Mariusz Popławski

**Name of the Vulnerable Software and Affected Versions** Observium Professional, Enterprise & Community version 20.8.10631 **Description** An issue was discovered that allows Cross-Site Scripting (XSS) due to the possibility of injecting and storing malicious JavaScript code. This can occur via the `la id` variable to the "/syslog rules" URI for `delete syslog rule`, because of `syslog rules.inc.php`. **Recommendations** For Observium Professional, Enterprise & Community version 20.8.10631, consider restricting access to the `syslog rules.inc.php` file and the `/syslog rules` URI to minimize the risk of exploitation. Avoid using the `la id` variable in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Observium Professional, Enterprise & Community version 20.8.10631 **Description** The issue allows for SQL Injection due to the possibility of injecting malicious SQL statements through malformed parameter types. Specifically, sending an improper variable type of Array bypasses core SQL Injection sanitization, enabling authenticated users to inject malicious SQL queries. This can lead to a full database leak, including ckeys that can be used in the authentication process without knowing the username and cleartext password, via the "ajax/actions.php" endpoint, particularly through the `group id` field. **Recommendations** For Observium Professional, Enterprise & Community version 20.8.10631, consider disabling access to the "ajax/actions.php" endpoint until a patch is available, or restrict the `group id` field to prevent malicious SQL injections. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Observium Professional, Enterprise & Community version 20.8.10631 **Description** The issue allows for Cross-Site Scripting (XSS) due to the ability to inject and store malicious JavaScript code. This can occur via the `role name` or `role descr` parameter to the "roles/" URI. **Recommendations** For Observium Professional, Enterprise & Community version 20.8.10631, avoid using the `role name` or `role descr` parameter in the "roles/" URI until the issue is resolved. As a temporary workaround, consider restricting access to the roles/ URI to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Observium Professional, Enterprise & Community version 20.8.10631 **Description** An issue in Observium allows SQL Injection due to the possibility of injecting malicious SQL statements through malformed parameter types. Specifically, sending an improper variable type `Array` bypasses core SQL Injection sanitization, enabling users to inject malicious statements in multiple functions. This leads to full authentication bypass, allowing any unauthorized user with access to the application to exploit the issue. The vulnerability can be exploited via the `Cookie` header to the default URI, within the `includes/authenticate.inc.php` file. **Recommendations** For Observium Professional, Enterprise & Community version 20.8.10631, consider disabling the authentication functionality temporarily until a patch is available to prevent exploitation. Restrict access to the `includes/authenticate.inc.php` file to minimize the risk of exploitation. Avoid using the `Cookie` header with malicious input in the default URI until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Observium Professional, Enterprise & Community version 20.8.10631 **Description** The issue concerns directory traversal and local file inclusion, allowing unrestricted loading of files with the inc.php extension. This can lead to Remote Code Execution. The vulnerability can be exploited via the "/ports/?format=../" URI, affecting pages such as "pages/ports.inc.php". **Recommendations** For Observium Professional, Enterprise & Community version 20.8.10631, restrict access to the `/ports/` endpoint to minimize the risk of exploitation. Avoid using the `format` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Observium Professional, Enterprise & Community version 20.8.10631 **Description** An issue in the software allows for directory traversal and local file inclusion due to unrestricted file loading with an inc.php extension. This can lead to Remote Code Execution. The issue can be exploited via the "/settings/?format=../" URI to access pages/settings.inc.php. **Recommendations** For version 20.8.10631, consider restricting access to the `/settings/` endpoint to minimize the risk of exploitation. As a temporary workaround, limit the ability to load files with the inc.php extension until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Observium Professional, Enterprise & Community version 20.8.10631 **Description** An issue was discovered that allows Cross-Site Scripting (XSS) due to the possibility of injecting and storing malicious JavaScript code. This can occur via the `graph title` parameter to the "graphs/" URI. **Recommendations** For Observium Professional, Enterprise & Community version 20.8.10631, avoid using the `graph title` parameter in the "graphs/" URI until the issue is resolved. As a temporary workaround, consider restricting access to the graphs/ URI to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Observium Professional, Enterprise & Community version 20.8.10631 **Description** The issue allows for directory traversal and local file inclusion due to the unrestricted possibility of loading any file with an `inc.php` extension. This can lead to Remote Code Execution. The vulnerability can be exploited via URIs such as "/device/device=345/?tab=routing&proto=../" to access files like "device/routing.inc.php". **Recommendations** For Observium Professional, Enterprise & Community version 20.8.10631, restrict access to files with the `inc.php` extension to minimize the risk of exploitation. As a temporary workaround, consider disabling the loading of external files with the `inc.php` extension until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Observium Professional, Enterprise & Community version 20.8.10631 **Description** An issue was discovered that allows for Cross-Site Scripting (XSS) due to the ability to inject and store malicious JavaScript code. This can occur via the `alert name` or `alert message` parameter to the "/alert check" URI. **Recommendations** For Observium Professional, Enterprise & Community version 20.8.10631, avoid using the `alert name` and `alert message` parameters in the "/alert check" URI until a fix is available. As a temporary workaround, consider restricting access to the "/alert check" URI to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Observium Professional, Enterprise & Community version 20.8.10631 **Description** An issue was discovered that allows for Cross-Site Scripting (XSS) due to the ability to inject and store malicious JavaScript code. This can occur via the "/alert check/action=delete alert checker/alert test id=" endpoint because of the pages/alert check.inc.php file. **Recommendations** For Observium Professional, Enterprise & Community version 20.8.10631, as a temporary workaround, consider restricting access to the /alert check/action=delete alert checker/alert test id= endpoint until a patch is available. Avoid using this endpoint with untrusted input to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Afterlogic WebMail Pro version 8.3.11 Afterlogic Aurora version 8.3.11 **Description** The issue allows for Remote Stored XSS via an attachment name. **Recommendations** For Afterlogic WebMail Pro version 8.3.11, update to a version that fixes the issue. For Afterlogic Aurora version 8.3.11, update to a version that fixes the issue.