Michael Wollner

**Name of the Vulnerable Software and Affected Versions** Rancher Manager versions prior to 2.14.2 **Description** A command injection issue exists in the import endpoint "/v3/import/{token} {clusterId}.yaml". This occurs due to unsanitized YAML parameters, which could allow remote attackers to break out of an image and execute malicious containers. **Recommendations** Update to version 2.14.2 or later.

**Name of the Vulnerable Software and Affected Versions** IBM Maximo Asset Management versions 7.6.0.1 through 7.6.0.2 **Description** The issue allows a remote attacker to expose sensitive information or consume memory resources through an XML External Entity Injection (XXE) attack when processing XML data. **Recommendations** For versions 7.6.0.1 and 7.6.0.2, consider disabling XML processing or restricting access to sensitive information until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.