Clément Amic

**Name of the Vulnerable Software and Affected Versions** SonarSource SonarQube versions prior to 9.9.5 LTA SonarSource SonarQube versions prior to 10.5 **Description** An issue was discovered in SonarSource SonarQube where a user with the Administrator role can modify an existing configuration of a GitHub integration to exfiltrate a pre-signed JWT. **Recommendations** For versions prior to 9.9.5 LTA, update to version 9.9.5 LTA or later. For versions prior to 10.5, update to version 10.5 or later. As a temporary workaround, consider restricting the modification of GitHub integration configurations to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC (affected versions not specified) **Description** A vulnerability in the web UI of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow an authenticated, remote attacker to perform a stored cross-site scripting attack on an affected system. This issue is due to improper input validation in the web UI. An authenticated attacker could exploit this vulnerability by sending malicious input to the web UI, potentially allowing the execution of arbitrary script code in the context of the web-based interface or access to sensitive, browser-based information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco NX-OS versions (affected versions not specified) **Description** The issue exists due to insufficient restrictions during the execution of a specific CLI command, allowing an authenticated, local attacker to elevate privileges on an affected device. An attacker with administrative privileges could exploit this by performing a command injection attack on the vulnerable command, potentially accessing the underlying operating system as root. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode (affected versions not specified) **Description** A vulnerability in the fabric infrastructure file system access control could allow an authenticated, local attacker to read arbitrary files on an affected system. This issue is due to improper access control. An attacker with Administrator privileges could exploit this by executing a specific vulnerable command on an affected device, allowing them to read arbitrary files on the file system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.