Torjus Bryne Retterstøl

**Name of the Vulnerable Software and Affected Versions** Splunk App for Lookup File Editing versions prior to 4.0.1 Splunk Enterprise (affected versions not specified) **Description** The issue is related to incorrect restriction of a directory path name with limited access. Exploitation may allow a remote attacker to read and write arbitrary files in the system using a specially crafted HTTP request. A low-privileged user can trigger a path traversal exploit with a specially crafted web request to read and write to restricted areas of the Splunk installation directory. **Recommendations** For Splunk App for Lookup File Editing versions prior to 4.0.1, update to version 4.0.1 or later to resolve the issue. For Splunk Enterprise, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco Jabber for Windows (affected versions not specified) Cisco Jabber for Mac (affected versions not specified) Cisco Jabber for mobile platforms (affected versions not specified) **Description** The issue is related to insufficient protection of registration data, which could allow a remote attacker to gain unauthorized access to sensitive information using a specially crafted XMPP message. This could also lead to a denial of service (DoS) condition, allowing an attacker to access sensitive information. **Recommendations** For Cisco Jabber for Windows, consider restricting access to sensitive information until a fix is available. For Cisco Jabber for Mac, avoid using the platform with untrusted XMPP messages until the issue is resolved. For Cisco Jabber for mobile platforms, restrict the use of the platform in untrusted environments to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco Jabber for Windows (affected versions not specified) Cisco Jabber for Mac (affected versions not specified) Cisco Jabber for mobile platforms (affected versions not specified) **Description** The issue is related to errors in resource management in the Cisco Jabber software platform. An attacker could exploit this to cause a denial of service (DoS) condition by sending a specially crafted XMPP message. This could allow an attacker to access sensitive information or disrupt service. **Recommendations** For Cisco Jabber for Windows, consider restricting access to the XMPP protocol until a fix is available. For Cisco Jabber for Mac, avoid using the software for sensitive operations until the issue is resolved. For Cisco Jabber for mobile platforms, as a temporary workaround, consider disabling the XMPP messaging functionality until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.