Hacked0X90

**Name of the Vulnerable Software and Affected Versions** CloudForms versions 5.8 through 5.10 **Description** A flaw was found in the CloudForms web interface where the RSS feed URLs are not properly restricted to authenticated users only. An attacker could use this flaw to view potentially sensitive information from CloudForms, including data such as newly created virtual machines. **Recommendations** For CloudForms versions 5.8 through 5.10, restrict access to the RSS feed URLs to authenticated users only to prevent unauthorized viewing of sensitive information. As a temporary workaround, consider disabling the RSS feed feature until a patch is available.

**Name of the Vulnerable Software and Affected Versions** com.android.provider.telephony (affected versions not specified) Infinix X571 (affected versions not specified) Lenovo phones (such as the A7020) (affected versions not specified) **Description** The issue allows SQL injection through the content://wappush content provider in com.android.provider.telephony, found in some custom ROMs for Android phones. This enables an application without the READ SMS permission to read SMS messages. **Recommendations** For com.android.provider.telephony, consider restricting access to the content://wappush content provider until a fix is available. For Infinix X571 phones, contact the manufacturer for guidance on resolving the issue. For Lenovo phones (such as the A7020), update to the fixed version provided by Lenovo. At the moment, there is no information about a newer version that contains a fix for this vulnerability for Infinix X571 and com.android.provider.telephony.

**Name of the Vulnerable Software and Affected Versions** Huawei HG8245H versions earlier than V300R018C00SPC110 **Description** The issue is related to an authentication bypass, allowing an attacker to access a specific URL of the affected product. This is due to improper verification of privileges, which may lead to information leaks. **Recommendations** For versions earlier than V300R018C00SPC110, update to V300R018C00SPC110 or later to resolve the issue.