Andreas Finstad

**Name of the Vulnerable Software and Affected Versions** Paessler PRTG Network Monitor (affected versions not specified) **Description** This issue allows network-adjacent attackers to bypass authentication on affected installations of Paessler PRTG Network Monitor. The specific flaw exists within the PRTG Network Monitor web interface, resulting from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to bypass authentication on the system. Some user interaction on the part of an administrator is required to exploit this vulnerability. There have been reports of offensive activities targeting this vulnerability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Centreon (affected versions not specified) **Description** This issue allows remote attackers to execute arbitrary code on affected installations of Centreon. User interaction is required to exploit this issue. The specific flaw exists within the processing of the `sysName` OID in SNMP, resulting from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this issue to execute code in the context of the service account. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (affected versions not specified) **Description** A vulnerability in the web-based management interface could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This issue exists due to the interface not properly validating user-supplied input. An attacker could exploit this by persuading a user to click a crafted link, potentially allowing the execution of arbitrary script code or access to sensitive browser-based information. **Recommendations** For Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager, update to a version that includes the software updates released by Cisco to address this issue. As a temporary workaround, consider restricting access to the web-based management interface until a patch is applied. Avoid using the interface with untrusted input until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Cisco Prime Infrastructure versions (affected versions not specified) Cisco Evolved Programmable Network Manager versions (affected versions not specified) **Description** The issue is related to insufficient input validation of the HTTPS URL by the web-based management interface, allowing an authenticated, remote attacker to conduct a path traversal attack. This could enable the attacker to write arbitrary files to the host system. The attacker must have valid credentials on the system to exploit this vulnerability. **Recommendations** For Cisco Prime Infrastructure, update to a version that includes the software updates released by Cisco to address this issue. For Cisco Evolved Programmable Network Manager, update to a version that includes the software updates released by Cisco to address this issue. As a temporary workaround, consider restricting access to the web-based management interface to minimize the risk of exploitation.