Brendan Scarvell

**Name of the Vulnerable Software and Affected Versions** NetComm NF20MESH versions prior to R6B032 **Description** Authenticated attackers can execute arbitrary commands as root by injecting shell metacharacters into the `username` JSON parameter. This occurs because the `dalStorage addUserAccount()` function unsafely concatenates user-supplied input into a shell command string passed to `rut doSystemAction()` without proper sanitization, leading to full root-level command execution on the operating system. **Recommendations** Update NetComm NF20MESH to a version newer than R6B031. As a temporary mitigation, restrict access to the functionality that utilizes the `dalStorage addUserAccount()` function.

**Name of the Vulnerable Software and Affected Versions** NetComm NF20MESH versions prior to R6B032 **Description** An authentication bypass exists in the web management interface due to a hardcoded AES-256 key used to encrypt session cookies. An unauthenticated attacker can use this shared key to forge a valid encrypted session cookie and gain full administrative control of the interface, provided a legitimate administrator session is active. **Recommendations** Update to firmware R6B032.

**Name of the Vulnerable Software and Affected Versions** Oracle Hospitality OPERA 5 Property Services version 5.6 **Description** The issue is related to insufficient input validation in the OXI component of Oracle Hospitality OPERA 5 Property Services. This allows a remote attacker with high privileges and network access via HTTP to compromise the system. Successful attacks can result in unauthorized access to critical data, complete access to all accessible data, unauthorized updates, inserts, or deletes to some accessible data, and a partial denial of service. The vulnerability can significantly impact additional products. **Recommendations** For Oracle Hospitality OPERA 5 Property Services version 5.6, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the OXI component to minimize the risk of exploitation. Avoid using HTTP requests to the vulnerable component until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 73 Firefox versions prior to ESR68.5 **Description** The issue allows command line arguments to be injected during Firefox invocation as a shell handler for certain unsupported file types. This requires Firefox to be configured as the default handler for a given file type and for a file downloaded to be opened in a third-party application that insufficiently sanitizes URL data. In such a situation, clicking a link in the third-party application could be used to retrieve and execute files whose location was supplied through command line arguments. This issue only affects Windows operating systems when Firefox is configured as the default handler for non-default file types. **Recommendations** For Firefox versions prior to 73, update to version 73 or later to resolve the issue. For Firefox versions prior to ESR68.5, update to version ESR68.5 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Electron versions 1.7 up to 1.7.12 Electron versions 1.8 up to 1.8.3 Electron versions 2.0.0 up to 2.0.0-beta.3 Description: The issue is related to an improper handling of values in Webviews, which can result in remote code execution. This can be exploited via an app that allows execution of 3rd party code, disallows node integration, and has not specified if webview is enabled or disabled. The application must also meet specific conditions, including running on affected Electron versions, allowing execution of arbitrary remote code, disabling Node.js integration, and not explicitly declaring webviewTag as false. Recommendations: For Electron versions 1.7 up to 1.7.12, update to version 1.7.13 or later. For Electron versions 1.8 up to 1.8.3, update to version 1.8.4 or later. For Electron versions 2.0.0 up to 2.0.0-beta.3, update to version 2.0.0-beta.5 or later. If an update is not possible, mitigate the vulnerability by using the provided code to disable node integration and webviewTag in webPreferences, and prevent new-window events from overriding event.newGuest without using the supplied options tag. Additionally, consider preventing the attachment of webviews if they are not used.