Werner Schober

**Name of the Vulnerable Software and Affected Versions** Konica Minolta bizhub MFP devices (affected versions not specified) **Description** The issue concerns an internal Chromium browser in Konica Minolta bizhub MFP devices that executes with root access privileges. This could potentially allow for elevated access to the device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Konica Minolta bizhub MFP devices before 2022-04-14 **Description** The issue allows a Sandbox Escape. To exploit this, an attacker must attach a keyboard to a USB port, press F12, and then escape from the kiosk mode. **Recommendations** For Konica Minolta bizhub MFP devices before 2022-04-14, update to a version released after 2022-04-14 to resolve the issue. As a temporary workaround, consider restricting physical access to the devices' USB ports to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SALTO ProAccess SPACE version 5.4.3.0 **Description** An issue allows an attacker to write arbitrary content to arbitrary files. This can be used to execute arbitrary commands on the server by writing to files under the web root or creating .bat files that will be used with auto start. **Recommendations** For version 5.4.3.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

An issue was discovered in SALTO ProAccess SPACE 5.4.3.0. The product's webserver runs as a Windows service with local SYSTEM permissions by default. This is against the principle of least privilege. An attacker who is able to exploit CVE-2019-19458 or CVE-2019-19459 is basically able to write to every single path on the file system, because the webserver is running with the highest privileges available.

**Name of the Vulnerable Software and Affected Versions** SALTO ProAccess SPACE version 5.4.3.0 **Description** The issue allows Directory Traversal in the Data Export feature. **Recommendations** For version 5.4.3.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Avaya one-X Communicator versions prior to 6.2 SP13 **Description** The issue concerns the use of weak cryptographic algorithms in the client authentication component, which could allow a local attacker to decrypt sensitive information. **Recommendations** For versions prior to 6.2 SP13, update to version 6.2 SP13 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Sonatype Nexus Repository Manager versions 3.x before 3.8 **Description** The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via several parameters and fields, including: - the `repoId` or `format` parameter to the "service/siesta/healthcheck/healthCheckFileDetail/.../index.html" endpoint, - the `filename` in the "File Upload" functionality of the Staging Upload, - the `username` when creating a new user, - the IQ Server URL field in the IQ Server Connection functionality. **Recommendations** For versions 3.x before 3.8, update to version 3.8 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Sonatype Nexus Repository Manager versions prior to 2.14.6 **Description** The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via several parameters and fields, including the `repoId` or `format` parameter to the "service/siesta/healthcheck/healthCheckFileDetail/.../index.html" endpoint, the `filename` in the "File Upload" functionality of the Staging Upload, the `username` when creating a new user, or the IQ Server URL field in the IQ Server Connection functionality. **Recommendations** For versions prior to 2.14.6, update to version 2.14.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable endpoints and functionalities, such as limiting the ability to upload files or create new users, until a patch is applied. Avoid using the vulnerable parameters, such as `repoId`, `format`, `filename`, `username`, and IQ Server URL field, in the affected functionalities until the issue is resolved.