Michele Di Bonaventura

**Name of the Vulnerable Software and Affected Versions** Typecho version 1.3.0 **Description** A stored cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload. This enables attackers to potentially steal user data or take control of user sessions. **Recommendations** For Typecho version 1.3.0, update to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting user input to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Typecho version 1.3.0 **Description** The issue allows attackers to falsify their IP addresses by specifying an arbitrary IP as the value of `X-Forwarded-For` or `Client-Ip` headers while performing HTTP requests. This is a Client IP Spoofing issue. **Recommendations** For Typecho version 1.3.0, as a temporary workaround, consider restricting the use of the `X-Forwarded-For` and `Client-Ip` headers until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Typecho version 1.3.0 **Description** A race condition issue was found in the post commenting function, allowing attackers to post multiple comments before spam protection checks are applied, particularly if comments are posted at a high frequency. **Recommendations** For Typecho version 1.3.0, as a temporary workaround, consider disabling the post commenting function until a patch is available. Restrict access to the commenting module to minimize the risk of exploitation. Avoid using the commenting feature in rapid succession to reduce the likelihood of bypassing spam protection checks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GL.iNET GL-AR300M version 4.3.7 **Description** The issue allows an attacker to write arbitrary files through a path traversal attack in the OpenVPN client file upload functionality. This can potentially lead to unauthorized access and modification of sensitive data on the affected device. **Recommendations** For version 4.3.7, consider disabling the OpenVPN client file upload functionality until a patch is available to prevent exploitation through path traversal attacks. Restrict access to the OpenVPN client to minimize the risk of unauthorized file writes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GL.iNET GL-AR300M version 4.3.7 **Description** The issue allows for the injection of arbitrary shell commands through a crafted package name in the package information functionality. This can potentially lead to unauthorized access and control of the device. **Recommendations** For version 4.3.7, consider restricting access to the package information functionality until a patch is available. As a temporary workaround, avoid using the package information feature to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GL.iNET GL-AR300M version 3.216 **Description** The issue allows for the injection of arbitrary shell commands through the OpenVPN client file upload functionality. This can potentially lead to remote code execution. **Recommendations** For version 3.216, consider disabling the OpenVPN client file upload functionality until a patch is available. Restrict access to the vulnerable functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Yellowfin versions prior to 9.6.1 **Description** The issue is related to a Stored Cross-Site Scripting vulnerability in the video embed functionality. It can be exploited through a specially crafted HTTP POST request to the page "ActivityStreamAjax.i4". **Recommendations** For versions prior to 9.6.1, update to version 9.6.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the "ActivityStreamAjax.i4" page to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Yellowfin versions prior to 9.6.1 **Description** The issue allows enumeration and download of uploaded images through an Insecure Direct Object Reference vulnerability. This can be exploited by sending a specially crafted HTTP GET request to the "MIImage.i4" page. **Recommendations** For versions prior to 9.6.1, update to version 9.6.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the "MIImage.i4" page to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Yellowfin versions prior to 9.6.1 **Description** The issue allows enumeration and download of users' profile pictures through an Insecure Direct Object Reference vulnerability. This can be exploited by sending a specially crafted HTTP GET request to the "MIIAvatarImage.i4" page. **Recommendations** For versions prior to 9.6.1, update to version 9.6.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the "MIIAvatarImage.i4" page to minimize the risk of exploitation.