Arseniy Sharoglazov

**Name of the Vulnerable Software and Affected Versions** Rejetto HTTP File Server versions 2.3m and earlier **Description** The vulnerability is related to the improper neutralization of special elements used in a template engine, allowing a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. This issue has been exploited in real-world attacks, with threat actors targeting older versions of the HTTP File Server to drop malware and cryptocurrency mining software. The estimated number of potentially affected devices worldwide is not explicitly stated, but it is known that over 89,700 services are found to be vulnerable. **Recommendations** For Rejetto HTTP File Server versions 2.3m and earlier, update to version 0.52.x, which is the recommended safe version of the product, as it is the latest release from the developer and includes support for HTTPS, dynamic DNS, and authentication for the administrative panel. Note: The provided information does not include any vulnerability identifiers (e.g., CVE numbers) in the response as per the guidelines.

**Name of the Vulnerable Software and Affected Versions** QTS versions prior to 4.3.6.2805 build 20240619 QTS versions prior to 4.3.4.2814 build 20240618 QTS versions prior to 4.3.3.2784 build 20240619 QTS versions prior to 4.2.6 build 20240618 **Description** An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. The issue is related to insufficient access control, which could allow a remote attacker to execute arbitrary code in the system. **Recommendations** For versions prior to 4.3.6.2805 build 20240619, update to QTS 4.3.6.2805 build 20240619 or later. For versions prior to 4.3.4.2814 build 20240618, update to QTS 4.3.4.2814 build 20240618 or later. For versions prior to 4.3.3.2784 build 20240619, update to QTS 4.3.3.2784 build 20240619 or later. For versions prior to 4.2.6 build 20240618, update to QTS 4.2.6 build 20240618 or later.

**Name of the Vulnerable Software and Affected Versions** mod wsgi (affected versions not specified) **Description** A vulnerability in mod wsgi is related to errors in processing the X-Client-IP header. This issue allows an attacker to pass the X-Client-IP header to the target WSGI application because the condition to remove it is missing when the request comes from an untrusted proxy. The exploitation of this issue may enable a remote attacker to gain unauthorized access to network services. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LDAP Account Manager versions prior to 8.0 **Description** The issue is related to the instantiation of objects from arbitrary classes in LDAP Account Manager, allowing an attacker to inject the first constructor argument. This can lead to code execution if non-LAM classes are instantiated that execute code during object creation. **Recommendations** For versions prior to 8.0, update to version 8.0 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable functionality until the update is applied.

**Name of the Vulnerable Software and Affected Versions** LDAP Account Manager versions prior to 8.0 **Description** The issue arises from incorrect regular expressions in LDAP Account Manager, allowing the upload of PHP scripts to the `/config/templates/pdf/` directory. This could lead to Remote Code Execution if the directory is accessible to remote users, which is not the default configuration. The estimated number of potentially affected devices worldwide is not specified. There are no reported real-world incidents where this issue was exploited. The vulnerability is related to the upload of PHP scripts to the `/config/templates/pdf/` directory, which can be accessed remotely if not properly configured. **Recommendations** For versions prior to 8.0, update to version 8.0 to resolve the issue. As a temporary workaround, consider restricting access to the `/config/templates/pdf/` directory to prevent remote users from uploading PHP scripts.

**Name of the Vulnerable Software and Affected Versions** LDAP Account Manager versions prior to 8.0 **Description** The issue allows an attacker to gain code execution on the host by writing a web-shell into the tmp directory, accessible via /lam/tmp/. This directory allows interpretation of .php files, and an attacker with www-data privileges can exploit this. The problem has been fixed in version 8.0. **Recommendations** For versions prior to 8.0, disallow executing PHP scripts in the (/var/lib/ldap-account-manager/)tmp directory as a temporary workaround until the issue is resolved. As a permanent solution, upgrade to version 8.0 or later.

