Ege Balci

**Name of the Vulnerable Software and Affected Versions** Seagate Central NAS versions STCG2000300, STCG3000300, and STCG4000300 **Description** The web-management application on the affected devices allows OS command injection via `mv backend launch` in `cirrus/application/helpers/mv backend helper.php` by leveraging the "start" state and sending a `check device name` request. **Recommendations** For versions STCG2000300, STCG3000300, and STCG4000300, consider restricting access to the `mv backend launch` function in `cirrus/application/helpers/mv backend helper.php` to minimize the risk of exploitation. As a temporary workaround, avoid sending `check device name` requests when the device is in the "start" state until a patch is available.

**Name of the Vulnerable Software and Affected Versions** rsync versions prior to 3.2.5 **Description** An issue in rsync allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories, for example, overwrite the .ssh/authorized keys file. **Recommendations** For versions prior to 3.2.5, update to version 3.2.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the rsync client target directory and subdirectories to minimize the risk of exploitation. Avoid using the rsync client with untrusted servers until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** LG LNB*, LND*, LNU*, and LNV* smart network camera devices (affected versions not specified) **Description** The issue concerns broken access control in the devices, allowing attackers to download sensitive files without authentication. Specifically, attackers can access `/updownload/t.report` (also known as Log & Report) files and backup files via `download.php`. These backup files contain user credentials and configuration information for the camera device. An attacker can discover the backup filename by reading system logs or report data, or by brute-forcing the backup filename pattern. This could potentially allow an attacker to authenticate to the admin account using the admin password. **Recommendations** For LG LNB*, LND*, LNU*, and LNV* smart network camera devices, consider restricting access to the `download.php` endpoint and the `/updownload/t.report` file to minimize the risk of exploitation. Avoid using default or weak admin passwords, and ensure that all user credentials are securely stored. As a temporary workaround, consider disabling the backup file download feature until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** F5 BIG-IP (affected versions not specified) **Description** A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may exploit this issue to obtain Secure Sockets Layer (SSL) session IDs from other sessions. It is possible that other data from uninitialized memory may be returned as well. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.