Esj4Y

**Name of the Vulnerable Software and Affected Versions** Luxion KeyShot Viewer (affected versions not specified) **Description** This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within the parsing of KSP files due to the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this to execute code in the context of the current process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Luxion KeyShot Viewer (affected versions not specified) **Description** This issue allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this issue, where the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of KSP files, resulting from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this issue to execute code in the context of the current process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Luxion KeyShot Viewer (affected versions not specified) **Description** This issue allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this issue, where the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of KSP files, resulting from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this issue to execute code in the context of the current process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Luxion KeyShot Viewer (affected versions not specified) **Description** This issue allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this issue, where the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of KSP files, resulting from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this issue to execute code in the context of the current process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Luxion KeyShot Viewer (affected versions not specified) **Description** This issue allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this issue, where the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of KSP files, resulting from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this issue to execute code in the context of the current process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Luxion KeyShot Viewer (affected versions not specified) **Description** This issue allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this issue, where the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of KSP files, resulting from the lack of proper validation of user-supplied data. This can lead to a write past the end of an allocated buffer, allowing an attacker to execute code in the context of the current process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Voltronic Power ViewPower Pro (affected versions not specified) **Description** The issue is related to the lack of authentication in the SocketService module of Voltronic Power ViewPower Pro, allowing remote attackers to create a denial-of-service condition on affected installations. The specific flaw exists within the SocketService module, which listens on UDP port 41222 by default. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Voltronic Power ViewPower Pro (affected versions not specified) **Description** This issue allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. Authentication is not required to exploit this issue. The specific flaw exists within the RMI interface, which listens on TCP port 41009 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this issue to execute code in the context of SYSTEM. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Voltronic Power ViewPower Pro (affected versions not specified) **Description** This issue allows remote attackers to bypass authentication on affected installations of Voltronic Power ViewPower Pro. The specific flaw exists within the `updateManagerPassword` function, resulting from the exposure of a dangerous function. An attacker can leverage this vulnerability to bypass authentication on the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Voltronic Power ViewPower Pro (affected versions not specified) **Description** This issue allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. Authentication is not required to exploit this issue. The specific flaw exists within the `getMacAddressByIP` function, resulting from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this issue to execute code in the context of SYSTEM. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Luxion KeyShot Viewer (affected versions not specified) **Description** This issue allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this issue, where the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of KSP files, resulting from the lack of proper validation of user-supplied data, which can lead to a memory corruption condition. An attacker can leverage this issue to execute code in the context of the current process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Advantech R-SeeNet version 2.4.22 **Description** The issue is related to incorrect external control of a file name or path, allowing a remote attacker to gain unauthorized access to local files by sending specially crafted HTTP requests. This can enable low-level users to access and load the content of local files. **Recommendations** For Advantech R-SeeNet version 2.4.22, consider restricting access to sensitive files and directories to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the privileges of low-level users to prevent them from accessing unauthorized files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Advantech R-SeeNet version 2.4.22 **Description** The issue is related to the use of hard-coded credentials in Advantech R-SeeNet. This allows a remote attacker to exploit the vulnerability and gain elevated privileges. The software comes with a hidden root-level user that is not available in the users list, and this user has a password that cannot be changed by users. The credentials for this hidden user are `username: root` and `password: conel`. **Recommendations** For Advantech R-SeeNet version 2.4.22, consider changing the hard-coded password for the hidden root-level user to a unique and secure password as soon as possible. As a temporary workaround, restrict access to the root-level user until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MXsecurity version 1.0 **Description** The issue is related to hardcoded credentials in MXsecurity, which can be exploited to craft arbitrary JWT tokens and bypass authentication for web-based APIs. This allows a remote attacker to elevate their privileges. **Recommendations** For MXsecurity version 1.0, consider disabling the use of hardcoded credentials and JWT token generation until a patch is available. Restrict access to web-based APIs to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MXsecurity version 1.0 **Description** The issue is related to a command injection vulnerability in the SSH CLI program of MXsecurity. This vulnerability can be exploited by attackers who have gained authorization privileges, allowing them to break out of the restricted shell and execute arbitrary code. The vulnerability is associated with a lack of data sanitization on the management level, which can be exploited by a remote attacker to execute arbitrary commands. **Recommendations** For MXsecurity version 1.0, consider disabling the SSH CLI program until a patch is available to prevent exploitation of the command injection vulnerability. Restrict access to the restricted shell to minimize the risk of attackers breaking out and executing arbitrary code. At the moment, there is no information about a newer version that contains a fix for this vulnerability.