Zach Hanley

**Name of the Vulnerable Software and Affected Versions** Nagios Core versions prior to 4.5.14 Nagios XI versions prior to 2026R1.7 **Description** Reflected cross-site scripting occurs in the 'cmd.cgi' endpoint via the `NagFormId` parameter. An unauthenticated remote attacker can craft a malicious link that, when followed by an authenticated user, executes arbitrary JavaScript in the victim's browser. **Recommendations** Update Nagios Core to version 4.5.14 or later. Update Nagios XI to version 2026R1.7 or later. Avoid using the `NagFormId` parameter in the 'cmd.cgi' endpoint until the updates are applied.

**Name of the Vulnerable Software and Affected Versions** Nagios Core versions prior to 4.5.14 Nagios XI versions prior to 2026R1.7 **Description** Authenticated UI users can achieve remote code execution as the nagios user through unfiltered NOTIFICATION-family macro substitution via the `com data` parameter. This occurs when a notification command references the `$NOTIFICATIONCOMMENT$` or `$NOTIFICATIONAUTHOR$` macros in a shell-reachable position. Exploitation is possible only in non-default configurations where these macros are used within a shell-executed command line. **Recommendations** Update Nagios Core to version 4.5.14 or later. Update Nagios XI to version 2026R1.7 or later.

**Name of the Vulnerable Software and Affected Versions** Nagios Core versions prior to 4.5.14 Nagios XI versions prior to 2026R1.7 **Description** DOM-based cross-site scripting occurs in `jsonquery.js` when unencoded JSON string values reflected from stored fields are inserted into the Document Object Model (DOM) without proper sanitization. This allows attackers to execute arbitrary JavaScript in the browser of a victim. **Recommendations** Update Nagios Core to version 4.5.14 or later. Update Nagios XI to version 2026R1.7 or later.

**Name of the Vulnerable Software and Affected Versions** Nagios Core versions prior to 4.5.14 Nagios XI versions prior to 2026R1.7 **Description** Cross-site request forgery (CSRF) protection bypass occurs when an attacker provides a self-supplied double-submit cookie. By supplying matching cookie and request parameter values, unauthenticated attackers can bypass security protections and execute commands as authorized users through malicious links. Double-submit cookies are a stateless CSRF defense mechanism where a random value is sent both in a cookie and a request parameter; the server validates that both values match. **Recommendations** Update Nagios Core to version 4.5.14 or later. Update Nagios XI to version 2026R1.7 or later.

**Name of the Vulnerable Software and Affected Versions** Ivanti EPM versions before 2024 January-2025 Security Update Ivanti EPM versions before 2022 SU6 January-2025 Security Update **Description** The issue is related to an absolute path traversal in Ivanti EPM, which can be exploited by a remote unauthenticated attacker to leak sensitive information. This is due to incorrect restriction of the directory path name. **Recommendations** For versions before 2024 January-2025 Security Update, apply the 2024 January-2025 Security Update. For versions before 2022 SU6 January-2025 Security Update, apply the 2022 SU6 January-2025 Security Update.

**Name of the Vulnerable Software and Affected Versions** Ivanti EPM versions before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update **Description** The issue is related to absolute path traversal in Ivanti EPM, allowing a remote unauthenticated attacker to leak sensitive information. Attackers could compromise servers via relay attacks. A proof-of-concept (PoC) exploit has been released, and researchers have revealed technical details on credential coercion vulnerabilities. It is estimated that 73 vulnerable targets have been identified. **Recommendations** For Ivanti EPM versions before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update, patch urgently to fix the vulnerability. As a temporary workaround, consider restricting access to sensitive information and disabling any features that may be exploited via relay attacks until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Palo Alto Networks Expedition (affected versions not specified) **Description** An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition. This results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls. The vulnerability is related to the failure to neutralize special elements used in the OS command. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks Expedition (affected versions not specified) Description: The issue is related to an SQL injection vulnerability in Palo Alto Networks Expedition. This vulnerability allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system. The estimated number of potentially affected devices worldwide is not specified. However, there are reports of real-world incidents where this issue was exploited. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the vulnerable SQL injection endpoint to minimize the risk of exploitation. Avoid using vulnerable parameters or variables in the affected API endpoint until the issue is resolved. Additionally, monitor the system for any suspicious activity and consider implementing additional security measures to prevent exploitation.

**Name of the Vulnerable Software and Affected Versions** Palo Alto Networks Expedition (affected versions not specified) **Description** The issue is related to the cleartext storage of sensitive information in Palo Alto Networks Expedition, allowing an authenticated attacker to reveal firewall usernames, passwords, and API keys generated using those credentials. This can be exploited by a remote attacker to obtain encrypted user credentials. The vulnerability involves a flaw in the storage of sensitive information, potentially through registration files or logs. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SolarWinds Web Help Desk versions prior to 12.8.3 Hotfix 2 **Description** The SolarWinds Web Help Desk software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated users to access internal functionality and modify data. This vulnerability has been actively exploited, and it involves hard-coded credentials that allow attackers to access sensitive help desk tickets. Approximately 827 instances of SolarWinds Web Help Desk are reachable on the internet, with 76% of devices with externally accessible login screens not yet patched. The vulnerability could allow remote, unauthenticated attackers to access internal functionalities and modify data, potentially leading to severe security breaches. **Recommendations** To resolve the issue, update to version 12.8.3 Hotfix 2 or later. If you haven't already done so, manually install the patch to prevent unauthorized access and data modification. As a temporary workaround, consider restricting access to the vulnerable module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Palo Alto Networks Expedition versions prior to 1.2.92 **Description** The vulnerability is related to a missing authentication mechanism for a critical function in Palo Alto Networks Expedition, allowing an attacker with network access to take over an admin account and potentially access configuration secrets, credentials, and other data. This issue has been actively exploited by attackers, and it is recommended to update to the latest version to mitigate the risks. **Recommendations** Update to Palo Alto Networks Expedition version 1.2.92 or later to fix the missing authentication vulnerability. As a temporary workaround, consider restricting access to the Expedition server to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** NETGEAR Multiple Routers (affected versions not specified) **Description** This issue allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of multiple NETGEAR routers. The specific flaw exists within the update functionality, which operates over HTTPS, due to the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Authentication is not required to exploit this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.