Fabian Ullrich

**Name of the Vulnerable Software and Affected Versions** CA Automic Automation versions 12.2 through 12.3 **Description** The issue is related to insecure input handling in the Automic Agent, which could allow a remote attacker to potentially enumerate users. **Recommendations** For CA Automic Automation versions 12.2 through 12.3, consider restricting access to the Automic Agent to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CA Automic Automation versions 12.2 through 12.3 **Description** The issue is related to an authentication error in the Automic agent, which could allow a remote attacker to potentially execute arbitrary commands. **Recommendations** For CA Automic Automation versions 12.2 and 12.3, consider restricting access to the Automic agent until a fix is available. As a temporary workaround, consider disabling remote access to the Automic agent to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CA Automic Automation versions 12.2 through 12.3 **Description** The issue is related to insecure memory handling in the Automic agent, which could allow a remote attacker to potentially access sensitive data. **Recommendations** For CA Automic Automation versions 12.2 through 12.3, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CA Automic Automation versions 12.2 through 12.3 **Description** The issue is related to insufficient input validation in the Automic agent, which could allow a remote attacker to potentially execute arbitrary code. **Recommendations** For CA Automic Automation versions 12.2 through 12.3, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CA Automic Automation versions 12.2 through 12.3 **Description** The issue concerns an insecure file creation and handling vulnerability in the Automic agent. This could potentially allow a user to elevate privileges. **Recommendations** For versions 12.2 and 12.3, update to a version that includes a fix for the insecure file creation and handling vulnerability in the Automic agent. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CA Automic Automation versions 12.2 through 12.3 **Description** The issue is related to insufficient input validation in the Automic agent, which could allow a remote attacker to potentially execute arbitrary code. **Recommendations** For CA Automic Automation versions 12.2 through 12.3, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SolarWinds N-Central version 12.3.0.670 **Description** An issue was discovered in SolarWinds N-Central, where the AdvancedScripts HTTP endpoint allows Relative Path Traversal by an authenticated user of the N-Central Administration Console (NAC), leading to execution of OS commands as root. **Recommendations** For SolarWinds N-Central version 12.3.0.670, as a temporary workaround, consider restricting access to the AdvancedScripts HTTP endpoint until a patch is available. Additionally, limiting the privileges of authenticated users in the N-Central Administration Console (NAC) may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SolarWinds N-Central version 12.3.0.670 **Description** An issue was discovered in the sudo configuration of SolarWinds N-Central, which has incorrect access control. The nable web user account is effectively able to run arbitrary OS commands as root because the use of root privileges is not limited to specific programs listed in the sudoers file. **Recommendations** For SolarWinds N-Central version 12.3.0.670, consider restricting the privileges of the nable web user account to prevent it from running arbitrary OS commands as root until a patch is available. As a temporary workaround, review and modify the sudoers file to limit the use of root privileges to specific programs.

**Name of the Vulnerable Software and Affected Versions** SolarWinds N-Central version 12.3.0.670 **Description** An issue was discovered in the SSH component of SolarWinds N-Central, where it does not restrict the communication channel to intended endpoints. This allows an attacker to leverage an SSH feature, specifically port forwarding with a temporary key pair, to access network services on the 127.0.0.1 interface. This feature was originally intended only for user-to-agent communication. **Recommendations** For SolarWinds N-Central version 12.3.0.670, consider restricting access to the SSH component until a patch is available. As a temporary workaround, disabling the port forwarding feature with temporary key pairs may help minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SolarWinds N-Central version 12.3.0.670 **Description** An issue was discovered in SolarWinds N-Central where hard-coded credentials exist by default for local user accounts named `support@n-able.com` and `nableadmin@n-able.com`. These credentials allow logins to the N-Central Administrative Console and/or the regular web interface. **Recommendations** For SolarWinds N-Central version 12.3.0.670, consider changing the default credentials for the `support@n-able.com` and `nableadmin@n-able.com` user accounts to prevent unauthorized access. As a temporary workaround, restrict access to the N-Central Administrative Console and the regular web interface until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Ivanti Service Manager HEAT Remote Control version 7.4 **Description** The issue is a Denial-of-Service (DoS) due to a buffer overflow in the protocol parser of the `HEATRemoteService` agent. This DoS can be triggered by sending a specially crafted network packet. **Recommendations** For Ivanti Service Manager HEAT Remote Control version 7.4, consider restricting access to the `HEATRemoteService` agent until a patch is available to prevent potential exploitation. As a temporary workaround, network traffic should be monitored for suspicious packets to minimize the risk of a Denial-of-Service attack.

**Name of the Vulnerable Software and Affected Versions** Frappe versions prior to 7.1.28 **Description** The issue allows remote authenticated users to execute arbitrary SQL commands via the `fields` parameter in the `frappe.share.get users` function. **Recommendations** For versions prior to 7.1.28, update to version 7.1.28 or later to resolve the issue.