Kelsey Tian

**Name of the Vulnerable Software and Affected Versions** Ylianst MeshCentral version 1.1.16 **Description** The issue is related to the use of a broken or risky cryptographic algorithm. **Recommendations** For Ylianst MeshCentral version 1.1.16, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** react-dashboard version 1.4.0 **Description** The issue is related to Cross Site Scripting (XSS) due to the httpOnly flag not being set. This allows an attacker to potentially inject malicious scripts into a user's session. **Recommendations** For react-dashboard version 1.4.0, set the httpOnly flag to prevent XSS attacks. As a temporary workaround, consider implementing additional security measures to restrict the execution of scripts.

**Name of the Vulnerable Software and Affected Versions** Ylianst MeshCentral version 1.1.16 **Description** The issue concerns missing SSL certificate validation. **Recommendations** For Ylianst MeshCentral version 1.1.16, consider implementing proper SSL certificate validation to mitigate the risk of exploitation. As a temporary workaround, restrict access to sensitive resources until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DeviceFarmer stf version 3.6.6 **Description** The issue is related to the use of a broken or risky cryptographic algorithm. **Recommendations** For DeviceFarmer stf version 3.6.6, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DoraCMS version 2.1.8 **Description** The issue is related to the use of a hard-coded cryptographic key. **Recommendations** For DoraCMS version 2.1.8, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Ylianst MeshCentral version 1.1.16 **Description** An algorithm-downgrade issue was discovered. **Recommendations** For Ylianst MeshCentral version 1.1.16, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** blinksocks version 3.3.8 **Description** An issue was discovered in the component `/presets/ssr-auth-chain.js`, allowing remote attackers to obtain sensitive information via weak encryption algorithms. **Recommendations** For blinksocks version 3.3.8, consider disabling the `/presets/ssr-auth-chain.js` component until a patch is available to mitigate the risk of sensitive information disclosure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** nos client version 0.6.6 **Description** An issue was discovered in the nos client, allowing remote attackers to escalate privileges via the getRPCEndpoint.js file. **Recommendations** For nos client version 0.6.6, consider disabling the getRPCEndpoint.js file as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** bill-ahmed qbit-matUI version 1.16.4 **Description** The issue is a Cross-Site Scripting (XSS) vulnerability that allows remote attackers to obtain sensitive information via fixed session identifiers (SID) in the index.js file. This vulnerability enables attackers to exploit the fixed session identifiers to gain access to sensitive information. **Recommendations** For bill-ahmed qbit-matUI version 1.16.4, consider updating to a newer version that addresses the Cross-Site Scripting (XSS) vulnerability, or as a temporary workaround, restrict access to the index.js file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** bcoin versions 2.2.0 **Description** An issue was discovered that allows remote attackers to obtain sensitive information via weak hashing algorithms in the component `vendorfaye-websocket.js`. This issue affects the bsock component. **Recommendations** For version 2.2.0, consider disabling the use of weak hashing algorithms in the `vendorfaye-websocket.js` component until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.