Huang

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.8 **Description** A race condition in the Linux kernel's swap cache can cause data corruption when two or more threads swap in the same entry at the same time. This can lead to a stalled page being installed into the page table, resulting in data loss. The issue is triggered when multiple threads swap in the same entry simultaneously, causing the `pte same` check to pass even though the page has been modified. This can happen when using a small swap device and multiple threads are updating mapped pages in opposite directions. A reproducer has been created to demonstrate this issue, which can cause data loss at a rate of about once every 5 minutes. **Recommendations** To resolve this issue, update the Linux kernel to version 6.8 or later, which includes the fix for this vulnerability. If updating is not possible, consider disabling the swap cache or restricting its use to minimize the risk of exploitation. Additionally, avoid using small swap devices and limit the number of threads that can swap in the same entry simultaneously.

**Name of the Vulnerable Software and Affected Versions** Windows Distributed File System (DFS) (affected versions not specified) **Description** The issue is caused by a buffer overflow in the memory of the Distributed File System component of the Windows operating system. This allows a remote attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TestLink version 1.9.20 **Description** A Cross-Site Request Forgery (CSRF) issue was found via the "/lib/plan/planView.php" API endpoint. **Recommendations** For version 1.9.20, update to a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** TestLink version 1.9.20 **Description** The issue is a SQL injection vulnerability. It can be exploited via the /lib/execute/execNavigator.php endpoint. **Recommendations** For TestLink version 1.9.20, consider restricting access to the /lib/execute/execNavigator.php endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TestLink version 1.9.20 **Description** A stored cross-site scripting (XSS) issue was found in TestLink via the /lib/inventory/inventoryView.php API endpoint. **Recommendations** For version 1.9.20, update to a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** TestLink version 1.9.20 Raijin **Description** A broken access control issue was found in TestLink at the "/lib/attachments/attachmentdownload.php" API endpoint. **Recommendations** For TestLink version 1.9.20 Raijin, consider restricting access to the "/lib/attachments/attachmentdownload.php" API endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices (affected versions not specified) **Description** An issue was discovered that allows attackers to perform a denial of service attack by utilizing the "discover ZigBee network procedure". **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices (affected versions not specified) **Description** An issue was discovered that allows attackers to perform multiple denial of service attacks using the ZigBee trust center rejoin procedure on devices using ZigBee PRO. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices (affected versions not specified) **Description** The issue is related to insecure key transport in ZigBee communication, allowing attackers to obtain sensitive information, cause denial of service attacks, take over smart home devices, and tamper with messages. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Xiaomi DGNWG03LM version Xiaomi ZNCZ03LM version Xiaomi MCCGQ01LM version Xiaomi WSDCGQ01LM version Xiaomi RTCGQ01LM version **Description** The issue is related to insecure key transport in ZigBee communication. This allows attackers to gain sensitive information, launch denial of service attacks, take over smart home devices, and tamper with messages. **Recommendations** For Xiaomi DGNWG03LM, update the device to a version that addresses the insecure key transport issue. For Xiaomi ZNCZ03LM, update the device to a version that addresses the insecure key transport issue. For Xiaomi MCCGQ01LM, update the device to a version that addresses the insecure key transport issue. For Xiaomi WSDCGQ01LM, update the device to a version that addresses the insecure key transport issue. For Xiaomi RTCGQ01LM, update the device to a version that addresses the insecure key transport issue.

**Name of the Vulnerable Software and Affected Versions** Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, WSDCGQ01LM, RTCGQ01LM devices (affected versions not specified) **Description** An issue allows attackers to perform multiple denial of service attacks using the ZigBee trust center rejoin procedure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, RTCGQ01LM devices (affected versions not specified) **Description** An issue allows attackers to perform a denial of service attack by utilizing the "discover ZigBee network procedure". **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.