**Name of the Vulnerable Software and Affected Versions** LDAP Account Manager versions prior to 8.0 **Description** The issue is related to the lack of protection for confidential information in the LDAP Account Manager web application. Exploitation of this issue may allow an attacker to obtain LDAP authentication credentials. The problem arises when the PHP OpenSSL extension is not installed or encryption is disabled by configuration, causing session files to include the LDAP user name and password in clear text. **Recommendations** For versions prior to 8.0, install the PHP OpenSSL extension and ensure session encryption is enabled in the LAM main configuration. For versions prior to 8.0 where an upgrade is not possible, install the PHP OpenSSL extension and make sure session encryption is enabled in LAM main configuration. Upgrade to version 8.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** LDAP Account Manager versions prior to 8.0 **Description** The issue exists due to the lack of neutralization of special elements in the LDAP Account Manager web application, allowing a remote attacker to use the `username` field to enumerate LDAP data. This is only possible in configurations that use LDAP search. **Recommendations** For versions prior to 8.0, update to version 8.0 to resolve the issue. As a temporary workaround, consider restricting access to the login functionality to minimize the risk of exploitation. Avoid using the `username` field in the affected login endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** LDAP Account Manager (LAM) versions prior to 7.9.1 **Description** The profile editor tool in LDAP Account Manager (LAM) has an edit profile functionality where parameters are not properly sanitized, leading to stored XSS attacks. An authenticated user can store XSS payloads in profiles, which are triggered when another user accesses the edit profile page. The pdf editor tool also has an edit pdf profile functionality with a `logoFile` parameter that is not properly sanitized, allowing users to enter relative paths to access files. Both issues require an attacker to be able to login to the LAM admin interface. **Recommendations** For versions prior to 7.9.1, update to version 7.9.1 to resolve the issue. As a temporary workaround, consider disabling the edit profile functionality and the pdf editor tool until the update is applied. Restrict access to the admin interface to minimize the risk of exploitation. Avoid using the `logoFile` parameter in the pdf editor tool until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 10.3.6.0.0 through 14.1.1.0.0 **Description** The issue is related to insufficient access control in the Core component of Oracle WebLogic Server, allowing a high-privileged attacker with network access via HTTP to compromise the server. This can result in unauthorized access to critical data or complete access to all accessible data on the server. **Recommendations** For versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sophos XG Firewall versions prior to v17.5 MR11 **Description** A heap-based buffer overflow in the awarrensmtp component potentially allows an attacker to run arbitrary code remotely. **Recommendations** For Sophos XG Firewall versions prior to v17.5 MR11, update to a version newer than v17.5 MR11 to resolve the issue. As a temporary workaround, consider restricting access to the awarrensmtp component until a patch is available.

Name of the Vulnerable Software and Affected Versions: IBM Maximo Asset Management versions 7.6.0 through 7.6.1 Description: The issue is related to an unsafe deserialization in Java, which could allow a remote authenticated attacker to execute arbitrary code on the system. This can be achieved by sending a specially-crafted request, enabling the attacker to exploit the vulnerability and execute arbitrary code. Recommendations: For IBM Maximo Asset Management versions 7.6.0 and 7.6.1, consider disabling the deserialization mechanism in Java as a temporary workaround until a patch is available. Restrict access to the system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: IBM Maximo Asset Management versions 7.6.0 through 7.6.1 Description: The issue is related to insufficient validation of incoming requests, which may allow a remote attacker to perform a Server Side Request Forgery (SSRF) attack. This could enable an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. Recommendations: For versions 7.6.0 and 7.6.1, consider restricting access to vulnerable components or functions until a patch is available. As a temporary workaround, disabling the functionality that allows server-side requests may help minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Apache Roller versions 5.2.1, 5.2.0 and earlier **Description** The issue is related to Server-side Request Forgery (SSRF) and File Enumeration vulnerability. It relies on the Java SAX Parser, which supports external entities in XML DOCTYPE by default, making Apache Roller vulnerable to SSRF and File Enumeration attacks. This vulnerability exists even if the Roller XML-RPC interface is disabled via the Roller web admin UI. **Recommendations** For Apache Roller versions 5.2.1, 5.2.0 and earlier, upgrade to the latest version, which is 5.2.2. Alternatively, edit the Roller web.xml file and comment out the XML-RPC Servlet mapping, specifically the `XmlRpcServlet` with the `url-pattern` `/roller-services/xmlrpc`.

