Emreovunc

**Name of the Vulnerable Software and Affected Versions** Nagios XI version 5.7.1 **Description** The issue allows remote attackers to run arbitrary code via the `returnUrl` parameter in a crafted GET request. This is a Cross Site Scripting (XSS) issue. **Recommendations** For Nagios XI version 5.7.1, avoid using the `returnUrl` parameter in GET requests until a fix is available. As a temporary workaround, consider restricting access to the affected endpoint to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Medintux version 2.16.000 Description: The issue is related to Reflected XSS in Medintux, where an attacker can manipulate the `mot1` parameter in CCAM.php to perform malicious actions on users who open a maliciously crafted link or third-party web page. Recommendations: For Medintux version 2.16.000, consider restricting access to the CCAM.php page or disabling the manipulation of the `mot1` parameter until a patch is available. As a temporary workaround, avoid using the `mot1` parameter in the affected page to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: FHEM version 6.0 Description: The issue allows an attacker to include a file using the `file` parameter in `fhem/FileLog logWrapper`, potentially leading to sensitive information disclosure. Recommendations: For FHEM version 6.0, consider restricting access to the `file` parameter in `fhem/FileLog logWrapper` to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Vtiger CRM version 7.2.0 Description: The issue is related to Reflected XSS in Vtiger CRM, where an attacker can perform malicious actions on users who open a maliciously crafted link or third-party web page through the `view` parameter in `vtigercrm/index.php`. Recommendations: For Vtiger CRM version 7.2.0, consider disabling access to the `vtigercrm/index.php` endpoint until a patch is available, or restrict the use of the `view` parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Vtiger CRM version 7.2.0 Description: The issue allows an attacker to display hidden files and list directories by utilizing the `/libraries` and `/layout` directories. Recommendations: For Vtiger CRM version 7.2.0, consider restricting access to the `/libraries` and `/layout` directories as a temporary workaround until a patch is available.

Name of the Vulnerable Software and Affected Versions: Nagios Log Server version 2.1.7 Description: The issue is a cross-site scripting (XSS) vulnerability. It is located in the `/nagioslogserver/configure/create snapshot` API endpoint through the `snapshot name` parameter. This may impact users who open a maliciously crafted link or third-party web page. Recommendations: For Nagios Log Server version 2.1.7, consider disabling access to the `/nagioslogserver/configure/create snapshot` API endpoint until a patch is available. Additionally, restrict the use of the `snapshot name` parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Web Port version 1.19.1 **Description** The issue allows for XSS via the /access/setup `type` parameter. **Recommendations** For version 1.19.1, avoid using the `type` parameter in the /access/setup API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Web Port version 1.19.1 **Description** The issue allows for XSS via the /log `type` parameter. **Recommendations** For version 1.19.1, avoid using the `type` parameter in the /log API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Eaton Intelligent Power Manager version 1.6 **Description** The issue allows an attacker to perform a local file inclusion via directory traversal in the server/node upgrade srv.js. This is achieved by manipulating the `firmware` parameter in a `downloadFirmware` action. **Recommendations** For Eaton Intelligent Power Manager version 1.6, consider restricting access to the `downloadFirmware` action and the `firmware` parameter to minimize the risk of exploitation. As a temporary workaround, avoid using the `firmware` parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** mySCADA myPRO version 7 **Description** The issue allows remote attackers to access the FTP server on port 2121, upload files, or list directories by using a hardcoded FTP username and password. The hardcoded credentials are `username` set to 'myscada' and `password` set to 'Vikuk63' in the 'myscadagate.exe' file. **Recommendations** For mySCADA myPRO version 7, consider changing the hardcoded FTP credentials to secure ones, and restrict access to the FTP server on port 2121 until a patch is available. As a temporary workaround, restrict the use of the 'myscadagate.exe' file to minimize the risk of exploitation.