Alex Joss

Name of the Vulnerable Software and Affected Versions: Intland codeBeamer ALM versions 10.x through 10.1.SP4 Description: An issue with insufficiently protected credentials was found. The `CB LOGIN` remember-me cookie contains encrypted user credentials, but due to a bug, these credentials are encrypted using a NULL encryption key. Recommendations: For versions 10.x through 10.1.SP4, consider disabling the use of the remember-me cookie feature until a patch is available. Restrict access to sensitive areas of the application to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Intland codeBeamer ALM versions 10.x through 10.1.SP4 Description: A cross-site scripting (XSS) issue was discovered. It is possible to perform XSS attacks through using the WebDAV functionality to upload files to a project, using the users import functionality, and changing the login text in the application configuration. Recommendations: For versions 10.x through 10.1.SP4, consider disabling the WebDAV functionality, restricting the use of the users import functionality to necessary admin tasks, and avoiding changes to the login text in the application configuration until a patch is available.

Name of the Vulnerable Software and Affected Versions: Avaya Equinox Conferencing versions 9.x through 9.1.10 Description: An XML External Entities (XXE) issue in the Media Server component could allow an authenticated, remote attacker to gain read access to information stored on an affected system or potentially lead to a denial of service. Recommendations: For Avaya Equinox Conferencing versions 9.x through 9.1.10, update to version 9.1.11 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Avaya Equinox Conferencing Management component versions 3.x before 3.17 Description: A vulnerability was discovered in the Management component of Avaya Equinox Conferencing that could potentially allow an unauthenticated, remote attacker to gain access to screen sharing and whiteboard sessions. Recommendations: For versions 3.x before 3.17, update to version 3.17 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Intland codeBeamer ALM versions 10.x through 10.1.SP4 **Description** An issue was discovered in the way Intland codeBeamer ALM parses ReqIF XML data used for importing projects. The software components are insecurely configured, allowing for XML External Entity Attacks. **Recommendations** For versions 10.x through 10.1.SP4, consider disabling the import of ReqIF XML data until a patch is available to prevent potential XML External Entity Attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.