**Name of the Vulnerable Software and Affected Versions** Telerik Extensions for ASP.NET MVC (all versions) **Description** The issue allows a remote attacker to access files inside the server's web directory because it does not properly restrict access to these files. This product has been obsolete since June 2013. **Recommendations** For Telerik Extensions for ASP.NET MVC, consider implementing a whitelist for requests to prevent unauthorized access to files inside the server's web directory. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PostgreSQL versions 9.3 through 10 **Description** The issue is related to insufficient access control in the PostgreSQL database management system. It allows a remote attacker to elevate their privileges and execute arbitrary code. An attacker with a user account can exploit this flaw to execute code with superuser permissions in the database. **Recommendations** For versions 9.3 through 10, update to a version that includes the fix for this issue to prevent exploitation. As a temporary workaround, consider restricting access to sensitive database operations to minimize the risk of privilege escalation.

**Name of the Vulnerable Software and Affected Versions** VMware vCenter Server version 6.0 before U2 VMware ESXi version 6.0 **Description** The issue is related to a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks. This is due to the failure to properly handle CRLF sequences, allowing user-supplied data to be added to HTTP response headers without proper processing. As a result, an attacker can control HTTP response headers and bodies, potentially leading to cross-site scripting attacks and attacks on intermediate proxy servers. **Recommendations** For VMware vCenter Server version 6.0 before U2, update to version U2 or later to resolve the issue. For VMware ESXi version 6.0, update to a version that includes the fix for this issue, as no specific version is mentioned as being unaffected. At the moment, there is no information about a newer version that contains a fix for VMware ESXi version 6.0.

**Name of the Vulnerable Software and Affected Versions** VMware vCenter Server versions 5.5 before U3e and 6.0 before U2a VMware vRealize Automation versions 6.x before 6.2.5 **Description** The issue is related to the Single Sign-On feature in VMware products, specifically an XML External Entity (XXE) problem. This is due to incorrect restriction of XML links to external objects. Exploitation can allow a remote attacker to cause a denial of service or gain access to confidential information by using specially crafted XML requests. The vulnerability can be exploited by sending an XML document containing an external entity declaration in conjunction with an entity reference, allowing attackers to read arbitrary files. **Recommendations** For VMware vCenter Server versions 5.5 before U3e, update to U3e or later. For VMware vCenter Server versions 6.0 before U2a, update to U2a or later. For VMware vRealize Automation versions 6.x before 6.2.5, update to 6.2.5 or later. As a temporary workaround, consider restricting access to the Single Sign-On feature until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** VMware vCenter Server versions 5.5 before U3e and 6.0 before U2a **Description** The issue is related to an XML External Entity (XXE) problem, where there is an incorrect restriction of XML links to external objects. This can be exploited by a remote attacker to gain access to confidential information by sending a specially crafted XML request to the server. The exploitation is possible through the Log Browser, Distributed Switch setup, or Content Library XML document. **Recommendations** For versions 5.5 before U3e, update to U3e or later to resolve the issue. For versions 6.0 before U2a, update to U2a or later to resolve the issue. As a temporary workaround, consider restricting access to the Log Browser, Distributed Switch setup, and Content Library XML documents to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** VMware vSphere Client versions 5.5 before U3e VMware vSphere Client versions 6.0 before U2a **Description** The issue is related to an XML External Entity (XXE) problem, where an XML document containing an external entity declaration in conjunction with an entity reference can be used to read arbitrary files. This is due to incorrect restriction of XML links to external objects. Exploitation of the issue may allow a remote attacker to access confidential information by convincing a user to connect to a malicious vCenter or ESXi server. **Recommendations** For versions 5.5 before U3e, update to U3e or later to resolve the issue. For versions 6.0 before U2a, update to U2a or later to resolve the issue. As a temporary workaround, consider restricting access to the vCenter and ESXi servers to minimize the risk of exploitation.