Sean Yeoh

**Name of the Vulnerable Software and Affected Versions** WS FTP Server versions prior to 8.7.4 and 8.8.2 **Description** The issue is related to a .NET deserialization vulnerability in the Ad Hoc Transfer module of WS FTP Server. This vulnerability can be exploited by a pre-authenticated attacker to execute remote commands on the underlying WS FTP Server operating system. The vulnerability has been observed being actively exploited in the wild, and it is estimated that a significant number of devices may be affected. **Recommendations** For WS FTP Server versions prior to 8.7.4, update to version 8.7.4 or later. For WS FTP Server versions prior to 8.8.2, update to version 8.8.2 or later. As a temporary workaround, consider disabling the Ad Hoc Transfer module until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Oracle Hospitality OPERA 5 Property Services version 5.6 **Description** The issue is related to insufficient input validation in the OXI component of Oracle Hospitality OPERA 5 Property Services. This allows a remote attacker with high privileges and network access via HTTP to compromise the system. Successful attacks can result in unauthorized access to critical data, complete access to all accessible data, unauthorized updates, inserts, or deletes to some accessible data, and a partial denial of service. The vulnerability can significantly impact additional products. **Recommendations** For Oracle Hospitality OPERA 5 Property Services version 5.6, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the OXI component to minimize the risk of exploitation. Avoid using HTTP requests to the vulnerable component until the issue is resolved.