Marcin Noga

Name of the Vulnerable Software and Affected Versions: Observium CE version 24.4.13528 Description: A cross-site scripting (XSS) issue exists in the `add alert check` page, allowing an attacker to execute arbitrary JavaScript code through a specially crafted HTTP request. An authenticated user would need to click on a malicious link provided by the attacker to trigger the issue. Recommendations: For Observium CE version 24.4.13528, as a temporary workaround, consider restricting access to the `add alert check` page until a patch is available. Avoid clicking on suspicious links from untrusted sources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Observium CE version 24.4.13528 Description: A html code injection vulnerability exists in the vlan management part of Observium CE. This issue can be exploited by an attacker sending a specially crafted HTTP request, potentially leading to the execution of arbitrary html code. For a successful attack, an authenticated user would need to click on a malicious link provided by the attacker. Recommendations: For Observium CE version 24.4.13528, consider disabling the vlan management feature until a patch is available to prevent potential html code injection attacks. Restrict access to the vlan management module to minimize the risk of exploitation. Avoid using the vlan management feature in Observium CE until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Observium CE version 24.4.13528 **Description** A cross-site scripting (XSS) issue exists in the weather map editor functionality. This can be exploited through a specially crafted HTTP request, leading to the execution of arbitrary JavaScript code. An authenticated user would need to click on a malicious link provided by the attacker to trigger the issue. **Recommendations** For Observium CE version 24.4.13528, as a temporary workaround, consider disabling the weather map editor functionality until a patch is available. Restrict access to this feature to minimize the risk of exploitation. Avoid clicking on suspicious links to prevent arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WhatsUp Gold versions prior to 2024.0.2 **Description** The issue allows an authenticated user to use a specially crafted HTTP request, which can lead to information disclosure. **Recommendations** For versions prior to 2024.0.2, update to version 2024.0.2 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: WhatsUp Gold versions prior to 2023.1.3 Description: A vulnerability exists in the TestController functionality, allowing a specially crafted unauthenticated HTTP request to disclose sensitive information. Recommendations: For versions prior to 2023.1.3, update to version 2023.1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the TestController functionality until a patch is available.

Name of the Vulnerable Software and Affected Versions: WhatsUp Gold versions prior to 2023.1.3 Description: The issue is related to an uncontrolled resource consumption vulnerability. A specially crafted unauthenticated HTTP request to the "TestController Chart" functionality can lead to denial of service. Recommendations: For versions prior to 2023.1.3, update to version 2023.1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the TestController Chart functionality to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: WhatsUp Gold versions prior to 2023.1.3 Description: A path traversal issue exists, allowing information disclosure through a specially crafted unauthenticated HTTP request to the AppProfileImport endpoint. Recommendations: For versions prior to 2023.1.3, update to version 2023.1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the AppProfileImport endpoint until a patch is applied.

