Cert-In

**Name of the Vulnerable Software and Affected Versions** e-Sushrut (affected versions not specified) **Description** e-Sushrut exposes One-Time Passwords (OTPs) in plaintext within API responses. A remote attacker can intercept these responses to obtain valid OTPs, potentially allowing them to impersonate users and gain unauthorized access to accounts. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda 300Mbps Wireless Router F3 Tenda N300 Easy Setup Router **Description** The routers are susceptible to a security issue stemming from the absence of the HTTPOnly flag on session cookies used with the web-based administrative interface. An attacker positioned remotely could potentially capture these session cookies when they are transmitted over an unencrypted HTTP connection. Successful exploitation may lead to unauthorized access to the device and the potential disclosure of sensitive information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.