C4Ng4C3Ir0

**Name of the Vulnerable Software and Affected Versions** AllStarLink Supermon versions up to 6.2 **Description** A security issue exists in AllStarLink Supermon, specifically within the AllMon2 component. This issue allows for cross site scripting, and can be triggered remotely. The exploit for this issue has been publicly disclosed. The vendor was informed of the disclosure but did not provide a response. This vulnerability impacts products that are no longer supported by the maintainer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Kentico CMS versions up to 13.0.178 **Description** A vulnerability was found in the Additional Database Installation Wizard component of Kentico CMS, specifically in the file /CMSInstall/install.aspx. The issue is related to the manipulation of the `new database` argument, which leads to cross-site scripting. This can be exploited remotely. **Recommendations** For versions up to 13.0.178, upgrade to version 13.0.179 to address this issue. It is recommended to upgrade the affected Additional Database Installation Wizard component.

**Name of the Vulnerable Software and Affected Versions** AthleteMonitoring up to 20250302 **Description** A problematic vulnerability was found in AthleteMonitoring, affecting the /login.php file. The issue is related to the manipulation of the `username` argument, which leads to cross-site scripting. This can be initiated remotely. The exploit has been publicly disclosed. **Recommendations** For AthleteMonitoring up to 20250302, as a temporary workaround, consider restricting access to the /login.php file or validating and sanitizing the `username` argument to prevent cross-site scripting attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Seventh D-Guard versions up to 20250206 Description: A vulnerability has been found in the HTTP GET Request Handler component of Seventh D-Guard, affecting an unknown part of it. The manipulation leads to path traversal, and it is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Recommendations: For Seventh D-Guard versions up to 20250206, as a temporary workaround, consider restricting access to the HTTP GET Request Handler component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Animati PACS versions up to 1.24.12.09.03 **Description** A problematic issue was found in Animati PACS, affecting an unknown part of the file /login. The manipulation of the `p` argument leads to cross-site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For versions up to 1.24.12.09.03, as a temporary workaround, consider restricting access to the /login file until a patch is available. Avoid using the `p` argument in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Cianet ONU GW24AC versions up to 20250127 **Description** A problem has been detected in the Login component of the affected software, where the manipulation of the `browserLang` argument leads to cross-site scripting. This issue can be exploited remotely. The exploit has been publicly disclosed and may be used. **Recommendations** For Cianet ONU GW24AC versions up to 20250127: 1. Update the firmware to a version that is not affected by this issue. 2. Disable remote access as a temporary workaround to minimize the risk of exploitation. 3. Monitor systems for any signs of exploitation.

**Name of the Vulnerable Software and Affected Versions** Facile Sistemas Cloud Apps up to 20250107 **Description** A vulnerability was found in the Password Reset Handler component of Facile Sistemas Cloud Apps, affecting an unknown function of the file /account/forgotpassword. The manipulation of the `reterros` argument leads to cross-site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. **Recommendations** As a temporary workaround, consider disabling the Password Reset Handler component until a patch is available. Restrict access to the /account/forgotpassword endpoint to minimize the risk of exploitation. Avoid using the `reterros` argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Overtek OT-E801G version OTE801G65.1.1.0 **Description** A critical issue was found in the Overtek OT-E801G, affecting the file `/diag ping.cmd`. This issue leads to os command injection when the `action` parameter is set to `test` and the `ipaddr` parameter is manipulated with malicious input, such as `8.8.8.8%26%26cat%20/etc/passwd`. The attack can be initiated remotely. **Recommendations** For version OTE801G65.1.1.0, as a temporary workaround, consider restricting access to the `/diag ping.cmd` file until a patch is available. Avoid using the `ipaddr` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** CONPROSYS HMI System (CHS) versions prior to 3.5.3 **Description** A SQL injection issue exists, allowing a user with administrative privileges to execute arbitrary SQL commands by providing specially crafted input to the query setting page. **Recommendations** For versions prior to 3.5.3, update to version 3.5.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Keysight IXIA Hawkeye version 3.3.16.28 **Description** A problem has been found in the software. It affects unknown code in the /licenses file. The issue arises when the `view` argument is manipulated with a specific input, leading to cross-site scripting. This can be done remotely. **Recommendations** For version 3.3.16.28, as a temporary workaround, consider restricting access to the /licenses file until a patch is available. Avoid using the `view` argument in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** BDCOM 1704-WGL version 2.0.6314 **Description** A critical issue affects the Backup File Handler component, specifically an unknown part of the file /param.file.tgz, leading to information disclosure. The attack can be initiated remotely. **Recommendations** For BDCOM 1704-WGL version 2.0.6314, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Multilaser RE057 and RE170 versions 2.1/2.2 **Description** A critical issue was found in the Backup File Handler component, affecting an unknown part of the file /param.file.tgz. This leads to information disclosure and can be initiated remotely. **Recommendations** For Multilaser RE057 and RE170 versions 2.1/2.2, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Netis Netcore Router versions up to 2.2.6 **Description** A vulnerability was found in the Netis Netcore Router, affecting an unknown functionality of the file param.file.tgz of the component Backup Handler. This leads to information disclosure and can be launched remotely. **Recommendations** For versions up to 2.2.6, at the moment, there is no information about a newer version that contains a fix for this vulnerability.