William Soderberg

**Name of the Vulnerable Software and Affected Versions** Azure Site Recovery (affected versions not specified) **Description** The issue is related to insufficient protection of registration data in Azure Site Recovery, which can be exploited by a remote attacker to elevate their privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Azure Site Recovery (affected versions not specified) **Description** The issue is related to incorrect code generation management. It may allow a remote attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IBM API Connect versions 5.0.0.0 through 5.0.8.6 **Description** The issue allows an attacker to perform command injection using a specially crafted request, potentially leading to arbitrary code execution on the server and complete system access. **Recommendations** For versions 5.0.0.0 through 5.0.8.6, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** IBM API Connect versions 5.0.0.0 through 5.0.8.6 **Description** The issue allows app developers to exploit the Developer Portal and download arbitrary files from the host OS, potentially carrying out Server-Side Request Forgery (SSRF) attacks. SSRF attacks involve tricking a server into making requests to unintended locations, which can lead to unauthorized access to sensitive data or systems. **Recommendations** For IBM API Connect versions 5.0.0.0 through 5.0.8.6, consider restricting access to the Developer Portal to minimize the risk of exploitation until a fix is available. As a temporary workaround, restrict the ability of app developers to download arbitrary files from the host OS. At the moment, there is no information about a newer version that contains a fix for this vulnerability.