Luke Symons

**Name of the Vulnerable Software and Affected Versions** ServiceNow versions Quebec prior to Patch 10 Hot Fix 8b ServiceNow versions Rome prior to Patch 10 Hot Fix 1 ServiceNow versions San Diego prior to Patch 7 ServiceNow versions Tokyo prior to Tokyo Patch 1 ServiceNow versions Utah prior to Utah General Availability **Description** The issue is an Access Control List (ACL) bypass in ServiceNow Core functionality. If successfully exploited, it could allow an authenticated user to obtain sensitive information from tables missing authorization controls. **Recommendations** For ServiceNow Quebec, apply Patch 10 Hot Fix 8b or later to resolve the issue. For ServiceNow Rome, apply Patch 10 Hot Fix 1 or later to resolve the issue. For ServiceNow San Diego, apply Patch 7 or later to resolve the issue. For ServiceNow Tokyo, apply Tokyo Patch 1 or later to resolve the issue. For ServiceNow Utah, upgrade to Utah General Availability or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** FactoryCamera versions prior to 2.1.96 **Description** The issue is related to improper access control in FactoryCamera, allowing an attacker to access a file with system privilege. **Recommendations** For versions prior to 2.1.96, update to version 2.1.96 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Group Sharing versions prior to 10.8.03.2 **Description** The issue allows an attacker to access contact information due to an intent redirection vulnerability in Group Sharing. **Recommendations** For versions prior to 10.8.03.2, update to version 10.8.03.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Samsung Health versions prior to 6.19.1.0001 **Description** The issue allows an attacker to access Samsung Health via a malicious content provider or lead to denial of service due to a non-existent provider. **Recommendations** For versions prior to 6.19.1.0001, update to version 6.19.1.0001 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** NetComm NB16WV-02 router with firmware NB16WV R0.09 **Description** The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote authenticated users to inject arbitrary web script or HTML via the `S801F0334` parameter to the "hdd.htm" endpoint. **Recommendations** For the NetComm NB16WV-02 router with firmware NB16WV R0.09, consider restricting access to the "hdd.htm" endpoint until a patch is available. Avoid using the `S801F0334` parameter in the affected endpoint to minimize the risk of exploitation.