Karol Mazurkowi

**Name of the Vulnerable Software and Affected Versions** DaVinci Resolve versions prior to 19.1.3 **Description** The issue is related to incorrect file permissions in DaVinci Resolve on MacOS, which can lead to Dylib Hijacking. This inconsistency with standard macOS security practices allows for privilege escalation, where the guest account, other users, and applications can exploit this issue. **Recommendations** For versions prior to 19.1.3, update to version 19.1.3 or later to resolve the issue. As a temporary workaround, consider changing the file permissions to drwxr-xr-x to minimize the risk of exploitation. Restrict access to the application for guest accounts and other users to prevent privilege escalation until the update is applied.

**Name of the Vulnerable Software and Affected Versions** CyberArk Endpoint Privilege Manager in SaaS version 24.7.1 **Description** The issue allows an attacker with access to the Administration panel, specifically the "Role Management" tab, to inject code by adding a new role in the `name` field. However, the risk of exploiting this issue is reduced due to the required additional error that allows bypassing the Content-Security-Policy policy, which mitigates JS code execution while still allowing HTML injection. **Recommendations** For version 24.7.1, consider restricting access to the "Role Management" tab in the Administration panel to minimize the risk of exploitation. As a temporary workaround, avoid using the `name` field in the "Role Management" tab until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CyberArk Endpoint Privilege Manager in SaaS version 24.7.1 **Description** The issue allows IP address spoofing by providing a custom value in the `X-Forwarded-For` header, which compromises the action logging mechanism's accountability. **Recommendations** For version 24.7.1, consider restricting the use of the `X-Forwarded-For` header until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CyberArk Endpoint Privilege Manager in SaaS version 24.7.1 **Description** The issue concerns code injection in the "modalDlgMsgInternal" parameter via POST in the "/EPMUI/ModalDlgHandler.ashx?value=showReadonlyDlg" endpoint, which is then executed in the browser. The risk of exploitation is somewhat mitigated by the need to bypass the Content-Security-Policy. **Recommendations** For version 24.7.1, consider restricting access to the "/EPMUI/ModalDlgHandler.ashx?value=showReadonlyDlg" endpoint to minimize the risk of exploitation. As a temporary workaround, avoid using the `modalDlgMsgInternal` parameter in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CyberArk Endpoint Privilege Manager in SaaS version 24.7.1 **Description** The application does not limit the number or frequency of user interactions, such as the number of incoming requests. At the "/EPMUI/VfManager.asmx/ChangePassword" endpoint, it is possible to perform a brute force attack on the current password in use. **Recommendations** For CyberArk Endpoint Privilege Manager in SaaS version 24.7.1, consider implementing rate limiting on the "/EPMUI/VfManager.asmx/ChangePassword" endpoint to prevent brute force attacks until a patch is available. As a temporary workaround, restrict access to this endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** CyberArk Endpoint Privilege Manager version 24.7.1 **Description** The issue allows for HTML code injection into the page content through the `content` field in the Application definition page. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. **Recommendations** For version 24.7.1, consider restricting access to the `content` field in the Application definition page to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.