Piotr Bazydlo

**Name of the Vulnerable Software and Affected Versions** IBM Engineering Lifecycle Management versions 7.0.3 Interim Fix 001 through Interim Fix 021 IBM Engineering Lifecycle Management versions 7.1.0 Interim Fix 001 through Interim Fix 009 IBM Engineering Lifecycle Management versions 7.2.0 through 7.2.0 Interim Fix 001 **Description** An XML external entity (XXE) injection occurs when processing XML data, which is a technique where an application processes external entities within an XML document. An authenticated attacker can exploit this to expose sensitive information or consume memory resources. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IBM Engineering Lifecycle Management versions 7.0.3 through Interim Fix 021 IBM Engineering Lifecycle Management versions 7.1.0 through Interim Fix 009 IBM Engineering Lifecycle Management versions 7.2.0 through Interim Fix 001 **Description** An unauthenticated remote attacker can update server property files, which may lead to unauthorized access to the application. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions Authenticated user can upload a malicious file to the server and execute it, which leads to remote code execution. Description An authenticated user is able to upload a malicious file to the server and subsequently execute it, resulting in remote code execution. The affected API endpoint is not specified. The vulnerable parameter is not specified. The vulnerable function is not specified. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Hyland Alfresco Transformation Service (affected versions not specified) **Description** An unauthenticated attacker can perform server-side request forgery (SSRF) via the document processing functionality. SSRF occurs when an application makes requests to an internal or external resource on behalf of a user, and an attacker can manipulate the request to access unintended resources. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Hyland Alfresco (affected versions not specified) **Description** An unauthenticated attacker can read arbitrary files from protected directories, such as WEB-INF, by accessing the `/share/page/resource/` API endpoint. This can lead to the disclosure of sensitive configuration files. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Hyland Alfresco Transformation Service (affected versions not specified) **Description** The Hyland Alfresco Transformation Service is susceptible to exploitation allowing unauthenticated attackers to perform arbitrary file read and server-side request forgery (SSRF) through absolute path traversal. The vulnerability allows attackers to access files and potentially manipulate server-side requests. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Hyland Alfresco Transformation Service (affected versions not specified) **Description** The Hyland Alfresco Transformation Service contains a flaw that enables unauthenticated attackers to execute code remotely. This issue stems from an argument injection weakness within the document processing functionality. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: SmarterTools SmarterMail versions prior to build 9511 Description: SmarterTools SmarterMail contains an authentication bypass vulnerability in the password reset API. The `force-reset-password` endpoint at `/api/v1/admin/force-reset-password` permits anonymous requests and does not verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator `username` and a new `password` to reset the account, resulting in full administrative compromise of the SmarterMail instance. SmarterMail system administrator privileges grant the ability to execute operating system commands. This vulnerability has been actively exploited in the wild, with reports of Warlock ransomware operators gaining access and moving laterally through networks. Approximately 6,000 instances were identified as potentially vulnerable. Exploitation involves resetting admin passwords and leveraging built-in features for remote code execution. Recommendations: Upgrade to build 9511 or later immediately. Restrict API access via IP allowlisting. Deploy a Web Application Firewall (WAF) for the `/force-reset-password` endpoint. Implement geo-blocking for admin interfaces. Review access logs for external POST requests, unauthorized admin changes, and new account creations. Rotate exposed credentials.

