Fabio Poloni

**Name of the Vulnerable Software and Affected Versions** Cisco Firepower Management Center (FMC) Software (affected versions not specified) **Description** A vulnerability in the administrative web-based GUI configuration manager of Cisco Firepower Management Center (FMC) Software is related to improper encryption of sensitive information stored within the GUI configuration manager. This could allow an authenticated, remote attacker to access sensitive configuration information. The attacker would require low privilege credentials on an affected device. An attacker could exploit this vulnerability by logging into the GUI of Cisco FMC Software and navigating to certain sensitive configurations. A successful exploit could allow the attacker to view sensitive configuration parameters in clear text. **Recommendations** For all affected versions of Cisco Firepower Management Center (FMC) Software, update to the latest software version that addresses this vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco Firepower Management Center Software (affected versions not specified) **Description** A vulnerability in the administrative web-based GUI configuration manager could allow an authenticated, remote attacker to access sensitive configuration information. This is due to a lack of proper encryption of sensitive information stored within the GUI configuration manager. An attacker could exploit this by logging into the FMC GUI and navigating to certain sensitive configurations, potentially allowing them to view sensitive configuration parameters in clear text. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: AdRem NetCrunch version 10.6.0.4587 Description: The issue is related to improper session handling in the NetCrunch web client, which can lead to an authentication bypass or escalation of privileges. Recommendations: For AdRem NetCrunch version 10.6.0.4587, consider disabling the NetCrunch web client until a patch is available to prevent potential authentication bypass or escalation of privileges.

Name of the Vulnerable Software and Affected Versions: AdRem NetCrunch version 10.6.0.4587 Description: The issue is related to a hardcoded SSL private key vulnerability in the NetCrunch web client. This hardcoded key is used across different customers' installations when no other SSL certificate is installed. As a result, remote attackers can defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation. Recommendations: For AdRem NetCrunch version 10.6.0.4587, consider replacing the hardcoded SSL private key with a unique certificate for each installation to prevent exploitation. Additionally, restrict access to the NetCrunch web client until a proper SSL certificate is installed.

Name of the Vulnerable Software and Affected Versions: AdRem NetCrunch version 10.6.0.4587 Description: The issue allows credentials disclosure, enabling every user to read private keys, private keys' passwords, and root passwords for BSD, Linux, MacOS, and Solaris stored in the credential manager. Additionally, every administrator can access ESX and Windows passwords stored in the credential manager. Recommendations: For AdRem NetCrunch version 10.6.0.4587, consider restricting access to the credential manager to minimize the risk of exploitation. As a temporary workaround, limit the privileges of users and administrators to prevent unauthorized access to sensitive credentials. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** totemodata version 3.0.0 b936 **Description** The issue is related to a Cross-Site Scripting (XSS) problem. It occurs via a folder name, allowing potential exploitation. **Recommendations** For totemodata version 3.0.0 b936, avoid using user-supplied input for folder names until a fix is available. As a temporary workaround, consider validating and sanitizing all folder names to prevent XSS attacks.