Nguyen Quoc Viet

**Name of the Vulnerable Software and Affected Versions** Zoho ManageEngine ADManager Plus versions prior to Build 7200 **Description** The issue is related to insufficient access control in the Zoho ManageEngine ADManager Plus software for managing Active Directory services. It allows a remote attacker to execute arbitrary commands with superuser privileges. Admin users can execute commands on the host machine. **Recommendations** For Zoho ManageEngine ADManager Plus versions prior to Build 7200, update to Build 7200 or later to resolve the issue. As a temporary workaround, consider restricting access to the `installServiceWithCredentials` command to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Inductive Automation Ignition (affected versions not specified) **Description** This issue allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. The specific flaw exists within the `ResponseParser` method, resulting from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. User interaction is required to exploit this vulnerability, as the target must connect to a malicious server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Inductive Automation Ignition (affected versions not specified) **Description** The issue is related to the Base64Element class in Inductive Automation Ignition, which has flaws in its deserialization mechanism. This allows remote attackers to execute arbitrary code on affected installations. The problem stems from the lack of proper validation of user-supplied data, leading to the deserialization of untrusted data. An attacker can exploit this to execute code in the context of SYSTEM. Authentication is required to exploit this vulnerability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Inductive Automation Ignition (affected versions not specified) **Description** The issue is related to the deserialization mechanism in the RunQuery class of Inductive Automation Ignition, allowing remote attackers to execute arbitrary code on affected installations. The problem stems from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Authentication is required to exploit this vulnerability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Inductive Automation Ignition (affected versions not specified) **Description** This issue allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. The specific flaw exists within the ModuleInvoke class, resulting from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Authentication is required to exploit this vulnerability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disabling the `ModuleInvoke` class until a patch is available. Restrict access to the vulnerable `ModuleInvoke` class to minimize the risk of exploitation. Avoid using untrusted data in the `ModuleInvoke` class until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Pfsense version 2.1.3 Pfsense Suricata version 1.4.6 pkg version 1.0.1 **Description** A Directory Traversal issue allows a remote attacker to obtain sensitive information via the `file` parameter to the "suricata/suricata logs browser.php" endpoint. This enables access to files outside the intended directory, potentially revealing confidential data. **Recommendations** For Pfsense version 2.1.3, update to a version that fixes this issue. For Pfsense Suricata version 1.4.6 pkg version 1.0.1, update to a version that fixes this issue. As a temporary workaround, consider restricting access to the "suricata/suricata logs browser.php" endpoint to minimize the risk of exploitation.