Mazin Faour

Name of the Vulnerable Software and Affected Versions: VeriSign Kontiki Delivery Management System (DMS) versions 5.0 and earlier Description: A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the `action` parameter to "zodiac/servlet/zodiac". Recommendations: For versions 5.0 and earlier, avoid using the `action` parameter in the "zodiac/servlet/zodiac" endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** NetPublish Server version 7 **Description** A directory traversal issue exists, allowing remote attackers to read arbitrary files by using "../" sequences in the `template` parameter. **Recommendations** For NetPublish Server version 7, consider restricting access to the `server.np` component until a patch is available. As a temporary workaround, avoid using the `template` parameter with "../" sequences to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Sygate Secure Enterprise versions 3.5 through 4.1 **Description** The issue allows local users to modify the security policy by exporting the policy file, changing it, and importing it back into the system, due to the lack of prevention of security policy updates by unprivileged users. **Recommendations** For Sygate Secure Enterprise versions 3.5 through 4.1, consider restricting access to the policy file to prevent unprivileged users from modifying the security policy until a fix is available.