Michele Damico

**Name of the Vulnerable Software and Affected Versions** ArcGIS Server versions prior to 12.0 **Description** An unrestricted file upload issue exists where an unauthenticated attacker can upload a crafted file to the affected endpoint. This could allow for arbitrary file upload, potentially enabling further attacks. **Recommendations** Update ArcGIS Server to version 12.0 or later.

**Name of the Vulnerable Software and Affected Versions** UniFi Network Application (affected versions not specified) **Description** An Improper Access Control issue exists that allows a malicious actor with network access and low privileges to escalate their privileges within the application under certain conditions. Improper Access Control occurs when an application fails to properly restrict access to sensitive functions or data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Campaign Classic versions prior to 7.4.3 build 9396 **Description** An incorrect authorization issue exists that allows for arbitrary code execution in the context of the current user. This flaw does not require user interaction to be exploited. **Recommendations** Update to a version newer than 7.4.3 build 9396.

**Name of the Vulnerable Software and Affected Versions** Dell PowerFlex Manager versions prior to 4.8 **Description** An unauthenticated attacker with remote access can exploit the inclusion of functionality from an untrusted control sphere, which may lead to information disclosure. **Recommendations** Update to version 4.8 or later.

**Name of the Vulnerable Software and Affected Versions** Dell PowerFlex Manager (affected versions not specified) **Description** An improper neutralization of special elements used in an SQL command allows a low privileged attacker with adjacent network access to perform SQL injection, which could potentially lead to script injection. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dell PowerFlex Manager (affected versions not specified) **Description** Improper Access Control allows a low privileged attacker with remote access to potentially cause a denial of service, a condition where the system becomes unavailable to its intended users. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dell PowerFlex Manager (affected versions not specified) **Description** An improper neutralization of special elements used in an SQL command, known as SQL Injection, allows a low privileged attacker with adjacent network access to potentially cause information disclosure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dell PowerFlex Manager version 4.6.0.1 **Description** Use of a broken or risky cryptographic algorithm allows an unauthenticated attacker with remote access to potentially cause information disclosure and information tampering. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dell PowerFlex Manager versions prior to 5.1.0.1 **Description** An improper access control issue exists where a low privileged attacker with adjacent network access could potentially exploit the flaw to achieve elevation of privileges and gain unauthorized access. **Recommendations** Update Dell PowerFlex Manager to version 5.1.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** Dell PowerFlex Manager (affected versions not specified) **Description** Improper Access Control allows a low privileged attacker with remote access to potentially cause a denial of service, a condition where the system becomes unavailable to its intended users. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Commerce versions prior to 2.4.9-beta1 **Description** An uncontrolled resource consumption issue exists that could lead to an application denial-of-service. An attacker can exploit this to exhaust system resources, causing the application to become unavailable. This process does not require any user interaction. **Recommendations** Update to a version newer than 2.4.9-beta1.

**Name of the Vulnerable Software and Affected Versions** Dell ECS versions 3.8.1.0 through 3.8.1.7 Dell ObjectScale versions prior to 4.3.0.0 **Description** An issue involving the use of hard-coded credentials allows an unauthenticated attacker with local access to potentially gain filesystem access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dell PowerProtect Data Domain versions 7.7.1.0 through 8.5 Dell PowerProtect Data Domain versions 8.3.1.0 through 8.3.1.20 Dell PowerProtect Data Domain versions 7.13.1.0 through 7.13.1.50 **Description** The Data Domain Operating System (DD OS) contains a use of weak credentials. An unauthenticated attacker with local access could potentially exploit this issue to gain unauthorized access to the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Framemaker versions prior to 2022.9 **Description** A Heap-based Buffer Overflow exists, which is a condition where a program writes more data to a heap-allocated memory block than it can hold, potentially overwriting adjacent memory. This flaw could lead to memory exposure, allowing an attacker to disclose sensitive information stored in memory. Exploitation requires user interaction, specifically requiring a victim to open a malicious file. **Recommendations** Update to a version newer than 2022.8.

**Name of the Vulnerable Software and Affected Versions** InDesign Desktop versions 20.5.2 and 21.2 and earlier **Description** A Heap-based Buffer Overflow occurs when a program writes more data to a heap-allocated memory block than it can hold. This issue could result in arbitrary code execution in the context of the current user and requires user interaction, specifically the opening of a malicious file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Bridge versions 16.0.2 and earlier Bridge versions 15.1.4 and earlier **Description** A Heap-based Buffer Overflow (a condition where a program writes more data to a heap-allocated memory block than it can hold) could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, specifically that a victim opens a malicious file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FortiSOAR PaaS versions 7.6.0 through 7.6.3 FortiSOAR PaaS versions 7.5.0 through 7.5.2 FortiSOAR PaaS versions 7.4 FortiSOAR PaaS versions 7.3 FortiSOAR on-premise versions 7.6.0 through 7.6.2 FortiSOAR on-premise versions 7.5.0 through 7.5.1 FortiSOAR on-premise versions 7.4 FortiSOAR on-premise versions 7.3 **Description** A cleartext transmission of sensitive information issue in the graphical user interface of the cybersecurity orchestration and real-time incident response management software may allow an authenticated remote attacker to view user passwords in cleartext. This occurs specifically in responses for Secure Message Exchange and Radius queries when configured. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions 7.7.1.0 through 8.5 Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions 8.3.1.0 through 8.3.1.20 Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions 7.13.1.0 through 7.13.1.50 **Description** An exposure of sensitive information to an unauthorized actor exists. A low privileged attacker with remote access could potentially exploit this issue, leading to information exposure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Experience Manager versions prior to 6.5.24, FP11.7 **Description** A DOM-based Cross-Site Scripting (XSS) issue exists where an attacker can manipulate the Document Object Model (DOM) environment to execute malicious JavaScript in the victim's browser. This requires the victim to visit a specially crafted webpage. **Recommendations** Update to a version later than 6.5.24, FP11.7.

Name of the Vulnerable Software and Affected Versions Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.6 and versions 9.11.0.0 through 9.13.0.0 Description A high privileged attacker with local access could potentially exploit a vulnerability that results in the generation of error messages containing sensitive information. This could lead to information disclosure. Recommendations Update to a version beyond 9.13.0.0