Andreas Vikerup

**Name of the Vulnerable Software and Affected Versions** CodeMeter Runtime (affected versions not specified) **Description** The `cmu.exe` utility creates a predictable temporary file in the `C:CM-Stick` directory when the `--create-io` flag is used with the `--file` parameter. The application fails to properly validate directory and file paths for NTFS reparse points, such as symbolic links or junctions, before performing file operations. A local attacker can create a junction at the temporary file location pointing to an arbitrary system path. Since the process runs with System privileges, this flaw allows for arbitrary file deletion with System privileges, which could lead to local privilege escalation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sitevision versions 10.3.1 and earlier **Description** A security issue in Sitevision allows a remote attacker, in certain non-default scenarios, to gain access to the private keys used for signing SAML authentication requests. The underlying issue is a Java keystore that may become accessible and downloadable via WebDAV. This keystore is protected with a low-complexity, auto-generated password. **Recommendations** For Sitevision versions 10.3.1 and earlier, consider disabling WebDAV access to the Java keystore as a temporary workaround until a patch is available. Restrict access to the keystore to minimize the risk of exploitation. Avoid using auto-generated passwords for the keystore. At the moment, there is no information about a newer version that contains a fix for this vulnerability.