B3Hz4D

Name of the Vulnerable Software and Affected Versions: KMplayer versions 2.9.4.1433 and earlier Description: The issue allows remote attackers to cause a denial of service or execute arbitrary code via a long string in a subtitle (.srt) playlist file. Recommendations: For KMplayer versions 2.9.4.1433 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Rae Media Contact Management Software versions SOHO, Standard, and Enterprise Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `Password` parameter in the asadmin/default.asp file. Recommendations: For Rae Media Contact Management Software versions SOHO, Standard, and Enterprise, consider restricting access to the asadmin/default.asp file until a patch is available. As a temporary workaround, avoid using the `Password` parameter in the affected file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Ez Ringtone Manager (affected versions not specified) **Description** The issue concerns multiple directory traversal vulnerabilities. These vulnerabilities allow remote attackers to read arbitrary files by utilizing a .. (dot dot) in the `id` parameter within a detail action to API endpoints such as "main.php" and "template.php" in the "ringtones/" directory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Kalptaru Infotech Product Sale Framework version 0.1 beta **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `forum topic id` parameter in the customer.forumtopic.php file. **Recommendations** For Kalptaru Infotech Product Sale Framework version 0.1 beta, consider restricting access to the customer.forumtopic.php file until a patch is available, and avoid using the `forum topic id` parameter in this context to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** BuzzyWall version 1.3.1 **Description** A directory traversal issue exists, allowing remote attackers to read arbitrary local files. This is achieved by using a .. (dot dot) in the `id` parameter of the "download.php" endpoint. **Recommendations** For BuzzyWall version 1.3.1, consider restricting access to the download.php endpoint until a patch is available. As a temporary workaround, avoid using the `id` parameter in the download.php endpoint to minimize the risk of exploitation.