Omri Inbar

NuBrowser lacks protocol whitelist validation for the S.browser fallback url field of intent://, allowing attackers to inject javascript: URLs via 302 redirects. This results in a universal cross‑site scripting (UXSS) vulnerability that enables script execution within the origin of arbitrary websites.

**Name of the Vulnerable Software and Affected Versions** Samsung WLAN AP WEA453e versions prior to 5.2.4.T1 **Description** An unauthenticated remote command execution issue exists due to improper input validation in the “Tech Support” diagnostic functionality. The `command1` and `command2` POST or GET parameters accept arbitrary shell commands that are executed with root privileges. An attacker can exploit this by crafting a request to inject shell commands, create output files in writable directories, and then access their contents via the download endpoint, leading to complete device compromise without authentication. **Recommendations** Update to version 5.2.4.T1 or later.

**Name of the Vulnerable Software and Affected Versions** SVI MS Management System versions all **Description** The issue is related to insecure deserialization of user-supplied content in the Java Remote Management Interface, allowing attackers to execute arbitrary code via a crafted serialized Java object. This can be exploited by a remote attacker. **Recommendations** For all versions, consider disabling the Java Remote Management Interface until a patch is available to prevent exploitation. Restrict access to the interface to minimize the risk of arbitrary code execution. Avoid using user-supplied content in the interface until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Totolink N200RE and N100RE Routers version 2.0 **Description** A cross site scripting (XSS) vulnerability in the error page of the routers allows attackers to execute arbitrary web scripts or HTML via SCRIPT element. **Recommendations** For Totolink N200RE and N100RE Routers version 2.0, consider disabling the error page or restricting access to it until a patch is available. Avoid using the SCRIPT element in the error page to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Xtend Voice Logger version 1.0 **Description** A reflected cross site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML, via the path of the error page. This could potentially lead to unauthorized actions on the affected system. **Recommendations** For Xtend Voice Logger version 1.0, consider disabling the error page or restricting access to it until a patch is available. As a temporary workaround, avoid using the error page functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Webuzo versions prior to 2.9.0 **Description** A Cross Site Scripting (XSS) issue exists in the admin panel of Webuzo via an HTTP request to a non-existent page. This is triggered when administrators view the "Error Log" page. An attacker can exploit this to achieve Unauthenticated Remote Code Execution through the "Cron Jobs" functionality. **Recommendations** For versions prior to 2.9.0, update to version 2.9.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the "Error Log" page and the "Cron Jobs" functionality to minimize the risk of exploitation.