Niv Levy

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands on Db2 clients due to a stack-based buffer overflow that improperly copies user-controlled data into a fixed-size stack buffer without bounds checking.

**Name of the Vulnerable Software and Affected Versions** MOVEit Transfer versions prior to 2025.1.5 MOVEit Transfer versions 2026.0.0 through 2026.0.2 **Description** An improper authentication issue exists in Progress MOVEit Transfer, which may allow an attacker to bypass authentication mechanisms. **Recommendations** Update to version 2025.1.5 or later. Update to version 2026.0.3 or later.

**Name of the Vulnerable Software and Affected Versions** MOVEit Transfer versions prior to 2025.0.7 MOVEit Transfer versions 2025.1.0 through 2025.1.2 **Description** A relative path traversal issue exists within the Admin Settings module. Path traversal is a flaw that allows an attacker to access files and directories that are stored outside the web root folder by manipulating variables that control a file path. **Recommendations** Update to version 2025.0.7 or newer. Update to version 2025.1.3 or newer.

**Name of the Vulnerable Software and Affected Versions** MOVEit Transfer versions prior to 2025.0.7 MOVEit Transfer versions 2025.1.0 through 2025.1.2 **Description** An issue exists in the Custom Reports modules involving improper neutralization of special elements in data query logic. This flaw can lead to the manipulation of data queries. **Recommendations** Update MOVEit Transfer to version 2025.0.7 or later. Update MOVEit Transfer to version 2025.1.3 or later.

**Name of the Vulnerable Software and Affected Versions** MOVEit Transfer versions prior to 2025.0.7 MOVEit Transfer versions 2025.1.0 through 2025.1.2 **Description** A limited authentication bypass by spoofing exists within the HTTPS module of the software. **Recommendations** Update to version 2025.0.7 or later. Update to version 2025.1.3 or later.

**Name of the Vulnerable Software and Affected Versions** MOVEit Transfer versions prior to 2025.0.7 MOVEit Transfer versions 2025.1.0 through 2025.1.2 **Description** An incorrect authorization issue exists within the Audit User module, which may allow unauthorized access or actions. **Recommendations** Update to version 2025.0.7 or later. Update to version 2025.1.3 or later.

**Name of the Vulnerable Software and Affected Versions** SysAid versions prior to 23.2.14 b18 **Description** The issue allows for Server-Side Request Forgery (SSRF), which may expose the local OS user's NTLMv2 hash. **Recommendations** For versions prior to 23.2.14 b18, update to version 23.2.14 b18 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive resources to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Sysaid (affected versions not specified) **Description** The issue allows authenticated users to exfiltrate files from the server via an unspecified method. This is related to files or directories being accessible to external parties. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sysaid (affected versions not specified) **Description** A malicious user with administrative privileges may be able to upload a dangerous filetype via an unspecified method. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Guacamole versions 0.9.8 through 0.9.9 **Description** A cross-site scripting (XSS) issue exists in the file browser when file transfer is enabled to a shared location. This allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename. **Recommendations** For Guacamole versions 0.9.8 and 0.9.9, update the guacamole.war file to the version fixed on 2016-01-13 to resolve the issue.