John Jackson

**Name of the Vulnerable Software and Affected Versions** Quadient DS-700 iQ devices through 2025-09-30 **Description** Quadient DS-700 iQ devices may experience a race condition when quickly clicking the Question Mark button, the Help Button, the About button, and the Help Button in sequence. This can potentially lead to a transition from kiosk mode to local administrative access. The issue was observed sporadically during limited testing, raising some doubt about the reproducibility of a cybersecurity issue, as sporadic crashes could also be caused by hardware faults. The reporter also noted other issues, such as potential access via USB due to a lack of physical security measures, which are not considered cybersecurity issues. The risks are potentially limited to insider threats within a controlled environment. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows WLAN AutoConfig Service (affected versions not specified) **Description** An elevation-of-privilege issue allows attackers to affect the system. The issue is related to the lack of authentication for a critical function in the Windows WLAN AutoConfig Service. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. Technical details about exploitation, such as specific API endpoints, vulnerable parameters, or function names, are not provided. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Natus NeuroWorks and SleepWorks versions prior to 8.4 GMA3 **Description** The issue arises from the use of a default password `xltek` for the Microsoft SQL Server service `sa` account in Natus NeuroWorks and SleepWorks. This allows a threat actor to perform remote code execution, data exfiltration, or other malicious actions such as tampering with data or destroying/disrupting MSSQL services. **Recommendations** For versions prior to 8.4 GMA3, update to version 8.4 GMA3 or later to resolve the issue. As a temporary workaround, consider changing the default password `xltek` for the Microsoft SQL Server service `sa` account to a strong, unique password. Restrict access to the Microsoft SQL Server service to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WatsonWebserver versions 4.1.3 and below IpMatcher versions 1.0.4.1 and below **Description** An Input Validation issue exists due to insufficient validation of input IP addresses and netmasks against the internal Matcher list of IP addresses and subnets. **Recommendations** For WatsonWebserver versions 4.1.3 and below, update to a version above 4.1.3 to resolve the issue. For IpMatcher versions 1.0.4.1 and below, update to a version above 1.0.4.1 to resolve the issue. As a temporary workaround, consider restricting the input of IP addresses and netmasks to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Studio 42 elFinder versions 2.1.31 and earlier **Description** The issue allows for XSS via an SVG document. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited. **Recommendations** For versions 2.1.31 and earlier, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** XenForo versions 2.2.7 and earlier **Description** A threat actor with access to the admin panel can create a new Advertisement via the Advertising function and save an XSS payload in the body of the HTML document. This payload will execute globally on the client side. **Recommendations** For XenForo versions 2.2.7 and earlier, as a temporary workaround, consider disabling the Advertising function until a patch is available. Restrict access to the admin panel to minimize the risk of exploitation. Avoid using the Advertising function to save HTML documents that may contain malicious payloads until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Marmoset Viewer WordPress plugin versions prior to 1.9.3 **Description** The issue is related to a reflected Cross-Site Scripting problem. It occurs because the `id` parameter is not properly sanitized, validated, or escaped before being outputted back in the page. **Recommendations** For versions prior to 1.9.3, update to version 1.9.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the `id` parameter in the affected plugin until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Rust versions prior to 1.53.0 **Description** The issue is related to the improper handling of extraneous zero characters at the beginning of an IP address string in the library/std/src/net/parser.rs file. This can allow attackers to bypass access control based on IP addresses due to unexpected octal interpretation, potentially leading to data integrity violations and denial of service. **Recommendations** For Rust versions prior to 1.53.0, update to version 1.53.0 or later to resolve the issue. As a temporary workaround, consider restricting access to IP addresses that may be interpreted incorrectly due to octal representation. Avoid using IP addresses with leading zeros in configurations until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: netmask npm package versions 1.0.6 and below netmask npm package versions 2.0.0 Description: The issue is related to improper input validation of octal strings in the netmask npm package, allowing unauthenticated remote attackers to perform server-side request forgery (SSRF), remote file inclusion (RFI), and local file inclusion (LFI) attacks. This vulnerability can be exploited to bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts. The netmask package is used by over 270,000 projects and has around 3 million downloads per week. Recommendations: For netmask npm package versions 1.0.6 and below: Upgrade to version 2.0.1 or later to ensure complete protection from this vulnerability. For netmask npm package version 2.0.0: Upgrade to version 2.0.1 or later, as the initial fix in version 2.0.0 was incomplete.

Name of the Vulnerable Software and Affected Versions: Keybase Desktop Client versions prior to 5.6.0 on Windows and macOS Keybase Desktop Client versions prior to 5.6.1 on Linux Description: The issue allows an attacker to obtain potentially sensitive media, such as private pictures, in the Cache and uploadtemps directories. This occurs because the client fails to effectively clear cached pictures, even after deletion via normal methodology within the client, or by utilizing the "Explode message/Explode now" functionality. Local filesystem access is needed by the attacker. Recommendations: For versions prior to 5.6.0 on Windows and macOS, update to version 5.6.0 or later. For versions prior to 5.6.1 on Linux, update to version 5.6.1 or later. As a temporary workaround, consider restricting access to the Cache and uploadtemps directories until a patch is applied.