Johnjhacking

**Name of the Vulnerable Software and Affected Versions** XenForo versions 2.2.7 and earlier **Description** A threat actor with access to the admin panel can create a new Advertisement via the Advertising function and save an XSS payload in the body of the HTML document. This payload will execute globally on the client side. **Recommendations** For XenForo versions 2.2.7 and earlier, as a temporary workaround, consider disabling the Advertising function until a patch is available. Restrict access to the admin panel to minimize the risk of exploitation. Avoid using the Advertising function to save HTML documents that may contain malicious payloads until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TCL Android Smart TV series V8-R851T02-LF1 versions V295 and below TCL Android Smart TV series V8-T658T01-LF1 versions V373 and below **Description** A vulnerability in the TCL Android Smart TV series allows an attacker on the adjacent network to arbitrarily browse and download sensitive files over an insecure web server running on port 7989 that lists all files & directories. An unprivileged remote attacker on the adjacent network can download most system files, leading to serious critical information disclosure. Some TV models and/or firmware versions may expose the web server with the entire file system accessible on another port. **Recommendations** For TCL Android Smart TV series V8-R851T02-LF1 versions V295 and below: As a temporary workaround, consider disabling access to the insecure web server running on port 7989 until a patch is available. For TCL Android Smart TV series V8-T658T01-LF1 versions V373 and below: Restrict access to the web server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TCL Android Smart TV series V8-R851T02-LF1 versions V295 and below TCL Android Smart TV series V8-T658T01-LF1 versions V373 and below **Description** A local unprivileged attacker, such as a malicious App, can read and write to the `/data/vendor/tcl`, `/data/vendor/upgrade`, and `/var/TerminalManager` directories within the TV file system. This allows an attacker, such as a malicious APK or local unprivileged user, to perform fake system upgrades by writing to the `/data/vendor/upgrade` folder. **Recommendations** For TCL Android Smart TV series V8-R851T02-LF1 versions V295 and below: consider restricting access to the `/data/vendor/tcl`, `/data/vendor/upgrade`, and `/var/TerminalManager` directories to prevent unauthorized read and write operations. For TCL Android Smart TV series V8-T658T01-LF1 versions V373 and below: consider restricting access to the `/data/vendor/tcl`, `/data/vendor/upgrade`, and `/var/TerminalManager` directories to prevent unauthorized read and write operations. At the moment, there is no information about a newer version that contains a fix for this vulnerability.