Phil Purviance

**Name of the Vulnerable Software and Affected Versions** ArubaOS (affected versions not specified) **Description** The issue is related to insufficient protection of the web page structure in the ArubaOS web management interface. This could allow a remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. A successful exploit could enable an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco Adaptive Security Appliance Software (ASA) and Cisco Firepower Threat Defense (FTD) (affected versions not specified) **Description** The issue is related to a buffer overflow due to insufficient boundary checks for specific data provided to the web services interface. This could allow an authenticated, remote attacker to cause a buffer overflow on an affected system by sending a malicious HTTP request, potentially disclosing data fragments or causing the device to reload, resulting in a denial of service (DoS) condition. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Demand Media Pluck SiteLife versions prior to 5.0.13 **Description** The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via several parameters, including the `jsonRequest` parameter to "Direct/Process", the `r` or `cb` parameter to "Direct/jsonp.htm", or the `cb` parameter to "sys/jsonp.app/.htm". **Recommendations** For versions prior to 5.0.13, update to version 5.0.13 or later to resolve the issue.