Florent Daigniere

Name of the Vulnerable Software and Affected Versions: Umbraco version 4.7.0 Description: The issue allows remote attackers to proxy requests on their behalf. This is achieved via the `url` parameter in the FeedProxy.aspx script. Recommendations: For Umbraco version 4.7.0, consider restricting access to the FeedProxy.aspx script to minimize the risk of exploitation. Avoid using the `url` parameter in the FeedProxy.aspx script until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** F5 BIG-IP appliances versions 9.x through 9.4.8-HF4, versions 10.x through 10.2.4, versions 11.0.x through 11.0.0-HF1, and versions 11.1.x through 11.1.0-HF2 F5 Enterprise Manager versions 2.1.x through 2.1.0-HF1, versions 2.2.x through 2.2.0-HF0, and versions 2.3.x through 2.3.0-HF2 **Description** The issue arises from the use of a single SSH private key across different customers' installations, combined with a lack of proper access restrictions to this key. This makes it easier for remote attackers to perform SSH logins via the PubkeyAuthentication option. **Recommendations** For F5 BIG-IP appliances versions 9.x through 9.4.8-HF4, update to version 9.4.8-HF5 or later. For F5 BIG-IP appliances versions 10.x through 10.2.4, update to version 10.2.4 or later. For F5 BIG-IP appliances versions 11.0.x through 11.0.0-HF1, update to version 11.0.0-HF2 or later. For F5 BIG-IP appliances versions 11.1.x through 11.1.0-HF2, update to version 11.1.0-HF3 or later. For F5 Enterprise Manager versions 2.1.x through 2.1.0-HF1, update to version 2.1.0-HF2 or later. For F5 Enterprise Manager versions 2.2.x through 2.2.0-HF0, update to version 2.2.0-HF1 or later. For F5 Enterprise Manager versions 2.3.x through 2.3.0-HF2, update to version 2.3.0-HF3 or later.

**Name of the Vulnerable Software and Affected Versions** Cisco Unified Videoconferencing (UVC) System versions 5110 and 5115 **Description** The issue allows remote attackers to obtain access due to default passwords for the `root`, `cs`, and `develop` accounts. This makes it easier for attackers to gain access via the FTP or SSH daemon. **Recommendations** For Cisco Unified Videoconferencing (UVC) System versions 5110 and 5115, change the default passwords for the `root`, `cs`, and `develop` accounts to prevent unauthorized access.