Kirill Nikolaev

**Name of the Vulnerable Software and Affected Versions** vsDesk versions prior to 14.0101 **Description** The application uses a weak and predictable method based on the request timestamp to generate names for uploaded files. This flaw allows a remote attacker to guess or brute-force the generated filename within a short time window, enabling unauthorized access to uploaded files to facilitate further attacks. **Recommendations** Update to version 14.0101 or later.

**Name of the Vulnerable Software and Affected Versions** vsDesk versions prior to 14.0101 **Description** An OS command injection flaw exists due to insufficient input filtering. This allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands, which could lead to disrupted web server operations, exposure of sensitive data, or full server compromise. **Recommendations** Update to version 14.0101 or later.

**Name of the Vulnerable Software and Affected Versions** vsDesk versions prior to 14.0402 **Description** An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component because the server fails to perform its own validation. This flaw allows the upload of arbitrary files, potentially leading to Remote Code Execution (RCE), which is the ability to execute malicious commands on the host machine, within the context of the web application. **Recommendations** Update to version 14.0402 or later.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined versions prior to 14.0101 **Description** An application component insecurely processes user-supplied parameters by passing them into SQL queries. This flaw allows for blind SQL injection, a technique used to extract information from a database by observing the application's response to specific queries, which could lead to the exposure of database contents or cause the application to become unresponsive. **Recommendations** Update to version 14.0101 or later.

**Name of the Vulnerable Software and Affected Versions** vsDesk versions prior to 14.0402 **Description** An insecure deserialization issue allows a remote attacker to obtain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account. Insecure deserialization occurs when untrusted data is used to abuse the logic of an application to execute arbitrary code or manipulate system behavior. **Recommendations** Update to version 14.0402 or later.

**Name of the Vulnerable Software and Affected Versions** SpotAuditor version 5.3.2 **Description** SpotAuditor 5.3.2 contains a local buffer overflow in the Base64 Encrypted Password tool. An attacker can execute arbitrary code by crafting a malicious payload. Specifically, a specially crafted Base64 encoded payload can trigger a Structured Exception Handler (SEH) overwrite, allowing the execution of shellcode on the vulnerable system. A Structured Exception Handler (SEH) is a mechanism in Windows operating systems for handling exceptions during program execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.