Actuator

**Name of the Vulnerable Software and Affected Versions** Reader Tools PDF Reader App version 98.8 **Description** A path traversal issue exists within the File Handler component. This occurs when the ` display name` argument is manipulated in the `ActSplashNew.handleDeeplink()` function, allowing a local attacker to access files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables such as file paths. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MapQuest Get Directions App version 10.16.1 **Description** A path traversal issue exists in the `com.mapquest.android.ace` component within the `ExpoShareIntentModule.kt` file. The flaw is located in the `getDataColumn()` function and requires local access to be exploited. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables such as file paths. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the `getDataColumn()` function.

**Name of the Vulnerable Software and Affected Versions** AirAsia MOVE App versions prior to 12.47.2 **Description** A path traversal issue exists in the `com.airasia.mobile` component. This occurs within the `getRealPath()` function of `com.airasia.core.utils.RealPathUtil` when the ` display name` argument is manipulated. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with input that is not properly neutralized. **Recommendations** Update AirAsia MOVE App to version 12.47.2 or later. As a temporary workaround, restrict the use of the ` display name` argument within the `getRealPath()` function.

**Name of the Vulnerable Software and Affected Versions** achorein expo-share-intent versions prior to 8.0.1 **Description** A path traversal flaw exists in the Android File Copy Routine component within the `getDataColumn()` function of the `ExpoShareIntentModule.kt` file. A local attacker can manipulate the ` display name` variable to perform the traversal. **Recommendations** Upgrade to version 8.0.1.

**Name of the Vulnerable Software and Affected Versions** Baicells EG3661M version BaiCE BQ6 2.0.5.3 NA **Description** An OS command injection flaw exists in the LuCI Web Interface component. A remote attacker can exploit this by manipulating the `MaxHops`, `Timeout`, or `Size` arguments within the '/cgi-bin/luci' endpoint. OS command injection is a flaw that allows an attacker to execute arbitrary operating system commands on the affected device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ZomboDroid Meme Generator App version 4.6830 **Description** A path traversal issue exists in the `com.zombodroid.MemeGenerator` component, specifically within the `t5.l.c()` function. Path traversal is a flaw that allows an attacker to access files and directories that are stored outside the intended folder. This issue requires local access to be exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogii.textplus. Such manipulation leads to improper export of android application components. The attack needs to be performed locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

A vulnerability was detected in Blix Email Blue Mail Calendar App 2.2.305. Impacted is the function FileDirectory.getDataColumn/FileDirectory.getFileFromUri of the component react-native-receive-sharing-intent. The manipulation of the argument display name results in path traversal. The attack is only possible with local access. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

**Name of the Vulnerable Software and Affected Versions** Genspark AI Workspace App version 2.8.4 **Description** An issue exists in the `ai.mainfunc.genspark` component of the Android application. Improper authorization occurs within the handler for custom URL schemes, which can be exploited by an attacker from a local environment. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iAI Lab PDF AI App version 4.21.0 **Description** A path traversal issue exists in the `getExternalCacheDir()` function of the `chatpdf.pro` component. This flaw allows a local attacker to perform path traversal by manipulating the ` display name` variable. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GoAhead-Webs on KuWFi 4G LTE AC900 version 1.0.13 **Description** A stack-based buffer overflow exists in the GoAhead-Webs HTTP daemon. The `/goform/formMultiApnSetting` handler uses `sprintf()` to copy the `pincode` parameter, supplied by the user, into a fixed 132-byte stack buffer without proper bounds checking. This can lead to corruption of adjacent stack memory, potentially causing the web server to crash and, under specific circumstances, enabling arbitrary code execution. The vulnerable parameter is `pincode`. **Recommendations** Update to a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** KuWFi CPF908-CP5 WEB5.0 LCD 20210125 **Description** Unauthenticated access control issues exist within the endpoints 'goform/goform set cmd process' and 'goform/goform get cmd process'. These flaws allow an unauthenticated attacker to retrieve sensitive information, such as the device admin username and password, modify critical device settings, and send arbitrary SMS messages. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FIRSTNUM JC21A-04 devices versions through 2.01ME/FN **Description** FIRSTNUM JC21A-04 devices enable the SSH service by default with the credentials `root`/`admin`. The graphical user interface (GUI) does not provide a method to disable this account. **Recommendations** For versions through 2.01ME/FN, change the default `root` account password or disable the SSH service.

**Name of the Vulnerable Software and Affected Versions** Jointelli 5G CPE 21H01 firmware version 1.36 **Description** Jointelli 5G CPE 21H01 firmware version 1.36 contains a blind OS command injection issue. Multiple API endpoints are vulnerable, including `/ubus/?flag=set WPS pin`, `/ubus/?flag=netAppStar1`, and `/ubus/?flag=set wifi cfgs`. An authenticated attacker can execute arbitrary OS commands with root privileges by providing crafted inputs to the SSID, WPS, Traceroute, and Ping fields. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FIRSTNUM JC21A-04 devices versions through 2.01ME/FN **Description** An issue allows authenticated attackers to execute arbitrary OS system commands with root privileges via crafted payloads to the `xml action.cgi?method=` endpoint. **Recommendations** Update FIRSTNUM JC21A-04 devices to a version later than 2.01ME/FN.

**Name of the Vulnerable Software and Affected Versions** com.skt.prod.dialer versions through 12.5.0 **Description** The application allows any installed application, without requiring any permissions, to initiate phone calls without user interaction. This is achieved by sending a specially crafted intent to the `com.skt.prod.dialer.activities.outgoingcall.OutgoingCallInternalBroadcaster` component. **Recommendations** Update com.skt.prod.dialer to a version newer than 12.5.0.