Name of the Vulnerable Software and Affected Versions: Microsoft High Definition Audio Bus Driver version 10.0.19041.3636 Description: A mishandling of IRP requests vulnerability exists in the HDAudBus DMA interface of Microsoft High Definition Audio Bus Driver. This vulnerability can be exploited by a specially crafted application issuing multiple IRP Complete requests, leading to a local denial-of-service. An attacker can execute malicious script/application to trigger this vulnerability, potentially allowing the execution of arbitrary code or causing a denial-of-service. Recommendations: For Microsoft High Definition Audio Bus Driver version 10.0.19041.3636, patch the driver to mitigate the local attack risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ManageEngine OpManager version 12.7.258 **Description** A directory traversal vulnerability exists in the uploadMib functionality, allowing an attacker to send a malicious MiB file and trigger the vulnerability, potentially leading to arbitrary file creation. This issue is related to incorrect restriction of a directory path name with limited access. Exploitation of the vulnerability may allow a remote attacker to execute arbitrary code. Approximately 6,971 devices are potentially affected, mainly distributed in China and the United States. **Recommendations** For ManageEngine OpManager version 12.7.258, consider disabling the uploadMib functionality until a patch is available to prevent exploitation. Restrict access to the uploadMib feature to minimize the risk of arbitrary file creation. Avoid using the uploadMib functionality with untrusted input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WPS Office version 11.2.0.11537 **Description** The issue is related to an uninitialized pointer use in the functionality that handles Data elements in an Excel file. This can be exploited by providing a specially crafted malformed file, potentially leading to remote code execution. An attacker can trigger this issue by providing a malicious file. **Recommendations** For WPS Office version 11.2.0.11537, consider avoiding the use of the affected Excel file handling functionality until a patch is available. As a temporary workaround, refrain from opening suspicious or untrusted Excel files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WebKitGTK versions 2.40.5 **Description** A use-after-free vulnerability exists in the MediaRecorder API of WebKitGTK, which can be exploited by a specially crafted web page to cause memory corruption and potentially arbitrary code execution. A user would need to visit a malicious webpage to trigger this vulnerability. **Recommendations** For WebKitGTK version 2.40.5, consider disabling the MediaRecorder API until a patch is available. Restrict access to the MediaRecorder API to minimize the risk of exploitation. Avoid using the MediaRecorder API in web pages until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Hancom Office 2020 HWord version 11.0.0.7520 **Description** A use-after-free issue exists in the footerr functionality. This can be triggered by a specially crafted .doc file, potentially allowing an attacker to exploit the vulnerability by tricking a user into opening a malformed file. **Recommendations** For Hancom Office 2020 HWord version 11.0.0.7520, consider avoiding the use of the footerr functionality until a patch is available. As a temporary workaround, restrict the opening of .doc files from untrusted sources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Excel (affected versions not specified) **Description** The issue is related to the use of memory after it has been freed due to insufficient input validation when processing an ElementType element. This can allow an attacker to execute arbitrary code or cause a denial of service by opening a specially crafted malicious file. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Excel (affected versions not specified) **Description** The issue is related to insufficient input validation in Microsoft Excel, allowing an attacker to execute arbitrary code using a specially crafted file. This can enable remote attackers to affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ManageEngine OpManager version 12.6.168 **Description** A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality. This issue is related to incorrect restriction of XML links to external objects. Exploitation of this vulnerability may allow a remote attacker to perform a Server-Side Request Forgery (SSRF) attack. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this vulnerability. **Recommendations** For ManageEngine OpManager version 12.6.168, consider disabling the `Add UCS Device` functionality until a patch is available to prevent potential SSRF attacks. Restrict access to the vulnerable functionality to minimize the risk of exploitation. Avoid using malicious XML files in the affected functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Lansweeper version 10.1.1.0 **Description** A directory traversal issue exists in the HelpdeskActions.aspx edittemplate functionality. This can be triggered by a specially-crafted HTTP request, potentially leading to arbitrary file upload. An attacker can exploit this by sending a crafted HTTP request. **Recommendations** For Lansweeper version 10.1.1.0, as a temporary workaround, consider restricting access to the HelpdeskActions.aspx edittemplate functionality until a patch is available. Avoid using this functionality in the affected version to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Lansweeper version 10.1.1.0 **Description** A cross-site scripting (xss) sanitization vulnerability bypass exists in the SanitizeHtml functionality. This allows an attacker to send a specially-crafted HTTP request, leading to arbitrary Javascript code injection. **Recommendations** For Lansweeper version 10.1.1.0, consider disabling the SanitizeHtml functionality until a patch is available to prevent arbitrary Javascript code injection. Restrict access to the SanitizeHtml functionality to minimize the risk of exploitation. Avoid using the SanitizeHtml functionality in HTTP requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Lansweeper version 10.1.1.0 **Description** A stored cross-site scripting issue exists in the HdConfigActions.aspx altertextlanguages functionality. This allows an attacker to inject arbitrary Javascript code using a specially-crafted HTTP request. The vulnerability can be triggered by sending a malicious HTTP request. **Recommendations** For Lansweeper version 10.1.1.0, as a temporary workaround, consider restricting access to the HdConfigActions.aspx page until a patch is available. Avoid using the altertextlanguages functionality in the meantime to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Lansweeper version 10.1.1.0 **Description** A directory traversal issue exists in the TicketTemplateActions.aspx GetTemplateAttachment functionality. This allows an attacker to send a specially-crafted HTTP request, potentially leading to arbitrary file read. **Recommendations** For Lansweeper version 10.1.1.0, consider restricting access to the TicketTemplateActions.aspx page until a fix is available. As a temporary workaround, avoid using the GetTemplateAttachment functionality to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Lansweeper version 10.1.1.0 **Description** A directory traversal issue exists in the KnowledgebasePageActions.aspx ImportArticles functionality. This can be triggered by a specially-crafted HTTP request, leading to arbitrary file read. An attacker can exploit this by sending a crafted HTTP request. **Recommendations** For Lansweeper version 10.1.1.0, as a temporary workaround, consider restricting access to the KnowledgebasePageActions.aspx ImportArticles functionality until a patch is available. Avoid using this functionality in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.