Matteo Brutti

Name of the Vulnerable Software and Affected Versions: Wowza Streaming Engine versions 4.8.11+5 through 4.8.13 Description: A Cross-Site Request Forgery (CSRF) issue allows a remote attacker to delete a user account via the "/enginemanager/server/user/delete.htm" API endpoint using the `userName` parameter. The application does not implement a CSRF token for the GET request. Recommendations: For versions 4.8.11+5 through 4.8.13, update to Wowza Streaming Engine release 4.8.14 to resolve the issue. As a temporary workaround, consider restricting access to the "/enginemanager/server/user/delete.htm" API endpoint to minimize the risk of exploitation. Avoid using the `userName` parameter in the affected API endpoint until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: IBM InfoSphere Information Server version 8.5.0.0 Description: The issue is related to the deserialization of untrusted data, which could allow remote unauthenticated attackers to execute arbitrary code. This problem only affects products that are no longer supported by the maintainer. Recommendations: For IBM InfoSphere Information Server version 8.5.0.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.