Mateusz Dabrowski

**Name of the Vulnerable Software and Affected Versions** Aruba Networks ClearPass Policy Manager (affected versions not specified) **Description** Vulnerabilities in the web-based management interface of ClearPass Policy Manager allow an attacker with read-only privileges to perform actions that change the state of the ClearPass Policy Manager instance. Successful exploitation of these vulnerabilities allow an attacker to complete state-changing actions in the web-based management interface that should not be allowed by their current level of authorization on the platform. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IBM WebSphere Application Server versions 8.5 through 9.0 **Description** The issue is related to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this to expose sensitive information or consume memory resources. **Recommendations** For IBM WebSphere Application Server versions 8.5 through 9.0, consider disabling XML processing or restricting access to sensitive data until a patch is available. As a temporary workaround, restrict the use of XML external entities to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** IBM WebSphere Application Server versions 8.5 through 9.0 **Description** The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session. This is due to a cross-site scripting vulnerability. **Recommendations** For IBM WebSphere Application Server versions 8.5 through 9.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IBM WebSphere Application Server version 9.0 **Description** The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session. **Recommendations** For IBM WebSphere Application Server version 9.0, update to a version that includes a fix for this issue to prevent cross-site scripting attacks.

**Name of the Vulnerable Software and Affected Versions** Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp versions 10.0.0.5 and below **Description** The issue allows users to perform actions for which they are not authorized due to an authorization bypass. **Recommendations** For versions 10.0.0.5 and below, update to a version above 10.0.0.5 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Veeam Management Pack for Microsoft System Center version 8.0 **Description** A reflected DOM-Based XSS issue exists due to inadequate protection of the web page structure. This could allow a remote attacker to conduct cross-site scripting attacks by convincing a legitimate user to visit a crafted URL on a Veeam Management Pack for Microsoft System Center server, enabling the execution of arbitrary scripts. **Recommendations** For Veeam Management Pack for Microsoft System Center version 8.0, consider restricting access to the Help directory until a patch is available. As a temporary workaround, avoid using crafted URLs that could exploit the reflected DOM-Based XSS vulnerability in the Help directory. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle BI Publisher versions 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 **Description** The issue is related to insufficient input validation in the Mobile Service component of Oracle BI Publisher, allowing an unauthenticated attacker with network access via HTTP to compromise the system. Successful attacks require human interaction and can result in unauthorized access to critical data, as well as unauthorized update, insert, or delete access to some data. The impact of the attack can be significant, affecting not only Oracle BI Publisher but also other products. **Recommendations** For versions 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0, consider restricting access to the Mobile Service component until a fix is available. As a temporary workaround, limit the use of HTTP protocol for sensitive operations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle BI Publisher versions 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 **Description** The issue is related to insufficient input validation in the Mobile Service component of Oracle BI Publisher, allowing an unauthenticated attacker with network access via HTTP to compromise the system. Successful attacks require human interaction and can significantly impact additional products, resulting in unauthorized access to critical data, complete access to all Oracle BI Publisher accessible data, as well as unauthorized update, insert, or delete access to some of Oracle BI Publisher accessible data. **Recommendations** For versions 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0, consider restricting access to the Mobile Service component until a patch is available. As a temporary workaround, consider disabling the Mobile Service component to minimize the risk of exploitation. Avoid using the affected Oracle BI Publisher product until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle BI Publisher versions 12.2.1.3.0 through 12.2.1.4.0 **Description** The issue is related to the BI Publisher Security component of Oracle BI Publisher, allowing an unauthenticated attacker with network access via HTTP to compromise the system. Successful attacks require human interaction and can significantly impact additional products, resulting in unauthorized access to critical data, complete access to all Oracle BI Publisher accessible data, as well as unauthorized update, insert, or delete access to some of Oracle BI Publisher accessible data. The vulnerability can be exploited to perform a cross-site scripting attack. **Recommendations** For versions 12.2.1.3.0 and 12.2.1.4.0, consider applying security measures to protect the web page structure, and ensure proper validation and sanitization of user input to prevent cross-site scripting attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle Financial Services Analytical Applications Infrastructure versions 8.0.6 through 8.1.0 **Description** The issue is related to insufficient access controls in the Infrastructure component of Oracle Financial Services Analytical Applications Infrastructure. This allows a low-privileged attacker with network access via HTTP to compromise the system. Successful attacks can result in unauthorized access to critical data, including creation, deletion, or modification of data. **Recommendations** For versions 8.0.6 through 8.1.0, consider restricting access to the Infrastructure component until a fix is available. As a temporary workaround, limit the use of HTTP protocol for remote access to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenable.Sc versions prior to 5.14.0 **Description** The issue allows an authenticated remote attacker to execute arbitrary script code in a user's browser session through a stored XSS attack. Updated input validation techniques have been implemented to correct this issue. **Recommendations** For versions prior to 5.14.0, update to version 5.14.0 or later to resolve the issue.