Icez

**Name of the Vulnerable Software and Affected Versions** vCenter Server (affected versions not specified) **Description** The issue is related to a reflected cross-site scripting vulnerability in the vCenter Server due to a lack of input sanitization. This allows an attacker to execute malicious scripts by tricking a victim into clicking a malicious link. The vulnerability can be exploited by a remote attacker to redirect users to a malicious webpage. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 10.3.6.0.0 through 14.1.1.0.0 **Description** The issue is related to a vulnerability in the Oracle WebLogic Server product, specifically in the Console component. This vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the Oracle WebLogic Server, potentially resulting in a takeover. The vulnerability is easily exploitable and can impact the confidentiality, integrity, and availability of the server. It is associated with errors in code generation management and can be exploited using HTTP requests. **Recommendations** For versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0, update to a version that includes the emergency patch released by Oracle to fix this critical flaw. As a temporary workaround, consider restricting access to the Console component until a patch is applied. Avoid using the vulnerable Console component in the affected Oracle WebLogic Server versions until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Apache Struts versions 2.1.x through 2.3.x **Description** The issue exists due to insufficient validation of user-input data that is part of a message, allowing a remote attacker to execute arbitrary code. This can be achieved by passing a malicious field value in a raw message to the ActionMessage. **Recommendations** For versions 2.1.x through 2.3.x, consider disabling the Struts 1 plugin until a patch is available to prevent remote code execution via malicious field values in raw messages to the ActionMessage. At the moment, there is no information about a newer version that contains a fix for this vulnerability.