Inc

**Name of the Vulnerable Software and Affected Versions** runZero Platform MCP service versions prior to 5.1.260826.0 **Description** An authorization bypass exists in the MCP service. This issue is an instance of Authorization Bypass Through User-Controlled Key, which occurs when an application uses a user-supplied input to access a resource without properly verifying if the user is authorized to access that specific resource. **Recommendations** Update to version 5.1.260826.0.

**Name of the Vulnerable Software and Affected Versions** e-Learning PHP Script version 0.1.0 **Description** The software contains a SQL injection issue in the search functionality. Attackers can manipulate database queries through unvalidated user input. Specifically, malicious SQL code can be injected through the `search` parameter to potentially extract, modify, or access sensitive database information. **Recommendations** Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, sanitize the `search` parameter to prevent SQL injection attacks.

**Name of the Vulnerable Software and Affected Versions** Phpscript-sgh version 0.1.0 **Description** The software contains a time-based blind SQL injection issue in the admin interface. Attackers can manipulate database queries through the `id` parameter. Exploitation involves crafting malicious payloads that cause time delays, allowing extraction of sensitive database information using conditional sleep techniques. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: PAN-OS versions (affected versions not specified) Description: An authenticated file deletion issue in the PAN-OS software allows an authenticated attacker with network access to the management web interface to delete certain files as the `nobody` user. This includes limited logs and configuration files but does not include system files. The attacker must have network access to the management web interface to exploit this issue. Restricting access to the management web interface to only trusted internal IP addresses can reduce the risk of this issue. This issue affects Cloud NGFW but does not affect Prisma Access software. Recommendations: As a temporary workaround, consider restricting access to the management web interface to only trusted internal IP addresses according to the recommended critical deployment guidelines. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FreeBSD versions prior to 13.1-RELEASE-p5 FreeBSD versions prior to 12.4-RC2-p2 FreeBSD versions prior to 12.3-RELEASE-p10 **Description** The issue is related to the ping utility in FreeBSD, which reads raw IP packets from the network to process responses in the `pr pack()` function. The function reconstructs the IP header, the ICMP header, and if present, a "quoted packet," which represents the packet that generated an ICMP error. However, it fails to account for the possible presence of IP option headers following the IP header in either the response or the quoted packet, leading to a buffer overflow of up to 40 bytes when IP options are present. This can be triggered by a remote host, causing the ping program to crash. The ping process runs in a capability mode sandbox, which constrains its interaction with the rest of the system. **Recommendations** For versions prior to 13.1-RELEASE-p5, update to 13.1-RELEASE-p5 or later. For versions prior to 12.4-RC2-p2, update to 12.4-RC2-p2 or later. For versions prior to 12.3-RELEASE-p10, update to 12.3-RELEASE-p10 or later. As a temporary workaround, consider restricting access to the ping utility until a patch is applied.

Name of the Vulnerable Software and Affected Versions: Secomea GateManager versions prior to 9.4 Description: A Cross-site Scripting (XSS) issue in the web GUI allows an attacker to inject arbitrary javascript code. Recommendations: For versions prior to 9.4, update to version 9.4 or later to resolve the issue.