Thierry Viaccoz

**Name of the Vulnerable Software and Affected Versions** Ironman Software PowerShell Universal versions 2.x through 3.x prior to 2.12.6 Ironman Software PowerShell Universal versions 3.x prior to 3.4.7 Ironman Software PowerShell Universal versions 3.x prior to 3.5.3 **Description** The issue allows an attacker with a valid app token to escalate privileges in the Web Server by retrieving other app tokens by ID via an HTTP web request. **Recommendations** For versions 2.x, update to version 2.12.6 to resolve the issue. For versions 3.x prior to 3.4.7, update to version 3.4.7 to resolve the issue. For versions 3.x prior to 3.5.3, update to version 3.5.3 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Ironman Software PowerShell Universal versions prior to 3.5.3 Ironman Software PowerShell Universal versions prior to 3.4.7 **Description** The issue allows a remote attacker with administrator privilege to create, delete, update, and display files outside of the configuration directory via a crafted HTTP request to particular endpoints in the web server. This is due to directory traversal outside of the configuration directory in the Web Server. **Recommendations** For versions prior to 3.5.3, update to version 3.5.3 or later. For versions prior to 3.4.7, update to version 3.4.7 or later.

Name of the Vulnerable Software and Affected Versions: AdRem NetCrunch version 10.6.0.4587 Description: The issue is related to improper session handling in the NetCrunch web client, which can lead to an authentication bypass or escalation of privileges. Recommendations: For AdRem NetCrunch version 10.6.0.4587, consider disabling the NetCrunch web client until a patch is available to prevent potential authentication bypass or escalation of privileges.

Name of the Vulnerable Software and Affected Versions: AdRem NetCrunch version 10.6.0.4587 Description: The issue is related to a hardcoded SSL private key vulnerability in the NetCrunch web client. This hardcoded key is used across different customers' installations when no other SSL certificate is installed. As a result, remote attackers can defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation. Recommendations: For AdRem NetCrunch version 10.6.0.4587, consider replacing the hardcoded SSL private key with a unique certificate for each installation to prevent exploitation. Additionally, restrict access to the NetCrunch web client until a proper SSL certificate is installed.

Name of the Vulnerable Software and Affected Versions: AdRem NetCrunch version 10.6.0.4587 Description: The issue allows credentials disclosure, enabling every user to read private keys, private keys' passwords, and root passwords for BSD, Linux, MacOS, and Solaris stored in the credential manager. Additionally, every administrator can access ESX and Windows passwords stored in the credential manager. Recommendations: For AdRem NetCrunch version 10.6.0.4587, consider restricting access to the credential manager to minimize the risk of exploitation. As a temporary workaround, limit the privileges of users and administrators to prevent unauthorized access to sensitive credentials. At the moment, there is no information about a newer version that contains a fix for this vulnerability.