John Doe

**Name of the Vulnerable Software and Affected Versions** Linksys E2500 version 3.0.04.002 **Description** The `chroot local user` option is enabled in the vsftpd configuration file. This could lead to unauthorized access to system files, privilege escalation, or use of the compromised server as a pivot point for internal network attacks. **Recommendations** Disable the `chroot local user` option in the vsftpd configuration file.

**Name of the Vulnerable Software and Affected Versions** One Identity OneLogin versions prior to 2025.2.0 **Description** The SQL connection “application name” is set based on the value of an untrusted `X-RequestId` HTTP request header. **Recommendations** Update One Identity OneLogin to version 2025.2.0 or later.

**Name of the Vulnerable Software and Affected Versions** Totolink A3300R version V17.0.0cu.596 B20250515 **Description** Totolink A3300R V17.0.0cu.596 B20250515 contains a command injection vulnerability in the `sub 4197C0` function. This allows unauthenticated attackers to execute arbitrary commands via a crafted request through the `mac` and `desc` parameters. **Recommendations** Totolink A3300R version V17.0.0cu.596 B20250515: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions:** Juniper Networks Junos OS on SRX Series versions prior to 21.4R3-S9 Juniper Networks Junos OS on SRX Series versions 22.2 through 22.2R3-S5 Juniper Networks Junos OS on SRX Series versions 22.4 through 22.4R3-S5 Juniper Networks Junos OS on SRX Series versions 23.2 through 23.2R2-S3 Juniper Networks Junos OS on SRX Series versions 23.4 through 23.4R2-S5 Juniper Networks Junos OS on SRX Series versions 24.2 through 24.2R2 **Description:** An incorrect authorization vulnerability exists in the web server of Juniper Networks Junos OS on SRX Series. This allows an unauthenticated, network-based attacker to access the Juniper Web Device Manager (J-Web). The issue occurs when Juniper Secure connect (JSC) is enabled on specific interfaces, or multiple interfaces are configured for J-Web, making the J-Web UI reachable over more than the intended interfaces. **Recommendations:** Update to Junos OS version 21.4R3-S9 or later. Update to Junos OS version 22.2R3-S5 or later. Update to Junos OS version 22.4R3-S5 or later. Update to Junos OS version 23.2R2-S3 or later. Update to Junos OS version 23.4R2-S5 or later. Update to Junos OS version 24.2R2 or later.

**Name of the Vulnerable Software and Affected Versions** HPE Networking Instant On Access Points versions 3.2.0 and earlier HPE Aruba Instant On Access Points versions 3.2.0.1 and earlier Aruba Instant On APs versions 3.2.0 and earlier **Description** HPE Networking and Aruba Instant On Access Points are affected by hard-coded login credentials. Exploitation of this issue allows attackers to bypass normal device authentication and gain administrative access to the system remotely. The vulnerability could potentially allow a full system takeover if chained with a second, unspecified bug. **Recommendations** HPE Networking Instant On Access Points versions 3.2.0 and earlier: Upgrade firmware to version 3.2.1.0 or later. HPE Aruba Instant On Access Points versions 3.2.0.1 and earlier: Upgrade firmware to version 3.2.1.0 or later. Aruba Instant On APs versions 3.2.0 and earlier: Upgrade firmware to version 3.2.1.0 or later.

Name of the Vulnerable Software and Affected Versions: MediaWiki - MsUpload extension versions 1.39.X through 1.39.12 MediaWiki - MsUpload extension versions 1.42.X through 1.42.6 MediaWiki - MsUpload extension versions 1.43.X through 1.43.1 Description: The MsUpload extension for MediaWiki is vulnerable to stored XSS via the `msu-continue` system message, which is inserted into the DOM without proper sanitization. This issue occurs in the file upload UI when the same filename is uploaded twice. Recommendations: For MediaWiki - MsUpload extension versions 1.39.X through 1.39.12, update to version 1.39.13 or later. For MediaWiki - MsUpload extension versions 1.42.X through 1.42.6, update to version 1.42.7 or later. For MediaWiki - MsUpload extension versions 1.43.X through 1.43.1, update to version 1.43.2 or later.

