Quan Le

**Name of the Vulnerable Software and Affected Versions** auth0-js versions 8.11.0 through 9.32.0 **Description** Improper validation in the Auth0.js SDK may allow the return of user profile data when a specifically crafted invalid ID token is used in conjunction with a valid access token. This issue occurs in applications where access control relies on rules defined in Auth0 Actions, potentially leading to unauthorized information disclosure. **Recommendations** Update auth0-js to version 10.0.0 or greater.

**Name of the Vulnerable Software and Affected Versions** Spring AI versions 1.0.0 through 1.0.5 Spring AI versions 1.1.0 through 1.1.4 **Description** Various `FilterExpressionConverter` implementations fail to properly escape keys and values when translating filter expression objects into specific vector store query languages. This improper escaping allows for query injection, which can enable attackers to alter vector store queries, potentially leading to data exposure and tampering. **Recommendations** Update versions 1.0.0 through 1.0.5 to 1.0.6. Update versions 1.1.0 through 1.1.4 to 1.1.5.

**Name of the Vulnerable Software and Affected Versions** Mitsubishi Electric MELSEC iQ-F Series CPU module (affected versions not specified) **Description** A missing authentication feature in the MODBUS/TCP implementation of the Mitsubishi Electric MELSEC iQ-F Series CPU module allows a remote, unauthenticated attacker to read or write device values and stop program operation. The vulnerability stems from the lack of authentication features within the MODBUS/TCP protocol used by the product. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module (affected versions not specified) **Description** A cleartext transmission issue exists in the Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module. A remote, unauthenticated attacker can intercept SLMP communication messages to obtain credential information. This allows the attacker to read or write device values and potentially stop program operations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module (affected versions not specified) Description: An improper handling of a length parameter inconsistency exists in the web server function of the product. This allows a remote, unauthenticated attacker to delay processing of the web server function and prevent legitimate users from utilizing it by sending a specially crafted HTTP request. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric MELSEC iQ-F Series (affected versions not specified) Description: The software contains an overly restrictive account lockout mechanism. A remote, unauthenticated attacker can lockout legitimate users by repeatedly attempting to log in with incorrect passwords. This prevents legitimate users from logging in for a specific duration or until the product is reset. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.