Tejas Nitin Pingulkar

**Name of the Vulnerable Software and Affected Versions** Maharashtra State Electricity Distribution Company Limited Mahavitran IOS Application version 16.1 **Description** The issue concerns the Maharashtra State Electricity Distribution Company Limited Mahavitran IOS Application, which uses the GET method to process requests containing sensitive information, such as `user account name` and `password`. This can lead to exposure of the sensitive information through the browser's history, referrers, web logs, and other sources. **Recommendations** For version 16.1, consider modifying the application to use a more secure method, such as the POST method, to process requests containing sensitive information, and ensure that sensitive data like `user account name` and `password` are properly encrypted and protected. As a temporary workaround, restrict access to the application's history and referrers to minimize the risk of sensitive information exposure.

**Name of the Vulnerable Software and Affected Versions** Wondershare Filmora version 9.2.11 **Description** The issue is related to Trojan Dll hijacking, which can lead to privilege escalation. **Recommendations** For version 9.2.11, update to a newer version that contains a fix for this issue, if available. If no specific fix is provided for version 9.2.11, consider applying general security best practices to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Smart Office Web versions 20.28 and earlier **Description** An issue in Smart Office Web allows attackers to download sensitive information via the `action name` parameter to "ExportEmployeeDetails.aspx" and "ExportReportingManager.aspx". Additionally, attackers can view sensitive information via "DisplayParallelLogData.aspx". **Recommendations** For versions 20.28 and earlier, consider restricting access to the "ExportEmployeeDetails.aspx" and "ExportReportingManager.aspx" pages, and avoid using the `action name` parameter until a fix is available. As a temporary workaround, consider disabling access to "DisplayParallelLogData.aspx" to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Smart Office Web versions 20.28 and earlier **Description** An issue was discovered that allows attackers to view sensitive information via the "DisplayParallelLogData.aspx" API endpoint. **Recommendations** For versions 20.28 and earlier, consider restricting access to the "DisplayParallelLogData.aspx" endpoint until a patch is available.

Name of the Vulnerable Software and Affected Versions: UTI Mutual fund Android application versions 5.4.18 and prior Description: An issue in the UTI Mutual fund Android application allows attackers to brute force enumeration of usernames determined by the error message returned after invalid credentials are attempted. Recommendations: For versions 5.4.18 and prior, consider implementing rate limiting or IP blocking to prevent brute force attacks, and modify the error message to not disclose whether the username is valid or not. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Maharashtra State Electricity Board Mahavitara Android Application versions 8.20 and prior **Description** The issue allows for remote account takeover due to an OTP fixation vulnerability in the password reset function. **Recommendations** For versions 8.20 and prior, update to a version that fixes the OTP fixation vulnerability in the password reset function to prevent remote account takeover.

Name of the Vulnerable Software and Affected Versions: Mahavitaran android application versions 7.50 and prior Description: The issue concerns the transmission of sensitive information in URL parameters, which may lead to information disclosure if unauthorized parties access the URLs via server logs, referrer header, Man-in-the-Middle (MITM) attacks, or browser history. Recommendations: For Mahavitaran android application versions 7.50 and prior, consider restricting access to sensitive information and avoid using URL parameters to transmit such data until a fix is available. As a temporary workaround, restrict access to server logs and referrer headers to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NCH Express Accounts versions 8.24 and earlier **Description** The issue allows local users to discover the cleartext password by reading the configuration file. **Recommendations** For versions 8.24 and earlier, consider restricting access to the configuration file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NCH Express Accounts versions 8.24 and earlier **Description** The issue allows an authenticated low-privilege user to access higher-privileged functionalities, such as Add/Edit users, by entering a crafted URL. **Recommendations** For versions 8.24 and earlier, update to a version later than 8.24 to resolve the issue. As a temporary workaround, consider restricting access to sensitive functionalities such as Add/Edit users until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Verint Workforce Optimization suite version 15.1 (15.1.0.37634) **Description** The issue concerns an Unauthenticated Information Disclosure via an API. **Recommendations** For version 15.1 (15.1.0.37634), at the moment, there is no information about a newer version that contains a fix for this vulnerability.