Behrang Fouladi

**Name of the Vulnerable Software and Affected Versions** DASH 7 Alliance protocol versions prior to 0.5.0 **Description** The Sub-IoT implementation of the DASH 7 Alliance protocol has a vulnerability that can lead to an out-of-bounds write. If the protocol has been compiled using default settings, this will only grant the attacker access to allocated but unused memory. However, if it was configured using non-default settings, there is the possibility that exploiting this vulnerability could lead to system crashes and remote code execution. **Recommendations** For versions prior to 0.5.0, update to version 0.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the protocol until a patch is available. Avoid using non-default settings for the protocol configuration to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Interaction SIP Proxy versions prior to 3.0.011 **Description** The issue is related to a heap-based buffer overflow in the SIPParser function, which can be triggered by a REGISTER request containing a large number of space or tab characters in the SPI version number. This can cause a denial of service and potentially allow the execution of arbitrary code. **Recommendations** For versions prior to 3.0.011, update to version 3.0.011 or later to resolve the issue. As a temporary workaround, consider restricting access to the SIPParser function in i3sipmsg.dll to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** HELM versions 3.1.19 and earlier **Description** A SQL injection issue exists in the compose message form, allowing remote attackers to execute arbitrary SQL commands via the `messageToUserAccNum` parameter. **Recommendations** For HELM versions 3.1.19 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HELM versions 3.1.19 and earlier **Description** A cross-site scripting (XSS) issue exists in the compose message form, allowing remote attackers to execute arbitrary web script or HTML via the `Subject` field. This could potentially lead to unauthorized actions on the affected system. **Recommendations** For HELM versions 3.1.19 and earlier, update to a version later than 3.1.19 to resolve the issue.