Yukusawa18

**Name of the Vulnerable Software and Affected Versions** WatchGuard Dimension (affected versions not specified) **Description** The Web UI contains a cross-site request forgery (CSRF) flaw—a type of attack that forces an authenticated user to execute unwanted actions—within the administrator passphrase change action. An attacker can change a global administrator's passphrase to a value of the attacker's choosing by inducing the authenticated administrator's browser to visit a specially crafted link or page. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WatchGuard Dimension (affected versions not specified) **Description** An authenticated SQL injection exists in the scheduled report feature. An authenticated user with report administration permissions can achieve arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, allowing unauthorized access to or manipulation of the database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WatchGuard Dimension (affected versions not specified) **Description** An authenticated SQL injection exists in the log viewer feature. An authenticated user with report administration permissions can achieve arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, allowing unauthorized access to or manipulation of the database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WatchGuard Dimension (affected versions not specified) **Description** An authenticated SQL injection exists in the audit report feature. An authenticated user with report administration permissions can achieve arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, allowing unauthorized access to or manipulation of the database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WatchGuard Dimension (affected versions not specified) **Description** A Reflected Cross-Site Scripting (XSS) issue exists in the report detail page. This allows an attacker to execute arbitrary JavaScript within the browser of an authenticated user by using a specially crafted URL. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WatchGuard Dimension (affected versions not specified) **Description** An authenticated administrator can execute arbitrary JavaScript in the web browser of another authenticated administrator. This occurs through a Stored Cross-Site Scripting (XSS) flaw—a type of vulnerability where malicious scripts are permanently stored on the target server—within the Trusted CA certificate configuration when a specially crafted certificate is saved. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.