John

**Name of the Vulnerable Software and Affected Versions** Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration versions prior to 3.5 **Description** Authenticated users with Subscriber-level access and above can perform unauthorized installation and activation of the ProfileGrid plugin. This occurs because the `pg install profilegrid()` function, handled via the `wp ajax pg install profilegrid` AJAX endpoint, lacks proper capability checks and nonce validation. A nonce is a unique token used to protect against cross-site request forgery by verifying that the request was intentionally sent by the user. **Recommendations** Update the plugin to a version later than 3.4.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An issue exists in the fair scheduler (`sched/fair`) regarding the tracking of `zero vruntime`. When two runnable tasks repeatedly perform a yield operation, they can enter a state where they leapfrog each other. Because `zero vruntime` is only updated during ticks or full enqueue/dequeue operations, and not during ` enqueue entity()` or ` dequeue entity()` calls from `put prev task()` or `set next task()`, the tracking can fall behind. If these tasks reach an overflow point within a single tick's duration, it can lead to system instability. This risk is further increased when multiple cgroups (control groups, a Linux kernel feature that limits, accounts for, and isolates the resource usage of a collection of processes) are involved, as there is no guarantee that every cgroup will receive a tick in a timely manner. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iRZ Mobile Routers through 2022-03-16 **Description** A CSRF issue in "/api/crontab" allows a threat actor to create a crontab entry in the router administration panel. The cronjob will execute the entry on the threat actor's defined interval, leading to remote code execution and filesystem access. If the router's default credentials are not rotated or a threat actor discovers valid credentials, remote code execution can be achieved without user interaction. **Recommendations** For iRZ Mobile Routers through 2022-03-16, consider disabling access to the "/api/crontab" endpoint until a patch is available. Additionally, ensure that default credentials are rotated and secure credentials are used to prevent remote code execution without user interaction. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Gurock TestRail versions prior to 7.2.0.3014 **Description** The issue is related to improper access control, resulting in sensitive information exposure. A threat actor can access the "/files.md5" file on the client side of a Gurock TestRail application, disclosing a full list of application files and the corresponding file paths. These file paths can be tested, potentially leading to the disclosure of hardcoded credentials, API keys, or other sensitive data. **Recommendations** For versions prior to 7.2.0.3014, update to version 7.2.0.3014 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/files.md5" file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 2021-08-14 **Description** The issue allows for tweb/ft.php?u= attacks, which can lead to XSS attacks. **Recommendations** For Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 2021-08-14, as a temporary workaround, consider restricting access to the tweb/ft.php endpoint until a patch is available. Avoid using the `u` parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PilusCart version 1.4.1 **Description** The issue allows for a CSRF attack via the "index.php?module=users&action=newUser" endpoint, potentially leading to the addition of a new user with administrator privileges. **Recommendations** For PilusCart version 1.4.1, as a temporary workaround, consider restricting access to the "index.php?module=users&action=newUser" endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Free MP3 CD Ripper version 2.6 **Description** The issue is a stack-based buffer overflow that occurs when converting a file, allowing remote attackers to execute arbitrary code via a crafted .mp3 file. This can be exploited with user assistance. **Recommendations** For Free MP3 CD Ripper version 2.6, update to a newer version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Free MP3 CD Ripper version 2.6 **Description** The issue is a stack-based buffer overflow that occurs when converting a file, allowing remote attackers to execute arbitrary code via a crafted .wma file. This can be exploited when a user assists the attack, such as by opening a malicious file. **Recommendations** For Free MP3 CD Ripper version 2.6, avoid converting .wma files from untrusted sources until a patch is available. As a temporary workaround, consider disabling the file conversion feature to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Thinkst Canarytokens through commit hash 4e89ee0 (2019-03-01) **Description** The issue makes it easier for attackers to estimate whether a Word document contains a token, due to limited variation in size, metadata, and timestamp. **Recommendations** For Thinkst Canarytokens through commit hash 4e89ee0 (2019-03-01), at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Vembu StoreGrid version 4.4.x **Description** The issue concerns Vembu StoreGrid, where there is XSS in several PHP files, including interface/registercustomer/onlineregsuccess.php, interface/registerreseller/onlineregfailure.php, interface/registerclient/onlineregfailure.php, and interface/registercustomer/onlineregfailure.php. **Recommendations** For Vembu StoreGrid version 4.4.x, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Vembu StoreGrid version 4.4.x **Description** The issue concerns the server web interface of Vembu StoreGrid, where the front page leaks the private IP address. This leak occurs due to incorrect processing of an index.php trailing slash, which discloses the private IP address in the `ipaddress` hidden form value of the HTML source code. **Recommendations** For Vembu StoreGrid version 4.4.x, consider modifying the index.php page to correctly process trailing slashes and remove the disclosure of the private IP address in the `ipaddress` hidden form value. As a temporary workaround, restrict access to the server web interface to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WaveMaker Studio version 6.6 **Description** The issue in WaveMaker Studio arises from the mishandling of the `studioService.download` method, specifically with the `inUrl` parameter. This mishandling leads to the disclosure of local files and enables Server-Side Request Forgery (SSRF) attacks. SSRF occurs when an attacker can manipulate a server into making requests to internal or external resources, potentially leading to unauthorized access or information disclosure. **Recommendations** For WaveMaker Studio version 6.6, as a temporary workaround, consider restricting access to the `studioService.download` method, especially for the `inUrl` parameter, until a patch is available. Additionally, avoid using the `inUrl` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HAProxy package before 0.59 16 for pfSense **Description** The issue is related to Cross-Site Scripting (XSS) via the `desc` (also known as Description) or `table actionsaclN` parameter. This is connected to the files `haproxy listeners.php` and `haproxy listeners edit.php`. **Recommendations** For HAProxy package before 0.59 16 for pfSense, update to version 0.59 16 or later to resolve the issue. As a temporary workaround, consider restricting access to the `haproxy listeners.php` and `haproxy listeners edit.php` files to minimize the risk of exploitation. Avoid using the `desc` and `table actionsaclN` parameters in the affected API endpoints until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Asterisk Open Source versions 13.x before 13.21.1 Asterisk Open Source versions 14.x before 14.7.7 Asterisk Open Source versions 15.x before 15.4.1 Certified Asterisk versions 13.18-cert before 13.18-cert4 Certified Asterisk versions 13.21-cert before 13.21-cert2 **Description** An issue in Asterisk allows disclosure of which requests hit a defined endpoint when endpoint-specific ACL rules block a SIP request. Normally, blocked requests respond with a 403 forbidden. However, if an endpoint is not identified, a 401 unauthorized response is sent instead. This does not allow ACL rules to be bypassed to gain access to the disclosed endpoints. **Recommendations** For Asterisk Open Source versions 13.x before 13.21.1, update to version 13.21.1 or later. For Asterisk Open Source versions 14.x before 14.7.7, update to version 14.7.7 or later. For Asterisk Open Source versions 15.x before 15.4.1, update to version 15.4.1 or later. For Certified Asterisk versions 13.18-cert before 13.18-cert4, update to version 13.18-cert4 or later. For Certified Asterisk versions 13.21-cert before 13.21-cert2, update to version 13.21-cert2 or later.

