Christoph Rottermanner

**Name of the Vulnerable Software and Affected Versions** eZ Platform Ibexa Kernel versions prior to 1.3.19 **Description** The issue allows determining account existence via a timing attack, affecting privacy. Ibexa DXP's implementation of random execution time to hinder timing attacks was found to be insufficient in some situations. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. Technical details about exploitation include the use of timing attacks against user accounts, which can discover whether a given account exists in a system without knowing its password. **Recommendations** For versions prior to 1.3.19, update to version 1.3.19 or later, which replaces the random execution time with constant time functionality, configured in the new security.yml parameter `ibexa.security.authentication.constant auth time`. As a temporary workaround, consider increasing the `ibexa.security.authentication.constant auth time` setting if a warning is logged due to the constant time being exceeded.

**Name of the Vulnerable Software and Affected Versions** Ibexa DXP ezsystems/ezpublish-kernel versions 7.5.x through 7.5.25 Ibexa DXP ezsystems/ezpublish-kernel versions 1.3.x through 1.3.11 **Description** The issue allows injection attacks via image filenames when image files are uploaded. This is possible because not all possible attack vectors are removed from the original file name. Additionally, direct access to the images is not access controlled, which can allow images not meant to be publicly accessible to be accessed if the image path and filename are correctly deduced or guessed. **Recommendations** For versions 7.5.x through 7.5.25, update to version 7.5.26 or later to resolve the issue. For versions 1.3.x through 1.3.11, update to version 1.3.12 or later to resolve the issue. As a temporary workaround, consider restricting access to image uploading functionality to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Ibexa DXP ezsystems/ezpublish-kernel versions 7.5.x through 7.5.25 Ibexa DXP ezsystems/ezpublish-kernel versions 1.3.x through 1.3.11 **Description** The issue allows Insecure Direct Object Reference (IDOR) attacks against image files because the image path and filename can be correctly deduced. When image files are uploaded, they are made accessible under a name similar to the original file name. This poses two issues: certain injection attacks can be possible due to not all possible attack vectors being removed from the original file name, and direct access to the images is not access controlled, allowing images not meant to be publicly accessible to be accessed if the image path and filename is correctly deduced or guessed. **Recommendations** For Ibexa DXP ezsystems/ezpublish-kernel versions 7.5.x through 7.5.25, update to version 7.5.26 or later. For Ibexa DXP ezsystems/ezpublish-kernel versions 1.3.x through 1.3.11, update to version 1.3.12 or later. As a temporary workaround, consider restricting access to image files to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Netgen Tags Bundle versions 3.4.x through 3.4.10 Netgen Tags Bundle versions 4.0.x through 4.0.14 Description: The issue allows for XSS in the Tags Admin interface. Recommendations: For Netgen Tags Bundle versions 3.4.x through 3.4.10, update to version 3.4.11 or later. For Netgen Tags Bundle versions 4.0.x through 4.0.14, update to version 4.0.15 or later.

**Name of the Vulnerable Software and Affected Versions** Cisco TelePresence Management Suite (TMS) Software (affected versions not specified) **Description** A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This issue is due to insufficient input validation by the web-based management interface. An attacker could exploit this vulnerability by inserting malicious data in a specific data field in the interface, potentially allowing the execution of arbitrary script code in the context of the affected interface or access to sensitive, browser-based information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco Prime Collaboration Provisioning (affected versions not specified) **Description** A vulnerability in the web-based management interface could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This issue is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link, potentially allowing the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco Prime Collaboration Provisioning Software (affected versions not specified) **Description** A vulnerability in the web-based management interface could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The issue exists because the interface improperly validates user input for specific SQL queries. An attacker could exploit this by authenticating with valid administrative credentials and sending malicious requests. A successful exploit could allow the attacker to view unauthorized information, make unauthorized changes, or delete unauthorized data from the database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco Prime Collaboration Provisioning (affected versions not specified) **Description** The issue is related to insufficient validation of user-supplied input by the web-based management interface, allowing an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. This could be achieved by persuading a user to click a crafted link, potentially enabling the attacker to execute arbitrary script code or access sensitive browser-based information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco Prime Collaboration Provisioning (affected versions not specified) **Description** The issue is related to a lack of protection for service data in the web-based management interface of Cisco Prime Collaboration Provisioning. This could allow a remote attacker to gain unauthorized access to sensitive information. The vulnerability exists because the web-based management interface includes unnecessary server information in its replies. An attacker could exploit this by inspecting the replies from the interface, potentially obtaining details about the operating system and web server version, which could be used for further attacks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.