Michele Spagnuolo

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** Memory corruption occurs when the system attempts to allocate memory with sizes that exceed the maximum allowed value. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 Dell PowerProtect Data Domain versions 8.6.1.0 through 8.6.1.10 Dell PowerProtect Data Domain versions 8.3.1.0 through 8.3.1.30 Dell PowerProtect Data Domain versions 7.13.1.0 through 7.13.1.70 **Description** An OS Command Injection issue exists due to improper neutralization of special elements used in an OS command. A high privileged attacker with remote access could exploit this flaw to execute arbitrary commands on the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dell PowerFlex Manager versions prior to 5.1.0.1 Dell PowerFlex Manager versions prior to 4.5.5.2 **Description** An improper authentication issue allows an unauthenticated attacker with adjacent network access to bypass authentication without credentials or user interaction. Successful exploitation can lead to unauthorized high-impact write access to the system and may cause a denial of service. Adjacent network access means the attacker must be located on the same network segment or VLAN. **Recommendations** Upgrade to PowerFlex Software 5.1.0.1 or later. Upgrade to PowerFlex Software 4.5.5.2 or later for the 4.x branch.

**Name of the Vulnerable Software and Affected Versions** CAI Content Credentials versions c2pa-web@0.7.1 and earlier CAI Content Credentials versions c2pa-v0.80.1 and earlier **Description** Improper Input Validation allows an attacker to crash the application, resulting in a denial-of-service condition. This issue can be exploited without requiring any user interaction. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ColdFusion versions prior to 2023.20 ColdFusion versions prior to 2025.9 **Description** An improper limitation of a pathname to a restricted directory, known as Path Traversal, allows an attacker to bypass security features and access unauthorized files or directories outside of intended restrictions. Exploitation of this issue requires user interaction, specifically requiring a victim to open a malicious file. **Recommendations** Update ColdFusion to a version later than 2023.19. Update ColdFusion to a version later than 2025.8.

**Name of the Vulnerable Software and Affected Versions** WCFM Membership versions prior to 2.11.11 **Description** A missing authorization issue in the `wc-multivendor-membership` component allows for the exploitation of incorrectly configured access control security levels. **Recommendations** Update to a version later than 2.11.10.

**Name of the Vulnerable Software and Affected Versions** Arm ArmNN versions prior to 2026-03-28 **Description** An integer overflow exists in the `TensorShape::GetNumElements()` function within `armnn/Tensor.cpp`. This occurs when tensor dimensions are multiplied using 32-bit unsigned arithmetic without overflow detection, leading the `GetNumBytes()` function to return an understated allocation size. A crafted TFLite model file can exploit this to bypass buffer size validation, triggering a heap-based buffer over-read during model optimization. Specifically, the `BatchToSpaceNdLayer` reads beyond the allocated buffer during the `Optimize()->InferOutputShapes()` process. **Recommendations** Update to a version released after 2026-03-27.

**Name of the Vulnerable Software and Affected Versions** Adobe Commerce versions prior to 2.4.9-beta1 **Description** An improper authorization issue allows an attacker to bypass security features and obtain unauthorized write access. Exploitation requires user interaction, such as visiting a maliciously crafted URL or interacting with a compromised web page. **Recommendations** Update to a version newer than 2.4.9-beta1.

**Name of the Vulnerable Software and Affected Versions** Adobe Commerce versions prior to 2.4.9-beta1 **Description** A stored Cross-Site Scripting (XSS) issue allows a high-privileged attacker to inject malicious scripts into vulnerable form fields. These scripts execute in the browser of a victim who visits the page containing the affected field. **Recommendations** Update to a version newer than 2.4.9-beta1.

**Name of the Vulnerable Software and Affected Versions** Adobe Commerce versions prior to 2.4.9-beta1 **Description** A stored Cross-Site Scripting (XSS) issue allows a high-privileged attacker to inject malicious scripts into vulnerable form fields. These scripts execute in the browser of a victim who visits the page containing the affected field. **Recommendations** Update to a version newer than 2.4.9-beta1.

**Name of the Vulnerable Software and Affected Versions** Adobe Commerce versions prior to 2.4.9-beta1 **Description** An uncontrolled resource consumption issue exists that could lead to an application denial-of-service. An attacker can exploit this to exhaust system resources, causing the application to become unavailable. This exploitation does not require user interaction. **Recommendations** Update to a version newer than 2.4.9-beta1.

**Name of the Vulnerable Software and Affected Versions** Adobe Commerce versions prior to 2.4.9-beta1 **Description** An incorrect authorization issue allows an attacker to bypass security features and gain unauthorized write access. This exploitation does not require any user interaction. **Recommendations** Update to a version newer than 2.4.9-beta1.

**Name of the Vulnerable Software and Affected Versions** Adobe Commerce versions prior to 2.4.9-beta1 **Description** A dependency on a vulnerable third-party component could result in an application denial-of-service. An attacker could exploit this issue to crash the application without requiring any user interaction. **Recommendations** Update to a version newer than 2.4.9-beta1.

**Name of the Vulnerable Software and Affected Versions** Dell/Alienware Purchased Apps versions prior to 1.1.31.0 **Description** An improper link resolution before file access, also known as link following, allows a low privileged attacker with local access to perform an arbitrary file write. Link following occurs when a program follows a symbolic link to a file or directory without verifying if the link points to an intended location. **Recommendations** Update to version 1.1.31.0 or later.

**Name of the Vulnerable Software and Affected Versions** Dell iDRAC10 version 1.20.70.50 Dell iDRAC10 version 1.30.05.10 **Description** An insufficiently protected credentials issue exists due to a race condition, which is a situation where the system's substantive behavior is dependent on the sequence or timing of other uncontrollable events. This could allow an authenticated low-privileged attacker to gain elevated access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Bridge versions 16.0.2 and earlier Bridge versions 15.1.4 and earlier **Description** A Heap-based Buffer Overflow occurs when an application writes more data to a heap-allocated memory block than it can hold. This issue could result in arbitrary code execution in the context of the current user and requires user interaction, specifically that a victim opens a malicious file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** InDesign Desktop versions 20.5.2 and 21.2 and earlier **Description** A Heap-based Buffer Overflow occurs when a program writes more data to a heap-allocated memory block than it can hold. This issue could result in arbitrary code execution in the context of the current user and requires user interaction, specifically the opening of a malicious file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dell PowerProtect Data Domain versions 8.5 through 8.6 **Description** Improper neutralization of special elements used in an OS command allows a high privileged attacker with remote access to execute arbitrary commands with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** InDesign Desktop versions 20.5.2 and 21.2 and earlier **Description** A Use After Free issue exists where the software continues to use a pointer after it has been freed. This could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, specifically the opening of a malicious file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FortiSOAR PaaS versions 7.6.0 through 7.6.3 FortiSOAR PaaS versions 7.5.0 through 7.5.2 FortiSOAR PaaS versions 7.4 FortiSOAR PaaS versions 7.3 FortiSOAR on-premise versions 7.6.0 through 7.6.3 FortiSOAR on-premise versions 7.5.0 through 7.5.2 FortiSOAR on-premise versions 7.4 FortiSOAR on-premise versions 7.3 **Description** An improper neutralization of input during web page generation allows an authenticated remote attacker to perform a stored cross-site scripting (XSS) attack via crafted HTTP Requests. XSS is a flaw where malicious scripts are injected into otherwise benign and trusted websites. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.