**Name of the Vulnerable Software and Affected Versions** Barracuda Service Center versions prior to 2025.1.1 **Description** Barracuda Service Center, as implemented in the RMM solution, does not validate the URL specified in a WSDL file controlled by an attacker, which is subsequently loaded by the application. This can result in arbitrary file writing and remote code execution through webshell uploads. **Recommendations** Update Barracuda Service Center to version 2025.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Barracuda Service Center versions prior to 2025.1.1 **Description** The Barracuda Service Center, as part of the RMM solution, has a .NET Remoting service exposed that allows an unauthenticated attacker to invoke a method susceptible to path traversal, enabling the reading of arbitrary files. This can be further exploited to achieve remote code execution by obtaining the .NET machine keys. **Recommendations** Update Barracuda Service Center to version 2025.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Barracuda Service Center versions prior to 2025.1.1 **Description** The Barracuda Service Center, within the RMM solution, improperly validates the name of a WSDL service controlled by an attacker. This insecure reflection can lead to remote code execution through arbitrary method invocation or deserialization of untrusted types. **Recommendations** Update Barracuda Service Center to version 2025.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Sitecore Experience Manager (XM) versions 9.2 through 10.4 Sitecore Experience Platform (XP) versions 9.2 through 10.4 **Description** A flaw exists that can lead to the exposure of sensitive information to an unauthorized actor in Sitecore Experience Manager (XM) and Sitecore Experience Platform (XP). **Recommendations** Update Sitecore Experience Manager (XM) to a version later than 10.4. Update Sitecore Experience Platform (XP) to a version later than 10.4.

**Name of the Vulnerable Software and Affected Versions** Sitecore Experience Manager (XM) versions 9.0 through 9.3, 10.0 through 10.4 Sitecore Experience Platform (XP) versions 9.0 through 9.3, 10.0 through 10.4 **Description** This issue involves the use of externally-controlled input to select classes or code ('Unsafe Reflection'), leading to cache poisoning. This can potentially allow for remote code execution. **Recommendations** Sitecore Experience Manager (XM) versions 9.0 through 9.3 and 10.0 through 10.4: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Sitecore Experience Platform (XP) versions 9.0 through 9.3 and 10.0 through 10.4: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sitecore Experience Manager (XM) versions 9.0 through 9.3, 10.0 through 10.4 Sitecore Experience Platform (XP) versions 9.0 through 9.3, 10.0 through 10.4 **Description** A deserialization of untrusted data issue exists in Sitecore Experience Manager (XM) and Sitecore Experience Platform (XP), potentially allowing for Remote Code Execution (RCE). **Recommendations** Sitecore Experience Manager (XM) versions 9.0 through 9.3 should be updated. Sitecore Experience Manager (XM) versions 10.0 through 10.4 should be updated. Sitecore Experience Platform (XP) versions 9.0 through 9.3 should be updated. Sitecore Experience Platform (XP) versions 10.0 through 10.4 should be updated.

Name of the Vulnerable Software and Affected Versions: Commvault versions prior to 11.36.60 Description: A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials. Role-Based Access Control (RBAC) can limit exposure, but does not eliminate the risk. Recommendations: Update to version 11.36.60 or later.

Name of the Vulnerable Software and Affected Versions: ServiceStack (affected versions not specified) Description: This issue allows remote attackers to execute arbitrary code on affected installations of ServiceStack. The specific flaw exists within the implementation of the `FindType` method, which lacks proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this to execute code in the context of the current process. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: ServiceStack (affected versions not specified) Description: This issue allows remote attackers to relay NTLM credentials on affected installations of ServiceStack. The specific flaw exists within the implementation of the `GetErrorResponse` method, resulting from the lack of proper validation of user-supplied data, which can lead to a type confusion condition. An attacker can leverage this to relay NTLM credentials in the context of the current user. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sitecore PowerShell Extensions versions prior to 7.0 **Description** The issue allows a remote, authenticated attacker to upload arbitrary files to the server using crafted HTTP requests, resulting in remote code execution. This is due to an unrestricted file upload problem. **Recommendations** For versions prior to 7.0, consider disabling the file upload functionality until a patch is available. Restrict access to the server to minimize the risk of exploitation. Avoid using crafted HTTP requests to upload files to the server until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Trend Micro Endpoint Encryption PolicyServer (affected versions not specified) **Description** The issue is related to an insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer, which could lead to a post-authentication remote code execution on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system to exploit this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Trend Micro Endpoint Encryption (affected versions not specified) **Description** The issue is related to an authentication bypass, allowing an attacker to access key methods as an admin user and modify product configurations on affected installations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.