Arseniy Sharoglazov

The vulnerability is related to the improper neutralization of special elements used in a template engine, allowing a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. This issue has been exploited in real-world attacks, with threat actors targeting older versions of the HTTP File Server to drop malware and cryptocurrency mining software. The estimated number of potentially affected devices worldwide is not explicitly stated, but it is known that over 89,700 services are found to be vulnerable.

An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. The issue is related to insufficient access control, which could allow a remote attacker to execute arbitrary code in the system.

A vulnerability in mod wsgi is related to errors in processing the X-Client-IP header. This issue allows an attacker to pass the X-Client-IP header to the target WSGI application because the condition to remove it is missing when the request comes from an untrusted proxy. The exploitation of this issue may enable a remote attacker to gain unauthorized access to network services.

The issue is related to the instantiation of objects from arbitrary classes in LDAP Account Manager, allowing an attacker to inject the first constructor argument. This can lead to code execution if non-LAM classes are instantiated that execute code during object creation.

The issue arises from incorrect regular expressions in LDAP Account Manager, allowing the upload of PHP scripts to the `/config/templates/pdf/` directory. This could lead to Remote Code Execution if the directory is accessible to remote users, which is not the default configuration. The estimated number of potentially affected devices worldwide is not specified. There are no reported real-world incidents where this issue was exploited. The vulnerability is related to the upload of PHP scripts to the `/config/templates/pdf/` directory, which can be accessed remotely if not properly configured.

The issue allows an attacker to gain code execution on the host by writing a web-shell into the tmp directory, accessible via /lam/tmp/. This directory allows interpretation of .php files, and an attacker with www-data privileges can exploit this. The problem has been fixed in version 8.0.

The issue is related to the lack of protection for confidential information in the LDAP Account Manager web application. Exploitation of this issue may allow an attacker to obtain LDAP authentication credentials. The problem arises when the PHP OpenSSL extension is not installed or encryption is disabled by configuration, causing session files to include the LDAP user name and password in clear text.

The issue exists due to the lack of neutralization of special elements in the LDAP Account Manager web application, allowing a remote attacker to use the `username` field to enumerate LDAP data. This is only possible in configurations that use LDAP search.

The profile editor tool in LDAP Account Manager (LAM) has an edit profile functionality where parameters are not properly sanitized, leading to stored XSS attacks. An authenticated user can store XSS payloads in profiles, which are triggered when another user accesses the edit profile page. The pdf editor tool also has an edit pdf profile functionality with a `logoFile` parameter that is not properly sanitized, allowing users to enter relative paths to access files. Both issues require an attacker to be able to login to the LAM admin interface.

The issue is related to insufficient access control in the Core component of Oracle WebLogic Server, allowing a high-privileged attacker with network access via HTTP to compromise the server. This can result in unauthorized access to critical data or complete access to all accessible data on the server.

A heap-based buffer overflow in the awarrensmtp component potentially allows an attacker to run arbitrary code remotely.

Name of the Vulnerable Software and Affected Versions: IBM Maximo Asset Management versions 7.6.0 through 7.6.1 Description: The issue is related to an unsafe deserialization in Java, which could allow a remote authenticated attacker to execute arbitrary code on the system. This can be achieved by sending a specially-crafted request, enabling the attacker to exploit the vulnerability and execute arbitrary code. Recommendations: For IBM Maximo Asset Management versions 7.6.0 and 7.6.1, consider disabling the deserialization mechanism in Java as a temporary workaround until a patch is available. Restrict access to the system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: IBM Maximo Asset Management versions 7.6.0 through 7.6.1 Description: The issue is related to insufficient validation of incoming requests, which may allow a remote attacker to perform a Server Side Request Forgery (SSRF) attack. This could enable an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. Recommendations: For versions 7.6.0 and 7.6.1, consider restricting access to vulnerable components or functions until a patch is available. As a temporary workaround, disabling the functionality that allows server-side requests may help minimize the risk of exploitation.

The issue is related to Server-side Request Forgery (SSRF) and File Enumeration vulnerability. It relies on the Java SAX Parser, which supports external entities in XML DOCTYPE by default, making Apache Roller vulnerable to SSRF and File Enumeration attacks. This vulnerability exists even if the Roller XML-RPC interface is disabled via the Roller web admin UI.

The issue allows a remote attacker to access files inside the server's web directory because it does not properly restrict access to these files. This product has been obsolete since June 2013.

The issue is related to insufficient access control in the PostgreSQL database management system. It allows a remote attacker to elevate their privileges and execute arbitrary code. An attacker with a user account can exploit this flaw to execute code with superuser permissions in the database.

The issue is related to a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks. This is due to the failure to properly handle CRLF sequences, allowing user-supplied data to be added to HTTP response headers without proper processing. As a result, an attacker can control HTTP response headers and bodies, potentially leading to cross-site scripting attacks and attacks on intermediate proxy servers.

The issue is related to the Single Sign-On feature in VMware products, specifically an XML External Entity (XXE) problem. This is due to incorrect restriction of XML links to external objects. Exploitation can allow a remote attacker to cause a denial of service or gain access to confidential information by using specially crafted XML requests. The vulnerability can be exploited by sending an XML document containing an external entity declaration in conjunction with an entity reference, allowing attackers to read arbitrary files.

The issue is related to an XML External Entity (XXE) problem, where there is an incorrect restriction of XML links to external objects. This can be exploited by a remote attacker to gain access to confidential information by sending a specially crafted XML request to the server. The exploitation is possible through the Log Browser, Distributed Switch setup, or Content Library XML document.

The issue is related to an XML External Entity (XXE) problem, where an XML document containing an external entity declaration in conjunction with an entity reference can be used to read arbitrary files. This is due to incorrect restriction of XML links to external objects. Exploitation of the issue may allow a remote attacker to access confidential information by convincing a user to connect to a malicious vCenter or ESXi server.