Ivathmican Sivakumaran

**Name of the Vulnerable Software and Affected Versions** Marvell QConvergeConsole version 5.5.0.64 **Description** This issue allows remote attackers to execute arbitrary code on affected installations. Although authentication is required to exploit this issue, the existing authentication mechanism can be bypassed. The specific flaw exists within the Tomcat configuration file due to the lack of proper restriction to the Tomcat admin console. An attacker can leverage this issue to execute code in the context of SYSTEM. **Recommendations** For Marvell QConvergeConsole version 5.5.0.64, restrict access to the Tomcat admin console to minimize the risk of exploitation. Consider implementing proper restrictions to the Tomcat configuration file as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: NEC ESMPRO Manager version 6.42 Description: This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the RMI service, resulting from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this issue to execute code in the context of SYSTEM. Recommendations: For NEC ESMPRO Manager version 6.42, consider disabling the RMI service until a patch is available to prevent exploitation. Restrict access to the RMI service to minimize the risk of remote code execution. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Eaton's Intelligent Power Manager (IPM) versions 1.67 and prior **Description** The issue is related to improper input validation on file names during configuration file import functionality. This allows attackers to perform command injection or code execution via specially crafted file names while uploading the configuration file in the application. **Recommendations** For versions 1.67 and prior, consider restricting the import of configuration files or validating file names to prevent specially crafted names from being uploaded until a fix is available. As a temporary workaround, avoid using the file import functionality for configuration files until the issue is resolved.