Leonidas Tsaousis

**Name of the Vulnerable Software and Affected Versions** IBM Sterling B2B Integrator Standard Edition versions 6.0.0.0 through 6.1.2.5 IBM Sterling B2B Integrator Standard Edition versions 6.2.0.0 through 6.2.0.2 **Description** The issue allows an attacker on the local network to execute arbitrary code on the system due to the deserialization of untrusted data. **Recommendations** For versions 6.0.0.0 through 6.1.2.5, update to a version that includes the patch for this issue. For versions 6.2.0.0 through 6.2.0.2, update to a version that includes the patch for this issue. As a temporary workaround, consider restricting access to the system to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Cisco Integrated Management Controller (affected versions not specified) **Description** The issue is related to information disclosure through inconsistency. It may allow a remote attacker to determine all existing usernames. The vulnerability is due to differences in authentication responses sent back from the application as part of an authentication attempt. An attacker could exploit this by sending authentication requests to the affected application, potentially confirming the names of administrative user accounts for use in further attacks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco Integrated Management Controller (affected versions not specified) **Description** A vulnerability in the API endpoints of Cisco Integrated Management Controller could allow an authenticated, remote attacker to bypass authorization and take actions on a vulnerable system without authorization. The issue is due to improper authorization checks on API endpoints, allowing an attacker to send malicious requests to an API endpoint. This could enable the attacker to download files from or modify limited configuration options on the affected system. Additionally, the vulnerability may allow a remote attacker to determine all existing usernames. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.