**Name of the Vulnerable Software and Affected Versions** AMD Ryzen processor with AGESA microcode through 2017-01-27 **Description** The issue allows local users to cause a denial of service, resulting in a system hang, by executing a long series of FMA3 instructions. This can be demonstrated using the Flops test suite. **Recommendations** For AMD Ryzen processor with AGESA microcode through 2017-01-27, consider avoiding the execution of long series of FMA3 instructions to prevent system hangs. As a temporary workaround, restrict the use of applications that heavily utilize FMA3 instructions until a fix is available.

**Name of the Vulnerable Software and Affected Versions** SolarWinds Orion Network Performance Monitor (NPM) version 10.1 **Description** The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters in various pages, including the `Title` parameter to "MapView.aspx", `NetObject` parameter to "NodeDetails.aspx" and "InterfaceDetails.aspx", and the `ChartName` parameter to "CustomChart.aspx". **Recommendations** For SolarWinds Orion Network Performance Monitor (NPM) version 10.1, consider restricting access to the vulnerable parameters `Title`, `NetObject`, and `ChartName` in the respective API endpoints "MapView.aspx", "NodeDetails.aspx", "InterfaceDetails.aspx", and "CustomChart.aspx" until a patch is available. Avoid using these parameters in the affected API endpoints to minimize the risk of exploitation.