Mikhail Klyuchnikov

A Server-Side Request Forgery (SSRF) issue allows remote authenticated users to request arbitrary URLs or trigger deserialization via phar protocol when generating class names dynamically. In some cases, exploitation is possible by an unauthenticated user. The `gkey` parameter is an unfollow token and is involved in the vulnerability.

The `mboximport` function allows an authenticated user with administrator rights to upload a ZIP archive containing arbitrary files. This can lead to directory traversal, which is a method used to access files and directories that are stored outside the web root folder. An attacker could exploit this to upload dangerous file types to the system.

The issue is related to an unrestricted file upload vulnerability in the SAP NetWeaver platform, specifically in the Visual Composer 7.0 RT component. This vulnerability allows an attacker, authenticated as a non-administrative user, to upload a malicious file over a network and trigger its processing. The malicious file can run operating system commands with the privilege of the Java Server process, enabling the attacker to read or modify any information on the server or shut the server down, making it unavailable.

The issue is related to the REST API of Cisco Firepower Device Manager On-Box Software, where insufficient sanitization of user input on specific REST API commands could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system of an affected device. An attacker could exploit this by sending a crafted HTTP request to the API subsystem. To exploit, an attacker would need valid low-privileged user credentials.

Name of the Vulnerable Software and Affected Versions: Atlassian Jira Server and Data Center versions prior to 8.5.13 Atlassian Jira Server and Data Center versions 8.6.0 through 8.13.5 Atlassian Jira Server and Data Center versions 8.14.0 through 8.15.1 Description: The issue allows an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the "QueryComponentRendererValue!Default.jspa" endpoint. Recommendations: For versions prior to 8.5.13, update to version 8.5.13 or later. For versions 8.6.0 through 8.13.5, update to version 8.13.5 or later. For versions 8.14.0 through 8.15.1, update to version 8.15.1 or later. As a temporary workaround, consider restricting access to the "QueryComponentRendererValue!Default.jspa" endpoint until a patch is available.

Name of the Vulnerable Software and Affected Versions: JetBrains YouTrack versions prior to 2020.6.6441 Description: The issue concerns stored XSS that could be achieved through an issue attachment, allowing potential malicious activities. Recommendations: For versions prior to 2020.6.6441, update to version 2020.6.6441 or later to resolve the issue.

A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to upload files to an affected device. This issue is due to missing authentication for the upload function. An attacker could exploit this by sending a specific HTTP request to an affected device, potentially allowing the upload of files with the permissions of the `tomcat8` user.

The issue is related to multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX, which could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. This is due to the failure to neutralize special elements used in operating system commands. Exploitation of the vulnerability may allow a remote attacker to execute arbitrary commands in the target system with root privileges.

The issue is related to the web-based management interface of Cisco HyperFlex HX, where an unauthenticated, remote attacker could perform command injection attacks against an affected device. This could allow the execution of arbitrary commands in the target system with the privileges of the `tomcat8` user.

The issue is related to the lack of authorization and improper input validation in the logupload web application of VMware View Planner, allowing an unauthorized attacker with network access to upload and execute a specially crafted file, leading to remote code execution within the logupload container. This can be exploited by an attacker to execute arbitrary code.

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This vulnerability is related to insufficient input validation.

The vSphere Client contains a Server Side Request Forgery (SSRF) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to the vCenter Server plugin, leading to information disclosure.

The issue is related to insufficient server-side request validation in IBM QRadar SIEM, which can be exploited by a remote attacker to send unauthorized requests and potentially disclose protected information. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. The vulnerability can be used to forge requests on the server side of QRadar, which can at least allow for the collection of data about the infrastructure/network where this software is running.

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance (ASA) Software (affected versions not specified) Cisco Firepower Threat Defense (FTD) Software (affected versions not specified) Description: The issue is related to insufficient validation of user-supplied input by the web services interface of affected devices, allowing an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface. An attacker could exploit this by persuading a user of the interface to click a crafted link, potentially allowing the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information. The vulnerabilities affect only specific AnyConnect and WebVPN configurations. There have been reports of active exploitation of this issue. Recommendations: As a temporary workaround, consider disabling the web services interface of the affected device until a patch is available. Restrict access to the web services interface to minimize the risk of exploitation. Avoid using the interface until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: McAfee ePolicy Orchestrator versions prior to 5.10.9 Update 9 Description: The issue allows administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized. This can lead to a Cross-Site Scripting attack. The vulnerability is related to the lack of protection of the web page structure, which can be exploited by a remote attacker to perform a Cross-Site Scripting attack. Recommendations: For versions prior to 5.10.9 Update 9, update to version 5.10.9 Update 9 or later to resolve the issue. As a temporary workaround, consider restricting access to the `syncPointList` parameter to minimize the risk of exploitation. Avoid using the `syncPointList` parameter in the affected API endpoint until the issue is resolved. Restrict access to the `/PolicyMgmt/policyDetailsCard.do` endpoint to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Rapid7 Nexpose versions prior to 6.6.49 Description: The issue is related to insufficient protection of the SQL query structure, which may allow a remote attacker to elevate their privileges. It is a SQL Injection issue that may have allowed an authenticated user with a low permission level to access resources and make changes they should not have been able to access. Recommendations: For versions prior to 6.6.49, update to version 6.6.49 or later to resolve the issue. As a temporary workaround, consider restricting access to the SQL query structure to minimize the risk of exploitation.

The issue is related to weak input validation on inputs by a trusted management administrator in Check Point Security Management's Internal CA web management. This weakness can be manipulated to run commands as a high privileged user or crash the system.

Name of the Vulnerable Software and Affected Versions: Atlassian Jira Server and Data Center versions prior to 7.13.6 Atlassian Jira Server and Data Center versions 8.0.0 through 8.5.7 Atlassian Jira Server and Data Center versions 8.6.0 through 8.12.0 Description: The issue is related to the "/ViewUserHover.jspa" component of the Jira error tracking system, which is associated with the storage of user credential information in an open manner. Exploitation of this issue may allow a remote attacker to disclose user credentials. An unauthenticated user can enumerate users via an Information Disclosure vulnerability in the "/ViewUserHover.jspa" endpoint. Recommendations: For versions prior to 7.13.6, update to version 7.13.6 or later. For versions 8.0.0 through 8.5.7, update to version 8.5.7 or later. For versions 8.6.0 through 8.12.0, update to version 8.12.0 or later. As a temporary workaround, consider restricting access to the "/ViewUserHover.jspa" endpoint until a patch is available. Avoid using the `username` parameter in the affected endpoint until the issue is resolved.

The issue is an OS Command Injection vulnerability in the PAN-OS management interface. It allows authenticated administrators to execute arbitrary OS commands with root privileges.

Name of the Vulnerable Software and Affected Versions: PAN-OS versions earlier than 8.1.16 PAN-OS versions earlier than 9.0.9 Description: A reflected cross-site scripting (XSS) issue exists in the PAN-OS management web interface. This could allow a remote attacker to execute arbitrary JavaScript code in an administrator's browser and perform administrative actions if the administrator clicks on a crafted link. The issue is related to insufficient input validation. Recommendations: For PAN-OS versions earlier than 8.1.16, update to version 8.1.16 or later. For PAN-OS versions earlier than 9.0.9, update to version 9.0.9 or later.