Oded Vanunu

Name of the Vulnerable Software and Affected Versions: Microsoft Teams for iOS (affected versions not specified) Description: The issue is related to errors in the representation of information by the user interface, which can be exploited by a remote attacker to conduct spoofing attacks. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IntelliJ IDEA (affected versions not specified) **Description** The IntelliJ IDEA XML parser is susceptible to an XML External Entity attack. An attacker can exploit this issue by implementing malicious code in the AndroidManifest.xml file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Eclipse XML parser for the Eclipse IDE versions 2017.2.5 and earlier **Description** The Eclipse XML parser for the Eclipse IDE was found vulnerable to an XML External Entity attack. An attacker can exploit this issue by implementing malicious code on the `Androidmanifest.xml` file. **Recommendations** For Eclipse XML parser for the Eclipse IDE versions 2017.2.5 and earlier, update to a version later than 2017.2.5 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Cisco FireSIGHT System Software versions 5.4.0 through 6.0.1 ASA with FirePOWER Services versions 5.4.0 through 6.0.0.1 **Description** The issue allows remote attackers to bypass malware protection. This is achieved via crafted fields in HTTP headers. **Recommendations** For Cisco FireSIGHT System Software versions 5.4.0 through 6.0.1, update to a version outside of this range to resolve the issue. For ASA with FirePOWER Services versions 5.4.0 through 6.0.0.1, update to a version outside of this range to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Palo Alto Networks PAN-OS versions prior to 5.0.15 Palo Alto Networks PAN-OS versions 5.1.x prior to 5.1.10 Palo Alto Networks PAN-OS versions 6.0.x prior to 6.0.6 **Description** A cross-site scripting issue exists in the web-based device management interface, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. This occurs because data provided by the user is echoed back without sanitization, potentially tricking an authenticated administrator into injecting malicious JavaScript into the web UI interface. **Recommendations** For versions prior to 5.0.15, update to version 5.0.15 or later. For versions 5.1.x prior to 5.1.10, update to version 5.1.10 or later. For versions 6.0.x prior to 6.0.6, update to version 6.0.6 or later.