Lorenzomoulin

**Name of the Vulnerable Software and Affected Versions** Intelbras InControl version 2.21.60.9 **Description** A vulnerability exists in Intelbras InControl that allows for information disclosure. The issue is related to the processing of the `/v1/operador/` JSON Endpoint. The exploitation of this issue is difficult and requires a high level of complexity, but the exploit has been publicly disclosed. **Recommendations** Upgrade the affected component to address the issue.

Name of the Vulnerable Software and Affected Versions: Intelbras InControl versions up to 2.21.60.9 Description: A vulnerability was found in Intelbras InControl, affecting unknown code of the file /v1/operador/. The manipulation leads to csv injection. The attack can be initiated remotely. Recommendations: For versions up to 2.21.60.9, as a temporary workaround, consider restricting access to the /v1/operador/ endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Intelbras InControl version 2.21.60.9 Description: A critical issue has been found in the HTTP PUT Request Handler component, affecting the processing of the file "/v1/operador/". This leads to permission issues and can be initiated remotely. The exploit has been disclosed publicly. Recommendations: For Intelbras InControl version 2.21.60.9, consider restricting access to the "/v1/operador/" endpoint to minimize the risk of exploitation. As a temporary workaround, review and limit the use of HTTP PUT requests to this endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Nway Pro version 9 **Description** A vulnerability was found in the function `ajax login submit form` of the file `loginindex.php` of the component Argument Handler. The manipulation of the argument `rsargs[]` leads to information exposure through error message. The attack may be launched remotely. **Recommendations** For Nway Pro version 9, as a temporary workaround, consider disabling the `ajax login submit form` function until a patch is available. Restrict access to the `loginindex.php` file to minimize the risk of exploitation. Avoid using the argument `rsargs[]` in the affected component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Allegro RomPager version 4.01 **Description** A problematic issue was found in the HTTP POST Request Handler component, specifically in the file usertable.htm?action=delete. The manipulation of the `username` argument leads to cross-site request forgery. This issue can be exploited remotely. The vendor notes that this is a very old issue that was fixed 20 years ago without public disclosure. **Recommendations** For Allegro RomPager version 4.01, upgrade to version 4.30 to address this issue. As a temporary workaround, consider restricting access to the usertable.htm?action=delete file or disabling the HTTP POST Request Handler component until the upgrade is applied.