Patrick Hener

**Name of the Vulnerable Software and Affected Versions** IPW Systems Metazo versions 8.1.3 and earlier **Description** The issue allows for unauthenticated Remote Code Execution because `smartyValidator.php` enables the attacker to provide template expressions, also known as Server-Side Template-Injection. All instances have been patched by the supplier. **Recommendations** For IPW Systems Metazo version 8.1.3 and earlier, update to a patched version to resolve the issue. As a temporary workaround, consider disabling the `smartyValidator.php` file until a patch is available. Restrict access to the `smartyValidator.php` file to minimize the risk of exploitation. Avoid using template expressions in the affected API endpoints until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Kardex Mlog MCC version 5.7.12+0-a203c2a213-master **Description** The issue is related to incorrect code generation management in the Kardex Mlog Control Center (MCC) module. This allows a remote attacker to execute arbitrary code. The software spawns a web interface listening on port 8088. A user-controllable path is handed to a path-concatenation method (`Path.Combine` from .NET) without proper sanitization, allowing the inclusion of local files and remote files on SMB shares. If a file with the extension `.t4` is provided, it is rendered with the .NET templating engine `mono/t4`, which can execute code. **Recommendations** As a temporary workaround, consider disabling the `Path.Combine` method until a patch is available. Restrict access to the web interface listening on port 8088 to minimize the risk of exploitation. Avoid using files with the extension `.t4` in the affected software until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AFI WebACMS versions through 2.1.0 **Description** A Cross Site Scripting (XSS) issue exists in the index.html file of AFI WebACMS via the `ID` parameter. This allows for potential malicious script execution. **Recommendations** For versions through 2.1.0, consider restricting access to the index.html file or disabling the `ID` parameter to minimize the risk of exploitation until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Secudos Qiata FTA version 1.70.19 **Description** An issue was discovered that allows persistent XSS, which is executed when reading transfer comments or the global notice board, due to a flaw in the comment feature. **Recommendations** For Secudos Qiata FTA version 1.70.19, consider disabling the comment feature as a temporary workaround until a patch is available. Restrict access to the global notice board to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** INNEO Startup TOOLS versions 2017 M021 12.0.66.3784 through 2018 M040 13.0.70.3804 **Description** An issue in the sut srv.exe web application allows user input to be included into a filesystem access without validation, potentially enabling an unauthenticated attacker to read files on the server via Directory Traversal. This could have unspecified other impact. **Recommendations** For versions 2017 M021 12.0.66.3784 through 2018 M040 13.0.70.3804, consider restricting access to the sut srv.exe web application served on TCP port 85 until a fix is available. As a temporary workaround, restrict filesystem access to prevent unauthorized file reading.