Dariusz Gońda

**Name of the Vulnerable Software and Affected Versions** Archer A6 v4 **Description** A denial-of-service issue exists in the httpd service. The asynchronous systool instruction handling path fails to properly synchronize or safely manage concurrent systool operations. An authenticated attacker can send crafted systool instructions through the asynchronous request path, which may cause the httpd process or device management service to crash. This can lead to a device reboot or a temporary loss of access to the web management interface. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TP-Link Archer A6 (affected versions not specified) **Description** An input validation issue exists in the HTTP-WRITEOEM handler. The problem occurs because user-supplied data is not sufficiently validated before being processed by the internal flash-write handling logic. Exploiting this flaw can cause the httpd process or the device to crash, leading to a denial-of-service condition and loss of access to the web interface. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apache Tomcat versions 11.0.0-M1 through 11.0.21 Apache Tomcat versions 10.1.0-M1 through 10.1.54 Apache Tomcat versions 9.0.0.M1 through 9.0.117 **Description** An issue exists involving the allocation of resources without limits or throttling. **Recommendations** Upgrade to the fixed version for the affected versions of Apache Tomcat.

**Name of the Vulnerable Software and Affected Versions** Slican NCP versions prior to 1.24.0190 Slican IPL/IPM/IPU versions prior to 6.61.0010 **Description** Slican NCP/IPL/IPM/IPU devices are susceptible to PHP Function Injection. An unauthenticated remote attacker can execute arbitrary PHP commands by sending specially crafted requests to the `/webcti/session ajax.php` endpoint. The vulnerable parameter is not specified. **Recommendations** Update Slican NCP to version 1.24.0190 or later. Update Slican IPL/IPM/IPU to version 6.61.0010 or later.

**Name of the Vulnerable Software and Affected Versions** DirectAdmin Evolution Skin versions prior to 1.668 **Description** The ticket management system in DirectAdmin Evolution Skin is vulnerable to Cross-site Scripting (XSS), which allows a low-privileged user to inject and store malicious JavaScript code. If an admin views the ticket, the script might perform actions with their privileges, including command execution. **Recommendations** For versions prior to 1.668, upgrade to version 1.668 to fix the issue. As a temporary workaround, consider restricting access to the ticket management system to minimize the risk of exploitation. Avoid using the ticket management system until the issue is resolved by upgrading to the fixed version.

**Name of the Vulnerable Software and Affected Versions** Circontrol Raption versions through 5.6.2 **Description** The pwrstudio web application of EV Charger is vulnerable to OS command injection via three fields of the configuration menu for `ntpserver0`, `ntpserver1`, and `pingip`. This issue affects Circontrol's Raption 150 DC chargers. To mitigate risks, ensure your systems are updated to the latest version. **Recommendations** For versions through 5.6.2, update to the latest version to mitigate risks. As a temporary workaround, consider restricting access to the configuration menu fields `ntpserver0`, `ntpserver1`, and `pingip` until a patch is available.

**Name of the Vulnerable Software and Affected Versions** HyperView Geoportal Toolkit versions prior to 8.2.4 **Description** The issue concerns a Reflected Cross-Site Scripting (XSS) vulnerability. An unauthenticated attacker could trick someone into using a crafted URL, which will cause a script to be run in the user's browser. **Recommendations** For versions prior to 8.2.4, update to version 8.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable URLs to minimize the risk of exploitation. Avoid using crafted URLs that could trigger the execution of malicious scripts in the user's browser.

**Name of the Vulnerable Software and Affected Versions** HyperView Geoportal Toolkit versions prior to 8.5.0 **Description** The issue allows an unauthenticated remote attacker to prepare links that, when opened, will load scripts from a remote location controlled by the attacker and execute them in the user space. By manipulating a `GET` request parameter, it is also possible to enumerate some of the devices in the Local Area Network in which the server resides. **Recommendations** For versions prior to 8.5.0, update to a patched version as soon as possible and review access controls to mitigate the risk of unauthorized access. As a temporary workaround, consider restricting access to the vulnerable `GET` request parameter until a patch is available.

**Name of the Vulnerable Software and Affected Versions** CemiPark software versions 4.5, 4.7, 5.03 **Description** The access control in CemiPark software does not properly validate user-entered data, allowing a stored cross-site scripting (XSS) attack. The parameters used to enter data into the system lack appropriate validation, making it possible to smuggle in HTML/JavaScript code, which will be executed in the user's browser space. **Recommendations** For version 4.5, update the input validation mechanism to properly check user-entered data. For version 4.7, implement robust validation for all parameters to prevent XSS attacks. For version 5.03, ensure that all user input is sanitized and validated to prevent code injection. As a temporary workaround, consider restricting user input to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** CemiPark software versions 4.5, 4.7, 5.03 **Description** The access control in CemiPark software does not properly validate user-entered data, allowing for authentication bypass. An attacker with network access to the login panel can log in with administrator rights to the application. **Recommendations** For versions 4.5, 4.7, 5.03, consider restricting access to the login panel to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CemiPark software versions 4.5 through 5.03 **Description** The access control in CemiPark software stores integration credentials, such as FTP or SIP, in plain-text. An attacker who gains unauthorized access to the device can retrieve clear text passwords used by the system. **Recommendations** For versions 4.5 through 5.03, consider restricting access to the device to minimize the risk of exploitation. As a temporary workaround, avoid using plain-text credentials for integrations until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Circontrol Raption versions 5.11.2 and earlier **Description** The issue is a pre-authentication stack-based buffer overflow that can be exploited to gain run-time control of the device as root. The ocpp1.5 and pwrstudio binaries on the charging station lack common exploitation mitigations, including stack canaries and the Position Independent Executable (PIE) format. **Recommendations** For Circontrol Raption versions 5.11.2 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Pi-hole Web Interface versions prior to 5.5.1 **Description** The Pi-hole Web interface has a stored cross-site-scripting vulnerability in the function to add domains to blocklists or allowlists. This vulnerability exists because user input added as a wildcard domain to a blocklist or allowlist is unfiltered in the web interface, allowing for a persistent XSS vulnerability. A remote attacker can attack administrative user accounts through client-side attacks. **Recommendations** For versions prior to 5.5.1, update to Pi-hole Web Interface version 5.5.1 to resolve the issue. As a temporary workaround, consider restricting access to the blocklist and allowlist functions until the update is applied. Avoid using unfiltered user input as wildcard domains in blocklists or allowlists until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: AAT Novus Management System versions through 1.51.2 Description: A Cross Site Scripting (XSS) issue exists due to incorrect HTTP 404 error handling in the WebUI. This allows a remote, unauthenticated attacker to potentially exploit the issue by sending malicious HTTP requests to non-existing URIs. The filename from the URL path is copied into the HTML document as plain text tags, which can be used for malicious purposes. Recommendations: For versions through 1.51.2, update to a version that addresses the incorrect HTTP 404 error handling to prevent exploitation of the XSS issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Novus HTTP Server versions through 1.51.2 Description: The Novus HTTP Server is affected by a Directory Traversal vulnerability for Arbitrary File Access. A remote, unauthenticated attacker using an HTTP GET request may be able to exploit this issue to access sensitive data. Recommendations: For versions through 1.51.2, consider restricting access to sensitive data until a patch is available. As a temporary workaround, restrict access to the HTTP GET request endpoint to minimize the risk of exploitation. Avoid using the Novus HTTP Server for sensitive data storage until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.