Jan Fry

**Name of the Vulnerable Software and Affected Versions** IBM OpenPages GRC Platform versions 7.0 through 7.0.0.4 IF3 IBM OpenPages GRC Platform versions 7.1 through 7.1.0.1 IF5 **Description** The issue allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. **Recommendations** For IBM OpenPages GRC Platform versions 7.0 through 7.0.0.4 IF3, update to version 7.0.0.4 IF3 or later. For IBM OpenPages GRC Platform versions 7.1 through 7.1.0.1 IF5, update to version 7.1.0.1 IF6 or later.

Cross-site scripting (XSS) vulnerability in WebID/IISWebAgentIF.dll in RSA Authentication Agent 5.3.0.258, and other versions before 5.3.3.378, allows remote attackers to inject arbitrary web script or HTML via a URL-encoded postdata parameter. NOTE: this is different than CVE-2005-1118, but it might be the same as CVE-2008-1470.

**Name of the Vulnerable Software and Affected Versions** Plone CMS versions prior to 3 **Description** The issue allows remote attackers to obtain access by sniffing the network, as a base64 encoded form of the `username` and `password` is placed in the ` ac` cookie for all user accounts. **Recommendations** For versions prior to 3, consider disabling the use of the ` ac` cookie or restricting access to sensitive areas of the CMS until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Plone CMS versions prior to 3.0.6 Plone CMS versions 3.0.5 and earlier **Description** The issue allows remote attackers to obtain administrative privileges by sniffing the network, as a base64 encoded form of the `username` and `password` is placed in the " ac" cookie for the admin account. **Recommendations** For Plone CMS versions prior to 3.0.6, update to version 3.0.6 or later to resolve the issue. For Plone CMS versions 3.0.5 and earlier, update to version 3.0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin account until a patch is available. Avoid using the ` ac` cookie in the affected Plone CMS versions until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Plone CMS versions 3.0.5 through 3.0.6 Plone CMS versions prior to 3.1 **Description** The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities allow remote attackers to perform certain actions without the victim's consent. Specifically, attackers can (1) add arbitrary accounts via the "join form" page and (2) change the privileges of arbitrary groups via the "prefs groups overview" page. **Recommendations** For Plone CMS versions 3.0.5 and 3.0.6, update to version 3.1 or later to resolve the issue. For Plone CMS versions prior to 3.1, update to version 3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the "join form" and "prefs groups overview" pages until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Plone CMS versions 3.x through 3.1.x **Description** The issue allows remote attackers to gain permanent access to an account by sniffing the network, due to the use of invariant data when calculating an HMAC-SHA1 value for an authentication cookie. This makes it easier for attackers to exploit the system. **Recommendations** For Plone CMS versions 3.x through 3.1.x, consider updating the authentication mechanism to use more secure and variable data when calculating the HMAC-SHA1 value for authentication cookies, to prevent remote attackers from gaining permanent access to accounts. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Plone CMS (affected versions not specified) **Description** The issue concerns the handling of user authentication states. Specifically, it does not record users' authentication states and implements the logout feature solely on the client side. This makes it easier for context-dependent attackers to reuse a logged-out session. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** F5 FirePass 4100 SSL VPN versions 5.4.1 through 5.5.2 F5 FirePass 4100 SSL VPN versions 6.0 through 6.0.1 **Description** The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the query string to specific API endpoints, such as "my.activation.php3" and "my.logon.php3", when pre-logon sequences are enabled. **Recommendations** For F5 FirePass 4100 SSL VPN versions 5.4.1 through 5.5.2, update to a version outside of this range to resolve the issue. For F5 FirePass 4100 SSL VPN versions 6.0 through 6.0.1, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the "my.activation.php3" and "my.logon.php3" endpoints until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Spyce - Python Server Pages (PSP) version 2.1.3 **Description** The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved through various parameters in different API endpoints, including: the `url` or `type` parameter to "docs/examples/redirect.spy"; the `x` parameter to "docs/examples/handlervalidate.spy"; the `name` parameter to "spyce/examples/request.spy"; the `Name` parameter to "spyce/examples/getpost.spy"; the `mytextarea`, `mypass`, or an empty parameter to "spyce/examples/formtag.spy"; the `newline` parameter to the default URI under "demos/chat/"; the `text1` parameter to "docs/examples/formintro.spy"; or the `mytext` or `mydate` parameter to "docs/examples/formtag.spy". **Recommendations** For Spyce - Python Server Pages (PSP) version 2.1.3, consider disabling the affected API endpoints until a patch is available. Restrict access to the parameters `url`, `type`, `x`, `name`, `Name`, `mytextarea`, `mypass`, `newline`, `text1`, `mytext`, and `mydate` in their respective endpoints to minimize the risk of exploitation. Avoid using these parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Spyce - Python Server Pages (PSP) version 2.1.3 **Description** The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the `url` parameter. This can be exploited by providing a malicious URL to the vulnerable application. **Recommendations** For Spyce - Python Server Pages (PSP) version 2.1.3, consider validating and sanitizing the `url` parameter to prevent redirects to arbitrary web sites. As a temporary workaround, restrict access to the redirect functionality to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Spyce - Python Server Pages (PSP) version 2.1.3 **Description** The issue allows remote attackers to obtain sensitive information via a direct request for "spyce/examples/automaton.spy", which reveals the path in an error message. **Recommendations** For version 2.1.3, consider restricting access to the "spyce/examples/automaton.spy" endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Novemberborn sIFR version 2.0.2 **Description** The issue is related to a cross-site scripting (XSS) vulnerability in the font rendering functionality. This allows remote attackers to inject arbitrary web script or HTML via the `txt` parameter to a Flash (SWF) file. **Recommendations** For Novemberborn sIFR version 2.0.2, consider restricting access to the vulnerable `txt` parameter in Flash files until a patch is available. As a temporary workaround, avoid using the `txt` parameter in the affected API endpoint or SWF files.

