Lai

**Name of the Vulnerable Software and Affected Versions** IDExpert from CHANGING Information Technology (affected versions not specified) **Description** The issue is related to the improper validation of a specific parameter in the administrator interface of IDExpert, allowing remote attackers with administrator privileges to read arbitrary system files. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IDExpert from CHANGING Information Technology (affected versions not specified) **Description** The issue is related to improper validation of a parameter for a specific functionality in IDExpert, allowing unauthenticated remote attackers to inject JavaScript code and perform Reflected Cross-site scripting attacks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.61 Description: A slab-use-after-free bug has been identified in the Linux kernel, specifically in the netfilter: bpf component. This issue arises when the ` nf unregister net hook()` function is deferred after exit/close time, potentially due to a missing reference on the net namespace. The bug can be triggered through the `bpf nf link release()` function, leading to a read of size 8 at a specific memory address. Eric's analysis suggests that the `bpf nf link attach()` function assigns `link->net = net` without taking a reference on the net namespace, which may cause the netns to be dismantled or freed prematurely. Recommendations: To resolve this issue, update the Linux kernel to version 6.6.61 or later. As a temporary workaround, consider restricting the use of the `bpf nf link attach()` function until a patch is available. Additionally, avoid using the `link->net` variable in the affected API endpoints until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: MCUsystem (affected versions not specified) Description: The issue concerns the login page in the MCUsystem, which fails to filter special characters. This oversight allows remote attackers to inject JavaScript without privilege, thereby performing reflected XSS attacks. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.