Geochen

**Name of the Vulnerable Software and Affected Versions** Huly Platform versions prior to 0.7.0 **Description** Improper authorization exists in the User Information Handler component. A remote attacker can manipulate the `getAccountInfo()` function within the `server/account/src/operations.ts` file to bypass authorization controls. **Recommendations** Update to a version later than 0.7.0. As a temporary workaround, restrict access to the `getAccountInfo()` function until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Huly Platform versions prior to 0.7.1 **Description** Improper access controls in the RPC Interface component allow for remote attacks. The issue is located in the `getMailboxSecret()` function within the `server/account/src/operations.ts` file. **Recommendations** Update to a version later than 0.7.0. As a temporary workaround, restrict access to the `getMailboxSecret()` function.

**Name of the Vulnerable Software and Affected Versions** TwiN gatus version 5.36.0 **Description** A flaw exists in the OIDC Session Cookie Handler component within the `setSessionCookie()` function of the `security/oidc.go` file. A remote attacker can perform a high-complexity manipulation to cause sensitive cookies to be issued without the secure attribute, which ensures cookies are only transmitted over encrypted connections. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Bolt CMS versions prior to 3.7.6 **Description** An issue exists in the HTML Attribute Handler component within the file `src/Storage/Field/Type/TextType.php`. A remote attacker can perform HTML injection by manipulating the `style` argument. This affects products that are no longer supported by the maintainer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** code-projects Online Examination System version 1.0 **Description** A flaw exists in the Online Examination System that allows for remote SQL injection. This occurs through manipulation of the `User` argument within the /index.php file, specifically related to the Login Page component. The exploit for this issue has been publicly disclosed. **Recommendations** Apply any available updates or patches to address the SQL injection vulnerability in the /index.php file. As a temporary workaround, consider restricting or carefully validating the `User` input parameter to prevent malicious SQL code injection.

**Name of the Vulnerable Software and Affected Versions** code-projects Online Examination System version 1.0 **Description** A flaw exists in code-projects Online Examination System 1.0 related to functionality within the `/admin pic.php` file. This allows for unrestricted file uploads, potentially exploitable from a remote location. The details of the exploit have been publicly released. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** code-projects Online Examination System version 1.0 **Description** A flaw exists in the Add Pages component of the software, allowing for cross site scripting. This manipulation can be executed remotely. The exploit details have been publicly disclosed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** 70mai X200 versions up to 20251019 **Description** A flaw exists in the Init Script Handler component of the software that allows for file inclusion. The attack requires local access and is considered difficult to exploit. The exploit has been publicly released. The vendor was notified but did not respond. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** 70mai X200 versions up to 20251010 **Description** A flaw exists in the Pairing component of 70mai X200 up to version 20251010. Manipulation of an unknown function can result in missing authentication. This issue can be exploited remotely. The exploit has been published. The vendor was contacted but did not respond. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** 70mai X200 versions up to 20251010 **Description** A vulnerability exists in the HTTP Web Server component of 70mai X200 devices. This issue allows for the use of default credentials, and the attack can be initiated remotely. The exploit has been publicly disclosed. The vendor was informed of the disclosure but did not respond. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: BlackVue Dashcam 590X up to 20250624 Description: A critical issue affects some unknown functionality of the file /upload.cgi of the component Configuration Handler, leading to improper access controls. The attack must be initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted about this disclosure but did not respond. Recommendations: For BlackVue Dashcam 590X up to 20250624, as a temporary workaround, consider restricting access to the /upload.cgi file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: BlackVue Dashcam 590X up to 20250624 Description: A critical vulnerability affects an unknown functionality of the file /upload.cgi of the component HTTP Endpoint, leading to unrestricted upload. The attack must be done within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond. Recommendations: For BlackVue Dashcam 590X up to 20250624, as a temporary workaround, consider restricting access to the /upload.cgi HTTP Endpoint until a patch is available. Avoid using the vulnerable HTTP Endpoint within the local network to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: IROAD Dashcam Q9 up to 20250624 Description: A vulnerability has been found in the component MFA Pairing Request Handler, affecting an unknown functionality. The manipulation leads to allocation of resources. The attack needs to be done within the local network. The vendor was contacted early about this disclosure but did not respond in any way. Recommendations: For IROAD Dashcam Q9 up to 20250624, as a temporary workaround, consider restricting access to the local network to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: NOYAFA/Xiami LF9 Pro up to 20250611 Description: A problematic vulnerability was found in the RTSP Live Video Stream Endpoint component of the NOYAFA/Xiami LF9 Pro device. This issue leads to improper access controls, allowing for unauthorized access or manipulation of video streams. The attack can only be initiated within the local network. The exploit has been disclosed to the public. Recommendations: For NOYAFA/Xiami LF9 Pro up to 20250611, consider restricting access to the RTSP Live Video Stream Endpoint to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: 70mai 1S up to 20250611 Description: A problematic issue has been found in the Video Services component, leading to improper authentication. This issue requires access to the local network to be exploited, has a high complexity, and is considered difficult to exploit. The exploit has been publicly disclosed. Recommendations: For 70mai 1S up to 20250611, at the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: 70mai M300 up to 20250611 Description: A vulnerability was found in the Telnet Service component, affecting an unknown part of the file demo.sh. The manipulation leads to denial of service. Access to the local network is required for this attack. The complexity of an attack is rather high, and the exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Recommendations: For 70mai M300 up to 20250611, as a temporary workaround, consider disabling the Telnet Service until a patch is available. Restrict access to the local network to minimize the risk of exploitation. Avoid using the `demo.sh` file in the Telnet Service component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: 70mai M300 up to 20250611 Description: A critical issue was found in the Telnet Service component, allowing the use of default credentials. The attack must be initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted about this disclosure but did not respond. Recommendations: For 70mai M300 up to 20250611, consider disabling the Telnet Service as a temporary workaround until a patch is available. Restrict access to the local network to minimize the risk of exploitation. Avoid using default credentials in the Telnet Service until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: 70mai M300 up to 20250611 Description: A vulnerability has been found in the RTSP Live Video Stream Endpoint of the 70mai M300, affecting an unknown functionality of the file /livestream/12. This leads to improper authentication. The attack must be done within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted about this disclosure but did not respond. Recommendations: For 70mai M300 up to 20250611, as a temporary workaround, consider restricting access to the RTSP Live Video Stream Endpoint, specifically the /livestream/12 file, to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: 70mai M300 versions up to 20250611 Description: A problematic issue was found in the Web Server component, affecting an unknown function. This leads to improper access controls. The attack can only be initiated within the local network and has a rather high complexity, with difficult exploitability. The exploit has been disclosed to the public. Recommendations: For 70mai M300 versions up to 20250611, consider restricting access to the Web Server component to minimize the risk of exploitation. As a temporary workaround, consider disabling unknown functions of the Web Server component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: 70mai M300 versions up to 20250611 Description: A problematic issue has been found in the HTTP Server component, leading to insufficiently protected credentials. The attack can only be done within the local network and has a high complexity, making exploitation difficult. The exploit has been disclosed to the public. Recommendations: For 70mai M300 versions up to 20250611, consider restricting access to the HTTP Server component to minimize the risk of exploitation. As a temporary workaround, avoid using the device on untrusted networks until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.