Name of the Vulnerable Software and Affected Versions: Emerson ValveLink products (affected versions not specified) Description: Emerson ValveLink products utilize a fixed or controlled search path for resource location. However, one or more locations within this path may be controllable by unauthorized actors. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Mediawiki - CheckUser extension versions 1.39.0 through 1.39.12 Mediawiki - CheckUser extension versions 1.42.0 through 1.42.6 Mediawiki - CheckUser extension versions 1.43.0 through 1.43.1 Description: The CheckUser extension’s Special:Investigate interface is vulnerable to reflected XSS due to improper escaping of certain internationalized system messages rendered on the “IPs and User agents” tab. Recommendations: For versions 1.39.0 through 1.39.12, update to version 1.39.13 or later. For versions 1.42.0 through 1.42.6, update to version 1.42.7 or later. For versions 1.43.0 through 1.43.1, update to version 1.43.2 or later.

Name of the Vulnerable Software and Affected Versions: educoder challenges version 1.0 Description: The issue is related to insufficient security mechanisms for created containers, allowing attackers to execute arbitrary code by injecting crafted content into a container. Recommendations: For educoder challenges version 1.0, consider restricting the ability to inject content into containers as a temporary mitigation measure until a more comprehensive fix is available.

**Name of the Vulnerable Software and Affected Versions** Versa Director versions (affected versions not specified) **Description** The Versa Director SD-WAN orchestration platform has a security issue with its Two-Factor Authentication (2FA) system. The platform accepts untrusted user input when sending 2FA codes, allowing an attacker who knows a valid username and password to redirect the One-Time Passcode (OTP) delivery to their own device. Additionally, the 2FA system does not properly limit the number of login attempts, and OTP values are generated from a relatively small keyspace, making brute-force attacks more feasible. The OTP/TOTP codes are not invalidated after use, enabling an attacker to reuse a previously intercepted or obtained valid code. There are no reported instances of this issue being exploited, but a proof of concept has been disclosed by third-party security researchers. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Veeam Backup & Replication versions prior to 12.3.2.3617 **Description** A critical remote code execution (RCE) vulnerability allows authenticated domain users to execute code on the Backup Server. This vulnerability affects Veeam Backup & Replication software, specifically impacting backup servers that are joined to a Windows domain. The estimated number of potentially affected devices worldwide is not explicitly stated, but it is mentioned that over 550,000 clients use Veeam's solutions, including 82% of Fortune 500 companies and 74% of Global 2000 firms. There have been real-world incidents where this issue was exploited, with attackers targeting Veeam Backup & Replication servers. **Recommendations** To resolve the issue, update Veeam Backup & Replication to version 12.3.2.3617 or later. As a temporary workaround, consider restricting access to the Backup Server to minimize the risk of exploitation. Additionally, follow isolation best practices to reduce the attack surface.

**Name of the Vulnerable Software and Affected Versions** Citrix NetScaler Application Delivery Controller versions prior to 12.1-55.328 Citrix NetScaler Application Delivery Controller versions prior to 13.1-37.235 Citrix NetScaler Application Delivery Controller versions prior to 13.1-58.32 Citrix NetScaler Application Delivery Controller versions prior to 14.1-43.56 Citrix NetScaler Gateway versions prior to 13.1-58.32 Citrix NetScaler Gateway versions prior to 14.1-43.56 **Description** This pre-authentication memory disclosure issue occurs due to insufficient input validation, leading to a memory overread (out-of-bounds read) when the system is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. An attacker can send a specially crafted POST request to the `/p/u/doAuthentication.do` endpoint with the `login` parameter provided without an equals sign or value. This causes the server to return fragments of uninitialized process memory within the `<InitialValue>` XML element, leaking approximately 127 bytes per request. This information can be analyzed to extract valid session tokens, enabling session hijacking and multi-factor authentication (MFA) bypass. Real-world exploitation has been observed by Anubis ransomware affiliates to gain initial access to systems, subsequently using legitimate Remote Management and Monitoring (RMM) tools to maintain persistence and deploy ransomware. **Recommendations** Update Citrix NetScaler Application Delivery Controller to version 12.1-55.328 or later. Update Citrix NetScaler Application Delivery Controller to version 13.1-37.235 or later. Update Citrix NetScaler Application Delivery Controller to version 13.1-58.32 or later. Update Citrix NetScaler Application Delivery Controller to version 14.1-43.56 or later. Update Citrix NetScaler Gateway to version 13.1-58.32 or later. Update Citrix NetScaler Gateway to version 14.1-43.56 or later. As a temporary mitigation, configure a Web Application Firewall (WAF) rule to block POST requests to the `/p/u/doAuthentication.do` endpoint that contain the `login` parameter without an assigned value.

