Michael Henry

**Name of the Vulnerable Software and Affected Versions** Cisco AnyConnect Secure Mobility Client (affected versions not specified) **Description** A vulnerability in the upgrade component could allow an authenticated, local attacker with low privileges to read arbitrary files on the underlying operating system of an affected device. The issue is due to insufficient file permission restrictions. An attacker could exploit this by sending a crafted command from the local CLI to the application, allowing them to read arbitrary files on the underlying OS. The attacker would need valid user credentials to exploit this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenBMC phosphor-host-ipmid versions prior to 2020-04-03 **Description** The issue arises from the `user channel/passwd mgr.cpp` file in OpenBMC phosphor-host-ipmid, which does not ensure that the `/etc/ipmi-pass` file has strong file permissions. This could potentially lead to unauthorized access. **Recommendations** For versions prior to 2020-04-03, ensure that the `/etc/ipmi-pass` file has strong file permissions to mitigate the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Intel(R) Graphics Performance Analyzer for Linux version 18.4 and before **Description** The issue is related to insufficient path checking in the installation package, which may allow an authenticated user to potentially enable escalation of privilege via local access. It is also described as a vulnerability related to insufficient access restriction, which can be exploited to elevate privileges. **Recommendations** For Intel(R) Graphics Performance Analyzer for Linux version 18.4 and before, consider restricting local access to minimize the risk of exploitation until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.