Davide Silvetti

**Name of the Vulnerable Software and Affected Versions** Kubernetes Image Builder Nutanix (affected versions not specified) OVA providers (affected versions not specified) **Description** VM images built with Kubernetes Image Builder Nutanix or OVA providers may use default credentials for Windows images if a user does not override them. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** VTiger CRM versions <= 8.1.0 **Description** The issue arises from improper sanitization of user input before it is used in a SQL statement, leading to a SQL Injection in the `CompanyDetails` operation of the `MailManager` module. **Recommendations** For VTiger CRM versions <= 8.1.0, update to a version higher than 8.1.0 to resolve the issue. As a temporary workaround, consider restricting access to the `MailManager` module to minimize the risk of exploitation. Avoid using the `CompanyDetails` operation until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** VTiger CRM versions <= 8.1.0 **Description** The issue concerns incorrect user privilege checking, allowing a low-privileged user to interact directly with the "Migration" administrative module. This enables the user to disable arbitrary modules. **Recommendations** For VTiger CRM versions <= 8.1.0, update to a version that includes the necessary privilege checks to prevent low-privileged users from accessing the "Migration" administrative module. As a temporary workaround, consider restricting access to the "Migration" module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** pgAdmin versions prior to 8.4 **Description** The issue is related to a path-traversal vulnerability in the session handling code of pgAdmin, which can lead to unsafe deserialization and remote code execution. This vulnerability can be exploited by an unauthenticated attacker on Windows or an authenticated attacker on POSIX/Linux systems, allowing them to gain code execution. The vulnerability is associated with the incorrect serialization of the `pga4 session` cookie file. **Recommendations** For pgAdmin versions prior to 8.4, update to version 8.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the session handling code to minimize the risk of exploitation. Avoid using the `pga4 session` cookie file until the issue is resolved. At the moment, there is no other information about additional mitigation measures.