Zach Hanley

Reflected cross-site scripting occurs in the 'cmd.cgi' endpoint via the `NagFormId` parameter. An unauthenticated remote attacker can craft a malicious link that, when followed by an authenticated user, executes arbitrary JavaScript in the victim's browser.

Authenticated UI users can achieve remote code execution as the nagios user through unfiltered NOTIFICATION-family macro substitution via the `com data` parameter. This occurs when a notification command references the `$NOTIFICATIONCOMMENT$` or `$NOTIFICATIONAUTHOR$` macros in a shell-reachable position. Exploitation is possible only in non-default configurations where these macros are used within a shell-executed command line.

DOM-based cross-site scripting occurs in `jsonquery.js` when unencoded JSON string values reflected from stored fields are inserted into the Document Object Model (DOM) without proper sanitization. This allows attackers to execute arbitrary JavaScript in the browser of a victim.

Cross-site request forgery (CSRF) protection bypass occurs when an attacker provides a self-supplied double-submit cookie. By supplying matching cookie and request parameter values, unauthenticated attackers can bypass security protections and execute commands as authorized users through malicious links. Double-submit cookies are a stateless CSRF defense mechanism where a random value is sent both in a cookie and a request parameter; the server validates that both values match.

The issue is related to an absolute path traversal in Ivanti EPM, which can be exploited by a remote unauthenticated attacker to leak sensitive information. This is due to incorrect restriction of the directory path name.

The issue is related to absolute path traversal in Ivanti EPM, allowing a remote unauthenticated attacker to leak sensitive information. Attackers could compromise servers via relay attacks. A proof-of-concept (PoC) exploit has been released, and researchers have revealed technical details on credential coercion vulnerabilities. It is estimated that 73 vulnerable targets have been identified.

An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition. This results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls. The vulnerability is related to the failure to neutralize special elements used in the OS command.

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks Expedition (affected versions not specified) Description: The issue is related to an SQL injection vulnerability in Palo Alto Networks Expedition. This vulnerability allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system. The estimated number of potentially affected devices worldwide is not specified. However, there are reports of real-world incidents where this issue was exploited. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the vulnerable SQL injection endpoint to minimize the risk of exploitation. Avoid using vulnerable parameters or variables in the affected API endpoint until the issue is resolved. Additionally, monitor the system for any suspicious activity and consider implementing additional security measures to prevent exploitation.

The issue is related to the cleartext storage of sensitive information in Palo Alto Networks Expedition, allowing an authenticated attacker to reveal firewall usernames, passwords, and API keys generated using those credentials. This can be exploited by a remote attacker to obtain encrypted user credentials. The vulnerability involves a flaw in the storage of sensitive information, potentially through registration files or logs.

The SolarWinds Web Help Desk software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated users to access internal functionality and modify data. This vulnerability has been actively exploited, and it involves hard-coded credentials that allow attackers to access sensitive help desk tickets. Approximately 827 instances of SolarWinds Web Help Desk are reachable on the internet, with 76% of devices with externally accessible login screens not yet patched. The vulnerability could allow remote, unauthenticated attackers to access internal functionalities and modify data, potentially leading to severe security breaches.

The vulnerability is related to a missing authentication mechanism for a critical function in Palo Alto Networks Expedition, allowing an attacker with network access to take over an admin account and potentially access configuration secrets, credentials, and other data. This issue has been actively exploited by attackers, and it is recommended to update to the latest version to mitigate the risks.

This issue allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of multiple NETGEAR routers. The specific flaw exists within the update functionality, which operates over HTTPS, due to the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Authentication is not required to exploit this issue.