Massimiliano Brolli

An unrestricted upload of files with dangerous type vulnerability in the Microchip TimePictra platform allows functionality not properly constrained by access control lists, potentially resulting in remote code execution.

A hard-coded root password in Microchip TimePictra platform installation files could allow an attacker with access to those files to obtain privileged credentials

A stored cross-site scripting vulnerability in Microchip the TimePictra platform could allow an authenticated, low-privileged attacker to store malicious script content that executes when another user views the affected page

An issue exists in the Console component of the WebLogic Server. A low privileged attacker with network access via HTTPS can compromise the server, provided there is human interaction from a person other than the attacker. This can lead to unauthorized access, creation, deletion, or modification of critical data or all data accessible by the WebLogic Server. The impact may extend beyond the WebLogic Server to affect additional products.

The use of hard-coded credentials allows for a malicious manual software update.

An improper neutralization of special elements used in an OS command vulnerability exists in Microchip Time Provider 4100, allowing for OS command injection. This issue relates to remote code execution through the backup configuration password.

An improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Microchip Time Provider 4100. This allows for OS Command Injection. The issue relates to restoring the configuration password.

An improper neutralization of special elements used in an SQL command ('SQL Injection') issue exists in Microchip Time Provider 4100. This allows for SQL Injection. The vulnerability is present in the web resource. The `SQL` command is not properly sanitized, potentially allowing an attacker to inject malicious code.

A flaw exists in Microchip Time Provider 4100 that permits malicious manual software updates due to a missing integrity check during code download.

Eclipse GlassFish version 7.0.15 is susceptible to Stored Cross-site scripting attacks within the Administration Console.

Eclipse GlassFish version 7.0.15 is susceptible to Stored Cross-site scripting attacks within the Administration Console.

Eclipse GlassFish version 7.0.15 is susceptible to Reflected Cross-site scripting attacks within the Administration Console.

Eclipse GlassFish version 7.0.15 is susceptible to Stored Cross-site Scripting attacks. The attacks can be performed by modifying the configuration file within the underlying operating system.

Eclipse GlassFish is susceptible to login brute-force attacks due to the absence of restrictions on the number of failed login attempts.

Name of the Vulnerable Software and Affected Versions: Puppet Enterprise versions 2018.1.8 through 2023.8.3 Puppet Enterprise version 2025.3 Description: A user with specific node group editing permissions and a specially crafted `class parameter` could execute commands as root on the primary host. Recommendations: For Puppet Enterprise versions 2018.1.8 through 2023.8.3, update to version 2023.8.4. For Puppet Enterprise version 2025.3, update to version 2025.4.0.

The issue is related to the XML Database component, allowing a low-privileged attacker with network access via HTTP to compromise the XML Database. Successful attacks require human interaction and can result in unauthorized update, insert, or delete access to some XML Database accessible data, as well as unauthorized read access to a subset of XML Database accessible data.

The issue affects Payara Server, allowing remote code inclusion due to improper neutralization of input during web page generation, also known as cross-site scripting.

Name of the Vulnerable Software and Affected Versions: Italtel S.p.A. i-MCS NFV version 12.1.0-20211215 Description: The issue is a cross-site scripting (XSS) vulnerability that allows unauthenticated remote attackers to inject arbitrary web script or HTML into HTTP/POST parameters. This can be exploited by attackers to execute malicious scripts on the victim's browser. Recommendations: For Italtel S.p.A. i-MCS NFV version 12.1.0-20211215, consider restricting access to HTTP/POST parameters to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using vulnerable parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: BMC Remedy Mid Tier version 7.6.04 Description: The web application in BMC Remedy Mid Tier allows stored HTML Injection by authenticated remote attackers. Recommendations: For BMC Remedy Mid Tier version 7.6.04, consider restricting access to the web application until a patch is available. As a temporary workaround, limit the ability of authenticated remote attackers to inject HTML code. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A flaw was found in the Wildfly Elytron integration, where the component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame. This makes it more susceptible to brute force attacks via the Command Line Interface (CLI).