Devesh Logendran

**Nome do software vulnerável e versões afetadas** Versões do Calibre anteriores à 7.15.0 **Descrição** O problema está relacionado a entradas de usuário não sanitizadas, permitindo que invasores executem scripts entre sites refletidos. **Recomendações** Para versões do Calibre anteriores à 7.15.0, atualize para a versão 7.15.0 ou posterior para resolver o problema.

**Nome do software vulnerável e versões afetadas** Versões do Calibre anteriores à 7.15.0 **Descrição** O problema diz respeito a entradas de usuário não sanitizadas, permitindo que usuários com permissões para realizar pesquisas de texto completo realizem injeção de SQL no banco de dados SQLite. **Recomendações** Para versões do Calibre anteriores à 7.15.0, atualize para a versão 7.15.0 ou posterior para resolver o problema.

**Name of the Vulnerable Software and Affected Versions** WebAccess/SCADA version 8.3 **Description** An improper authentication issue exists, potentially allowing an authentication bypass. This could enable an attacker to upload malicious data. **Recommendations** For version 8.3, update to a version that addresses the improper authentication issue to prevent potential authentication bypass and malicious data uploads. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ANTlabs InnGate firmware versions on IG 3100, InnGate 3.01 E, InnGate 3.10 E, InnGate 3.10 M, SG 4, and SSG 4 devices **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `ppli` parameter when https is used. **Recommendations** For ANTlabs InnGate firmware on IG 3100, InnGate 3.01 E, InnGate 3.10 E, InnGate 3.10 M, SG 4, and SSG 4 devices, consider restricting access to the `ppli` parameter in the https endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ANTlabs InnGate firmware versions on IG 3100, InnGate 3.01 E, InnGate 3.10 E, InnGate 3.10 M, SG 4, and SSG 4 devices **Description** The issue is related to a cross-site scripting (XSS) vulnerability. This allows remote attackers to inject arbitrary web script or HTML via the `msg` parameter in the index-login.ant file. **Recommendations** For all affected versions, consider restricting access to the index-login.ant file until a patch is available. As a temporary workaround, avoid using the `msg` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.