C4Ng4C3Ir0

A security issue exists in AllStarLink Supermon, specifically within the AllMon2 component. This issue allows for cross site scripting, and can be triggered remotely. The exploit for this issue has been publicly disclosed. The vendor was informed of the disclosure but did not provide a response. This vulnerability impacts products that are no longer supported by the maintainer.

A vulnerability was found in the Additional Database Installation Wizard component of Kentico CMS, specifically in the file /CMSInstall/install.aspx. The issue is related to the manipulation of the `new database` argument, which leads to cross-site scripting. This can be exploited remotely.

A problematic vulnerability was found in AthleteMonitoring, affecting the /login.php file. The issue is related to the manipulation of the `username` argument, which leads to cross-site scripting. This can be initiated remotely. The exploit has been publicly disclosed.

Name of the Vulnerable Software and Affected Versions: Seventh D-Guard versions up to 20250206 Description: A vulnerability has been found in the HTTP GET Request Handler component of Seventh D-Guard, affecting an unknown part of it. The manipulation leads to path traversal, and it is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Recommendations: For Seventh D-Guard versions up to 20250206, as a temporary workaround, consider restricting access to the HTTP GET Request Handler component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A problematic issue was found in Animati PACS, affecting an unknown part of the file /login. The manipulation of the `p` argument leads to cross-site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

A problem has been detected in the Login component of the affected software, where the manipulation of the `browserLang` argument leads to cross-site scripting. This issue can be exploited remotely. The exploit has been publicly disclosed and may be used.

A vulnerability was found in the Password Reset Handler component of Facile Sistemas Cloud Apps, affecting an unknown function of the file /account/forgotpassword. The manipulation of the `reterros` argument leads to cross-site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A critical issue was found in the Overtek OT-E801G, affecting the file `/diag ping.cmd`. This issue leads to os command injection when the `action` parameter is set to `test` and the `ipaddr` parameter is manipulated with malicious input, such as `8.8.8.8%26%26cat%20/etc/passwd`. The attack can be initiated remotely.

A SQL injection issue exists, allowing a user with administrative privileges to execute arbitrary SQL commands by providing specially crafted input to the query setting page.

A problem has been found in the software. It affects unknown code in the /licenses file. The issue arises when the `view` argument is manipulated with a specific input, leading to cross-site scripting. This can be done remotely.

A critical issue affects the Backup File Handler component, specifically an unknown part of the file /param.file.tgz, leading to information disclosure. The attack can be initiated remotely.

A critical issue was found in the Backup File Handler component, affecting an unknown part of the file /param.file.tgz. This leads to information disclosure and can be initiated remotely.

A vulnerability was found in the Netis Netcore Router, affecting an unknown functionality of the file param.file.tgz of the component Backup Handler. This leads to information disclosure and can be launched remotely.