Badcode

**Name of the Vulnerable Software and Affected Versions** Nexus Repository Manager versions <= 2.14.14 **Description** The issue is related to an OS Command Injection that could allow an attacker to achieve Remote Code Execution (RCE). This is due to the lack of input data sanitization. All instances using CommandLineExecutor.java with user-supplied data are affected, such as the Yum Configuration Capability. The exploitation of this issue may enable a remote attacker to execute arbitrary code. **Recommendations** For Nexus Repository Manager versions <= 2.14.14, consider restricting the use of CommandLineExecutor.java with user-supplied data until a fix is available. As a temporary workaround, avoid using the Yum Configuration Capability with untrusted input to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco Prime Infrastructure (affected versions not specified) **Description** A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. The issue is due to insufficient validation of user-supplied input in multiple sections of the interface. An attacker could exploit this by persuading a user to click a crafted link, potentially allowing the execution of arbitrary script code or access to sensitive browser-based information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.