Ayrx

**Name of the Vulnerable Software and Affected Versions** ProLink PRC2402M versions 1.0.18 and older **Description** The issue concerns a command injection in the set TR069 function within the adm.cgi binary. This function is accessible when the page parameter is set to TR069. Specifically, the value of the `TR069 local port` parameter is directly passed to the system, allowing for potential exploitation. **Recommendations** For ProLink PRC2402M versions 1.0.18 and older, consider disabling access to the adm.cgi binary with the page parameter set to TR069 until a fix is available. Restricting the use of the `TR069 local port` parameter in this context may also help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ProLink PRC2402M versions 1.0.18 and older **Description** The issue allows an attacker to reset the password to the administrative interface of the router. This is possible due to a problem in the set sys init function in the login.cgi binary. **Recommendations** For ProLink PRC2402M versions 1.0.18 and older, consider disabling the set sys init function in the login.cgi binary as a temporary workaround until a patch is available. Restrict access to the administrative interface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ProLink PRC2402M versions 1.0.18 and older **Description** The issue concerns a command injection in the set ledonoff function within the adm.cgi binary. This function is accessible with a page parameter value of `ledonoff`. The `led cmd` parameter's value is passed directly to `do system()`, allowing for a trivial command injection. **Recommendations** For ProLink PRC2402M versions 1.0.18 and older, as a temporary workaround, consider restricting access to the `adm.cgi` binary or disabling the `set ledonoff` function until a patch is available. Avoid using the `led cmd` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ProLink PRC2402M versions 1.0.18 and older **Description** The issue concerns a command injection in the set sys cmd function within the adm.cgi binary. This function is accessible when the page parameter is set to sysCMD, allowing the command parameter's value to be passed directly to the system. **Recommendations** For ProLink PRC2402M versions 1.0.18 and older, as a temporary workaround, consider restricting access to the adm.cgi binary or disabling the set sys cmd function until a patch is available. Avoid using the command parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: CryptoNote versions 0.8.9 and possibly later Description: The issue allows for remote command execution and takeover of the cryptocurrency wallet. This can occur when an attacker tricks an application, such as a web browser, into connecting and sending a command to the local RPC server, which does not require authentication. The walletd and simplewallet RPC daemons will process any commands sent to them. An attack can be triggered by a victim visiting a webpage hosting malicious content. Recommendations: For CryptoNote version 0.8.9 and possibly later, consider disabling the local RPC server or implementing authentication to prevent unauthorized access until a patch is available. Restrict access to the walletd and simplewallet RPC daemons to minimize the risk of exploitation. Avoid using the wallet on systems that can be tricked into connecting to malicious servers.

Name of the Vulnerable Software and Affected Versions: Calibre version 3.18 Description: The issue concerns the execution of arbitrary code via a crafted .pickle file. Specifically, the `gui2/viewer/bookmarkmanager.py` module in Calibre calls `cPickle.load` on imported bookmark data, allowing remote attackers to execute arbitrary code. This can be demonstrated by Python code that contains an `os.system` call. Recommendations: For Calibre version 3.18, consider avoiding the use of `cPickle.load` on untrusted input until a patch is available. As a temporary workaround, restrict the import of bookmark data from untrusted sources to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** GraphicsMagick version 1.3.26 **Description** The issue is related to a heap-based buffer over-read in the DescribeImage function of the magick/describe.c file, which can lead to a memory information disclosure. This can be triggered by a specially crafted MIFF file, causing an out-of-bounds buffer dereference due to un-checked increments. The vulnerable code portion is responsible for printing the IPTC Profile information contained in the image. **Recommendations** For GraphicsMagick version 1.3.26, as a temporary workaround, consider disabling the `DescribeImage` function until a patch is available. Restrict access to the `magick/describe.c` file to minimize the risk of exploitation. Avoid using specially crafted MIFF files with the affected `DescribeImage` function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GraphicsMagick version 1.3.26 **Description** The issue is related to a heap-based buffer overflow in the DescribeImage() function of the magick/describe.c file, specifically in the "Display visual image directory" feature. This can be triggered by running the identify command on a specially crafted MIFF format file with the verbose flag. Additionally, the vulnerability is caused by a buffer overflow in the ReadOneJNGImage function of the coders/png.c file, which can allow a remote attacker to execute arbitrary code. **Recommendations** For GraphicsMagick version 1.3.26, consider disabling the DescribeImage() function or restricting the use of the identify command with the verbose flag until a patch is available. As a temporary workaround, avoid using the ReadOneJNGImage function in the coders/png.c file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** GraphicsMagick version 1.3.26 **Description** The issue is related to the `ReadDCMImage` function in `coders/dcm.c`, which can cause a denial of service due to a NULL pointer dereference when processing a crafted DICOM image. This is connected to the `DCM ReadNonNativeImages` function's ability to return an image list with zero frames. The vulnerability can be exploited by remote attackers using a specially crafted DICOM file, leading to a service disruption. **Recommendations** For GraphicsMagick version 1.3.26, consider disabling the `ReadDCMImage` function in `coders/dcm.c` as a temporary workaround to prevent exploitation until a patch is available. Restrict the processing of DICOM images to minimize the risk of service disruption. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Odoo versions 8.0, 9.0, and 10.0 Odoo Community Edition versions 9.0 and 10.0 Odoo Enterprise Edition versions 9.0 and 10.0 **Description** The issue arises from insecure handling of anonymization data in the Database Anonymization module, allowing remote authenticated privileged users to execute arbitrary Python code due to the use of unpickle. **Recommendations** For Odoo version 8.0, update to a version that includes a fix for the insecure handling of anonymization data. For Odoo Community Edition versions 9.0 and 10.0, update to a version that includes a fix for the insecure handling of anonymization data. For Odoo Enterprise Edition versions 9.0 and 10.0, update to a version that includes a fix for the insecure handling of anonymization data. As a temporary workaround, consider disabling the Database Anonymization module until a patch is available.