Matt Bergin

**Nome do software vulnerável e versões afetadas** Dispositivo físico Cellebrite UFED, versões 5.0 a 7.5.0.845 **Descrição** O problema diz respeito ao uso de material de chave codificado no código executável e nos arquivos criptografados do dispositivo físico Cellebrite UFED. Esse material de chave é o mesmo para todos os dispositivos que executam a mesma versão do software e não parece mudar com novas compilações. Como resultado, é possível reconstruir o processo de descriptografia usando esse material de chave codificado, permitindo fácil acesso a dados que, de outra forma, estariam protegidos. **Recomendações** Para as versões 5.0 a 7.5.0.845, considere desativar o processo de descriptografia que utiliza o material de chave codificado até que uma correção esteja disponível. Restrinja o acesso aos arquivos criptografados para minimizar o risco de exploração. Evite confiar na técnica de encapsulamento de chave para proteção de dados até que o problema seja resolvido. No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

**Nome do software vulnerável e versões afetadas: Silicon Integrated Systems XGI WindowsXP Display Manager versão 6.14.10.1090 Descrição: A vulnerabilidade permite que usuários locais obtenham privilégios por meio de uma chamada IOCTL 0x96002404 maliciosamente criada. Recomendações: Para a versão 6.14.10.1090, considere restringir o acesso à chamada IOCTL 0x96002404 até que um patch esteja disponível.

**Name of the Vulnerable Software and Affected Versions** Dell OpenManage Network Manager versions prior to 6.5.0 **Description** The issue is related to an insecure default configuration setting for the embedded MySQL database, which allows MySQL users to have read/write access to the file system. **Recommendations** For versions prior to 6.5.0, update to version 6.5.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Dell OpenManage Network Manager versions prior to 6.5.3 **Description** The issue is caused by a misconfiguration in the /etc/sudoers file, leading to an improper authorization. **Recommendations** For versions prior to 6.5.3, update to version 6.5.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** SolarWinds Log & Event Manager (LEM) versions prior to 6.3.1 Hotfix 4 **Description** The issue allows an authenticated user to execute arbitrary commands. **Recommendations** For versions prior to 6.3.1 Hotfix 4, update to version 6.3.1 Hotfix 4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Cisco Firepower Management Center version 6.0.1 **Description** The issue allows remote authenticated users to read arbitrary files via crafted parameters. **Recommendations** For Cisco Firepower Management Center version 6.0.1, consider restricting access to the web console until a patch is available. Avoid using crafted parameters in the web console to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Cisco Firepower Management Center versions 5.2.0 through 6.0.1 **Description** The issue allows remote authenticated users to execute arbitrary commands via crafted web-application parameters. **Recommendations** For versions 5.2.0 through 6.0.1, update to a version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Cisco Firepower Management Center version 6.0.1 **Description** The issue allows local users to obtain sensitive information by leveraging CLI access due to hardcoded database credentials. **Recommendations** For Cisco Firepower Management Center version 6.0.1, update the system to remove hardcoded database credentials to prevent unauthorized access.

**Name of the Vulnerable Software and Affected Versions** Dell Pre-Boot Authentication Driver version 1.0.1.5 **Description** The issue allows local users to gain privileges by writing to arbitrary physical memory locations. This is achieved via a specific IOCTL call, `0x0022201c`. **Recommendations** For version 1.0.1.5, consider restricting access to the IOCTL call `0x0022201c` to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** VBox Communications Satellite Express Protocol version 2.3.17.3 **Description** The issue allows local users to gain privileges by writing to arbitrary physical memory locations. This is achieved via a specific ioctl call, `0x00000ffd`. **Recommendations** For version 2.3.17.3, consider restricting access to the ndvbs module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Silicon Integrated Systems WindowsXP Display Manager (aka VGA Driver Manager and VGA Display Manager) version 6.14.10.3930 **Description** The issue allows local users to gain privileges through crafted IOCTL calls, specifically (1) 0x96002400 or (2) 0x96002404. **Recommendations** For version 6.14.10.3930, consider restricting access to the IOCTL calls `0x96002400` and `0x96002404` to prevent privilege escalation until a patch is available.