Oded Vanunu

Nome do software vulnerável e versões afetadas: Microsoft Teams para iOS (versões afetadas não especificadas) Descrição: O problema está relacionado a erros na representação de informações pela interface do usuário, que podem ser explorados por um invasor remoto para realizar ataques de falsificação de identidade. Não há informações disponíveis sobre o número estimado de dispositivos potencialmente afetados em todo o mundo ou sobre incidentes reais em que essa vulnerabilidade tenha sido explorada. Recomendações: No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** IntelliJ IDEA (affected versions not specified) **Description** The IntelliJ IDEA XML parser is susceptible to an XML External Entity attack. An attacker can exploit this issue by implementing malicious code in the AndroidManifest.xml file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Eclipse XML parser for the Eclipse IDE versions 2017.2.5 and earlier **Description** The Eclipse XML parser for the Eclipse IDE was found vulnerable to an XML External Entity attack. An attacker can exploit this issue by implementing malicious code on the `Androidmanifest.xml` file. **Recommendations** For Eclipse XML parser for the Eclipse IDE versions 2017.2.5 and earlier, update to a version later than 2017.2.5 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Cisco FireSIGHT System Software versions 5.4.0 through 6.0.1 ASA with FirePOWER Services versions 5.4.0 through 6.0.0.1 **Description** The issue allows remote attackers to bypass malware protection. This is achieved via crafted fields in HTTP headers. **Recommendations** For Cisco FireSIGHT System Software versions 5.4.0 through 6.0.1, update to a version outside of this range to resolve the issue. For ASA with FirePOWER Services versions 5.4.0 through 6.0.0.1, update to a version outside of this range to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Palo Alto Networks PAN-OS versions prior to 5.0.15 Palo Alto Networks PAN-OS versions 5.1.x prior to 5.1.10 Palo Alto Networks PAN-OS versions 6.0.x prior to 6.0.6 **Description** A cross-site scripting issue exists in the web-based device management interface, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. This occurs because data provided by the user is echoed back without sanitization, potentially tricking an authenticated administrator into injecting malicious JavaScript into the web UI interface. **Recommendations** For versions prior to 5.0.15, update to version 5.0.15 or later. For versions 5.1.x prior to 5.1.10, update to version 5.1.10 or later. For versions 6.0.x prior to 6.0.6, update to version 6.0.6 or later.