Maurizio Ruchay

**Name of the Vulnerable Software and Affected Versions** SmartNode SN200 (aka SN200) version 3.21.2-23021 **Description** The issue is related to the Network Diagnostic Commands function of the SmartNode SN200 analog telephone adapter's firmware, which fails to neutralize special elements used in an operating system command. This allows for unauthenticated OS Command Injection, potentially enabling a remote attacker to impact the confidentiality, integrity, and availability of protected information. **Recommendations** For SmartNode SN200 version 3.21.2-23021, consider disabling the Network Diagnostic Commands function as a temporary workaround until a patch is available. Restrict access to the vulnerable function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PHP Event Calendar versions prior to 2021-09-03 **Description** The issue allows SQL injection, as demonstrated by the "/server/ajax/user manager.php" endpoint, specifically the `username` parameter. This can be used to execute SQL statements directly on the database, potentially allowing an adversary to compromise the database system or bypass the login form. **Recommendations** For versions prior to 2021-09-03, update to a version released after 2021-09-03 to resolve the issue. As a temporary workaround, consider restricting access to the "/server/ajax/user manager.php" endpoint or sanitizing the `username` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** PHP Event Calendar through 2021-11-04 **Description** The issue allows for persistent cross-site scripting (XSS) and can be exploited by an adversary in multiple ways, such as performing actions on the page in the context of other users or defacing the site. This is demonstrated by the `/server/ajax/events manager.php` API endpoint, specifically the `title` parameter. **Recommendations** For PHP Event Calendar through 2021-11-04, consider disabling the `/server/ajax/events manager.php` API endpoint or restricting access to the `title` parameter until a patch is available. As a temporary workaround, avoid using the `title` parameter in the affected API endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TTiny Java Web Server and Servlet Container (TJWS) versions <=1.115 **Description** A reflected cross-site scripting (XSS) issue allows an adversary to inject malicious code on the server's "404 Page not Found" error page. This occurs in the web server TTiny Java Web Server and Servlet Container (TJWS). **Recommendations** For versions <=1.115, update to a version greater than 1.115 to resolve the issue. As a temporary workaround, consider restricting access to the "404 Page not Found" error page until a patch is available.