Narendra Shinde

Name of the Vulnerable Software and Affected Versions: X.Org Server versions prior to 1.20.3 Description: The issue is caused by incorrect handling and validation of command line parameters, specifically the `modulepath` and `logfile` options when starting the Xorg server. This could allow a remote attacker to gain elevated privileges on the system, potentially leading to the execution of arbitrary code under root privileges. The vulnerability can be exploited by using the `-modulepath` or `-logfile` arguments to overwrite arbitrary files on the system. Recommendations: For versions prior to 1.20.3, update to version 1.20.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the `modulepath` and `logfile` options when starting the Xorg server to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Schneider Electric ETG3000 FactoryCast HMI Gateway versions through 1.60 IR 04 **Description** The issue concerns hardcoded credentials in the FTP server, making it easier for remote attackers to gain access via an FTP session. **Recommendations** For versions through 1.60 IR 04, consider disabling the FTP server or restricting its access until a patch is available to remove the hardcoded credentials.

**Name of the Vulnerable Software and Affected Versions** Yealink VOIP Phones (affected versions not specified) **Description** The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the Local Phone book and Blacklist form of Yealink VOIP Phones. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via the `user` field to the "cgi-bin/ConfigManApp.com" API endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Datum Systems SnIP on PSM-500 and PSM-4500 devices (affected versions not specified) **Description** The issue allows remote attackers to obtain sensitive information without requiring authentication for FTP sessions. This can be achieved via RETR commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Datum Systems SnIP on PSM-500 and PSM-4500 devices (affected versions not specified) **Description** The issue allows remote attackers to obtain access via unspecified vectors due to a hardcoded password of `admin` for the `admin` account. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MailEnable Professional, Enterprise, and Premium versions 4.26 and earlier, 5.x before 5.53, 6.x before 6.03 **Description** A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `Username` parameter in ForgottenPassword.aspx. **Recommendations** For versions 4.26 and earlier, update to version 4.27 or later. For versions 5.x before 5.53, update to version 5.53 or later. For versions 6.x before 6.03, update to version 6.03 or later. As a temporary workaround, consider restricting access to the ForgottenPassword.aspx page until a patch is available. Avoid using the `Username` parameter in the affected ForgottenPassword.aspx page until the issue is resolved.