**Name of the Vulnerable Software and Affected Versions** Sun Java System Identity Manager versions 6.0 SP1 through 7.1 **Description** The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved via a URL in the `nextPage` parameter in the /idm/user/login.jsp endpoint. **Recommendations** For Sun Java System Identity Manager versions 6.0 SP1 through 7.1, consider restricting access to the /idm/user/login.jsp endpoint until a fix is available, and avoid using the `nextPage` parameter in this endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Sun Java System Identity Manager versions 6.0 SP1 through 7.1 **Description** The issue allows remote attackers to inject frames from arbitrary web sites and conduct phishing attacks via the `helpUrl` parameter. This is related to the `/idm/help/index.jsp` endpoint. **Recommendations** For Sun Java System Identity Manager versions 6.0 SP1 through 7.1, consider restricting access to the `/idm/help/index.jsp` endpoint to minimize the risk of exploitation. Avoid using the `helpUrl` parameter in this endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Absolute News Manager.NET version 5.1 **Description** The issue allows remote attackers to obtain sensitive information. This is achieved via a direct request to "getpath.aspx", which reveals the installation path in an error message. **Recommendations** For Absolute News Manager.NET version 5.1, consider restricting access to the "getpath.aspx" page to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** F5 Firepass 4100 SSL VPN versions 5.4 through 5.5.2 F5 Firepass 4100 SSL VPN versions 6.0 through 6.0.1 **Description** A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `backurl` parameter in the download plugin.php3 file. **Recommendations** For versions 5.4 through 5.5.2, avoid using the `backurl` parameter in the download plugin.php3 file until a fix is available. For versions 6.0 through 6.0.1, restrict access to the download plugin.php3 file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Microsoft ASP .NET Framework version 2.0.50727.42 **Description** The issue allows remote attackers to bypass request filtering, which can lead to cross-site scripting (XSS) attacks or cause a denial of service. This can be achieved by exploiting the improper handling of comment enclosures, for example, via an xss:expression STYLE attribute in a closing XSS HTML tag. **Recommendations** For Microsoft ASP .NET Framework version 2.0.50727.42, consider updating to a newer version that properly handles comment enclosures to prevent request filtering bypass and subsequent attacks. As a temporary workaround, restrict access to potentially vulnerable endpoints to minimize the risk of exploitation.