J369

Name of the Vulnerable Software and Affected Versions: SEAT Queue Ticket Kiosk versions up to 20250827 Description: A flaw exists in the Java RMI Registry Handler component of SEAT Queue Ticket Kiosk. This issue allows for deserialization, and can only be exploited within a local network. The exploitability of this issue is considered difficult and requires high complexity. The vendor was contacted regarding this disclosure but did not respond. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Realce Tecnologia Queue Ticket Kiosk up to 20250517 **Description** A critical vulnerability has been found in the Image File Handler component of the affected software, specifically in an unknown function of the file /adm/ajax.php. The manipulation of the `files[]` argument leads to unrestricted upload. This issue can be exploited remotely. The vendor was contacted about this disclosure but did not respond. **Recommendations** For Realce Tecnologia Queue Ticket Kiosk up to 20250517, as a temporary workaround, consider restricting access to the /adm/ajax.php file and the Image File Handler component to minimize the risk of exploitation. Avoid using the `files[]` argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Realce Tecnologia Queue Ticket Kiosk versions up to 20250517 **Description** A critical vulnerability affects the unknown code of the file /adm/index.php of the component Admin Login Page. The manipulation of the argument `Usuário` leads to SQL injection. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way. **Recommendations** For Realce Tecnologia Queue Ticket Kiosk versions up to 20250517, as a temporary workaround, consider restricting access to the /adm/index.php file of the Admin Login Page to minimize the risk of exploitation. Avoid using the `Usuário` argument in the affected component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Realce Tecnologia Queue Ticket Kiosk up to 20250517 **Description** A vulnerability was found in the Admin Login Page component, specifically affecting the /adm/index.php file. The manipulation of the `Usuário` argument leads to cross-site scripting. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way. **Recommendations** As a temporary workaround, consider restricting access to the /adm/index.php file until a patch is available. Avoid using the `Usuário` argument in the affected Admin Login Page component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Realce Tecnologia Queue Ticket Kiosk up to 20250517 **Description** A vulnerability was found in Realce Tecnologia Queue Ticket Kiosk, affecting an unknown functionality of the file /adm/index.php of the component Cadastro de Administrador Page. The manipulation of the `Name/Usuário` argument leads to cross-site scripting. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way. **Recommendations** For Realce Tecnologia Queue Ticket Kiosk up to 20250517, as a temporary workaround, consider restricting access to the `/adm/index.php` file and the `Name/Usuário` argument to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dígitro NGC Explorer versions up to 3.44.15 **Description** A vulnerability was found in the software, classified as problematic, affecting some unknown processing. The manipulation leads to session expiration. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way. **Recommendations** For versions up to 3.44.15, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dígitro NGC Explorer version 3.44.15 **Description** A problematic issue was found in the Configuration Page component, leading to missing password field masking. This issue can be initiated remotely. The vendor was contacted about this disclosure but did not respond. **Recommendations** For version 3.44.15, consider restricting access to the Configuration Page until a fix is available. As a temporary workaround, avoid using the Configuration Page remotely to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Dígitro NGC Explorer version 3.44.15 **Description** A vulnerability has been found in the Password Transmission Handler component, allowing for client-side enforcement of server-side security. The attack can be initiated remotely, but the complexity is rather high and the exploitation appears to be difficult. **Recommendations** For Dígitro NGC Explorer version 3.44.15, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Topdata Inner Rep Plus WebServer version 2.01 **Description** A vulnerability was found in the Operator Details Form component of the Topdata Inner Rep Plus WebServer, affecting an unknown function of the file /InnerRepPlus.html. This issue leads to missing password field masking, allowing for remote attacks. The vendor was contacted about this disclosure but did not respond. **Recommendations** For Topdata Inner Rep Plus WebServer version 2.01, as a temporary workaround, consider implementing additional password masking measures until a patch is available. Restrict access to the Operator Details Form component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Topdata Inner Rep Plus WebServer version 2.01 **Description** A problem was found in the file td.js.gz, leading to a risky cryptographic algorithm. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. **Recommendations** For Topdata Inner Rep Plus WebServer version 2.01, as a temporary workaround, consider reviewing and updating encryption practices to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Intelbras InControl versions up to 2.21.56 **Description** A critical vulnerability has been found in Intelbras InControl, affecting an unknown part of the file C:Program Files (x86)IntelbrasIncontrol Clienteincontrol webcamincontrol-service-watchdog.exe. The manipulation leads to an unquoted search path, allowing an attack to be launched on the local host. **Recommendations** For versions up to 2.21.56, upgrade to version 2.21.58 to address this issue. As a temporary workaround, consider restricting access to the affected file incontrol-service-watchdog.exe until a patch is available.