون التحقق من التوقيعات. وهذا يتيح للمهاجمين الذين يتمتعون بإمكانية الوصول إلى ملفات VMDK أو مخزن البيانات تعديل ملفات النظام، مما قد يتيح لهم تنفيذ تعليمات برمجية تعسفية بشكل مستمر. **التوصيات** في الوقت الحالي، لا توجد معلومات حول إصدار أحدث يحتوي على إصلاح لهذه الثغرة الأمنية.

**Name of the Vulnerable Software and Affected Versions** HP Protect Tools Device Access Manager versions prior to 6.1.0.1 **Description** The issue allows remote attackers to execute arbitrary code or cause a denial of service due to heap memory corruption. This can be achieved via a long `SidString` argument in certain methods. **Recommendations** For versions prior to 6.1.0.1, update to version 6.1.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the `AddUser`, `AddUserEx`, `RemoveUser`, `RemoveUserByGuide`, `RemoveUserEx`, and `RemoveUserRegardless` methods until a patch is applied. Avoid using long `SidString` arguments in the affected methods to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Apple QuickTime versions prior to 7.3.1 Description: The issue is related to multiple unspecified vulnerabilities in the Flash media handler of Apple QuickTime. These vulnerabilities can be exploited by remote attackers via a crafted QuickTime movie, potentially allowing the execution of arbitrary code or having other unspecified impacts. Recommendations: For versions prior to 7.3.1, update to version 7.3.1 or later to resolve the issue.