Andrea Sindoni

**Name of the Vulnerable Software and Affected Versions** Microchip Time Provider 4100 versions prior to 2.5.0 **Description** The use of hard-coded credentials allows for a malicious manual software update. **Recommendations** Update to version 2.5.0 or later.

**Name of the Vulnerable Software and Affected Versions** Microchip Time Provider 4100 versions prior to 2.5 **Description** An improper neutralization of special elements used in an OS command vulnerability exists in Microchip Time Provider 4100, allowing for OS command injection. This issue relates to remote code execution through the backup configuration password. **Recommendations** Update to a version newer than 2.5.

**Name of the Vulnerable Software and Affected Versions** Microchip Time Provider 4100 versions prior to 2.5 **Description** An improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Microchip Time Provider 4100. This allows for OS Command Injection. The issue relates to restoring the configuration password. **Recommendations** Update Microchip Time Provider 4100 to version 2.5 or later.

**Name of the Vulnerable Software and Affected Versions** Microchip Time Provider 4100 versions prior to 2.5 **Description** An improper neutralization of special elements used in an SQL command ('SQL Injection') issue exists in Microchip Time Provider 4100. This allows for SQL Injection. The vulnerability is present in the web resource. The `SQL` command is not properly sanitized, potentially allowing an attacker to inject malicious code. **Recommendations** Update Microchip Time Provider 4100 to version 2.5 or later.

**Name of the Vulnerable Software and Affected Versions** Microchip Time Provider 4100 versions prior to 2.5 **Description** A flaw exists in Microchip Time Provider 4100 that permits malicious manual software updates due to a missing integrity check during code download. **Recommendations** Update to version 2.5 or later.

**Name of the Vulnerable Software and Affected Versions** Artifex MuJS versions prior to 1.0.3 **Description** The issue is related to an integer overflow in the js strtod function due to incorrect exponent validation. **Recommendations** For versions prior to 1.0.3, update to version 1.0.3 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Artifex MuJS versions 1.0.2 and earlier Description: The issue is related to the improper maintenance of the AST depth for binary expressions in jsparse.c, which can be exploited by remote attackers to cause a denial of service through excessive recursion by using a crafted file. Recommendations: For Artifex MuJS versions 1.0.2 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.