Name of the Vulnerable Software and Affected Versions: Comodo Internet Security Premium version 12.3.4.8162 Description: A critical vulnerability has been found in the Update Handler component of Comodo Internet Security Premium, leading to improper certificate validation. The attack can be initiated remotely, with a high complexity and difficult exploitability. The vendor was contacted about this disclosure but did not respond. Recommendations: For Comodo Internet Security Premium version 12.3.4.8162, as a temporary workaround, consider restricting the use of the Update Handler component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Comodo Internet Security Premium version 12.3.4.8162 Description: A critical vulnerability was found in the File Name Handler component, where the manipulation of the `name/folder` argument leads to path traversal. The attack can be launched remotely, with a rather high complexity and difficult exploitability. The exploit has been disclosed to the public and may be used. The vendor was contacted about this disclosure but did not respond. Recommendations: For Comodo Internet Security Premium version 12.3.4.8162, as a temporary workaround, consider restricting access to the File Name Handler component until a patch is available. Avoid using the `name/folder` argument in the affected component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** BOINC Server versions prior to 1.4.3 **Description** The issue is related to a Cross-Site Request Forgery (CSRF) problem. This allows for Cross-Site Request Forgery. **Recommendations** For versions prior to 1.4.3, update to version 1.4.3 or later to resolve the issue. As a temporary workaround, consider implementing additional validation for requests to prevent unauthorized actions. Restrict access to sensitive operations to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version 15.03.05.16 multi Description: The issue is related to a Buffer Overflow in the formSetFirewallCfg function via the `firewallEn` parameter. Recommendations: For Tenda AC6 version 15.03.05.16 multi, as a temporary workaround, consider disabling the `formSetFirewallCfg` function until a patch is available. Restrict access to the firewall configuration to minimize the risk of exploitation. Avoid using the `firewallEn` parameter in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FW-WGS-804HPT version 1.305b241111 **Description** A stack overflow issue was discovered via the `radIpkey` parameter in the `web radiusSrv post` function. **Recommendations** For FW-WGS-804HPT version 1.305b241111, consider restricting access to the `web radiusSrv post` function to minimize the risk of exploitation. Avoid using the `radIpkey` parameter in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FW-WGS-804HPT version 1.305b241111 **Description** A stack overflow issue was discovered via the `byruleEditName` parameter in the `web acl mgmt Rules Edit postcontains` function. **Recommendations** For FW-WGS-804HPT version 1.305b241111, consider restricting access to the `web acl mgmt Rules Edit postcontains` function until a patch is available. Avoid using the `byruleEditName` parameter in the affected function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** FW-WGS-804HPT version 1.305b241111 **Description** A stack overflow issue was discovered via the `remote ip` parameter in the `web snmpv3 remote engineId add post` function. **Recommendations** For FW-WGS-804HPT version 1.305b241111, consider restricting access to the `web snmpv3 remote engineId add post` function until a patch is available. Avoid using the `remote ip` parameter in the affected function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** FW-WGS-804HPT version 1.305b241111 **Description** A stack overflow issue was discovered via the `host ip` parameter in the `web snmp notifyv3 add post` function. **Recommendations** For FW-WGS-804HPT version 1.305b241111, consider restricting access to the `web snmp notifyv3 add post` function until a patch is available. Avoid using the `host ip` parameter in the affected function to minimize the risk of exploitation.