Masahiro Kawada

**Name of the Vulnerable Software and Affected Versions** Windows Kernel (affected versions not specified) **Description** A buffer over-read in Windows Kernel Memory allows an authorized attacker to disclose sensitive information locally, which may affect the system. A buffer over-read occurs when a program reads more data than is present in a memory buffer, potentially exposing adjacent memory contents. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows COM (affected versions not specified) **Description** The acceptance of extraneous untrusted data combined with trusted data in Windows COM allows an unauthorized attacker to elevate privileges locally. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SS1 versions 16.0.0.10 and earlier SS1 Media versions 16.0.0a and earlier **Description** SS1 versions 16.0.0.10 and earlier (Media version 16.0.0a and earlier) allow a remote, unauthenticated attacker to upload arbitrary files and execute OS commands with SYSTEM privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: SS1 versions 16.0.0.10 and earlier SS1 Media versions 16.0.0a and earlier Description: SS1 versions 16.0.0.10 and earlier (Media version: 16.0.0a and earlier) allow a remote, unauthenticated attacker to upload arbitrary files and execute OS commands with SYSTEM privileges. Recommendations: Update SS1 to a version later than 16.0.0.10. Update SS1 Media to a version later than 16.0.0a.

Name of the Vulnerable Software and Affected Versions: SS1 versions 16.0.0.10 and earlier SS1 Media versions 16.0.0.a and earlier Description: An improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists. A remote authenticated attacker may overwrite legitimate files by exploiting this issue. Recommendations: Update SS1 to a version later than 16.0.0.10. Update SS1 Media to a version later than 16.0.0.a.

Name of the Vulnerable Software and Affected Versions: SS1 versions 16.0.0.10 and earlier SS1 Media versions 16.0.0a and earlier Description: An improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists. This allows a remote, unauthenticated attacker to view arbitrary files. Recommendations: Update SS1 to a version later than 16.0.0.10. Update SS1 Media to a version later than 16.0.0a.

Name of the Vulnerable Software and Affected Versions: SS1 versions 16.0.0.10 and earlier SS1 Media versions 16.0.0.a and earlier Description: The use of a hard-coded password in SS1 allows a remote, unauthenticated attacker to view arbitrary files with root privileges. Recommendations: Versions prior to 16.0.0.10 require attention. Media versions prior to 16.0.0.a require attention.

Name of the Vulnerable Software and Affected Versions: SS1 versions 16.0.0.10 and earlier SS1 Media versions 16.0.0a and earlier Description: An inadequate encryption strength issue exists that may allow a remote, unauthenticated attacker to access a function requiring authentication. Recommendations: Update SS1 to a version later than 16.0.0.10. Update SS1 Media to a version later than 16.0.0a.

Name of the Vulnerable Software and Affected Versions: SS1 versions 16.0.0.10 and earlier SS1 Media versions 16.0.0a and earlier Description: An issue exists where files or directories are accessible to external parties. Exploitation may allow a remote, unauthenticated attacker to access uploaded files and SS1 configuration files. Recommendations: Update SS1 to a version later than 16.0.0.10. Update SS1 Media to a version later than 16.0.0a.

Name of the Vulnerable Software and Affected Versions: SS1 versions 16.0.0.10 and earlier SS1 Media versions 16.0.0a and earlier Description: An incorrect permission assignment for a critical resource exists, potentially allowing users with login access to a client terminal to obtain root privileges. Recommendations: Update SS1 to a version later than 16.0.0.10. Update SS1 Media to a version later than 16.0.0a.

**Name of the Vulnerable Software and Affected Versions** PC Time Tracer versions prior to 5.2 **Description** The issue is related to incorrect default permissions in PC Time Tracer. If exploited, a local authenticated attacker could execute arbitrary code with SYSTEM privilege on Windows systems where the product is running. **Recommendations** For versions prior to 5.2, update to version 5.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 13.3 **Description** The issue allows an app to potentially break out of its sandbox. This was addressed with improved checks. **Recommendations** For versions prior to 13.3, update to macOS Ventura 13.3 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Cisco Adaptive Security Appliance (ASA) Software (affected versions not specified) Cisco Firepower Threat Defense (FTD) Software (affected versions not specified) **Description** A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition. This vulnerability is due to improper input validation when parsing HTTPS requests. An attacker could exploit this vulnerability by sending a malicious HTTPS request to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Fuji Xerox multifunction devices and printers (DocuCentre-VII C7773/C6673/C5573/C4473/C3373/C3372/C2273, DocuCentre-VII C7788/C6688/C5588, ApeosPort-VII C7773/C6673/C5573/C4473/C3373/C3372 C2273, ApeosPort-VII C7788/C6688/C5588, ApeosPort C7070/C6570/C5570/C4570/C3570/C3070/C7070G/C6570G/C5570G/C4570G/C3570G/C3070G, ApeosPort-VII C4421/C3321, ApeosPort C3060/C2560/C2060/C3060G/C2560G/C2060G, ApeosPort-VII CP4421, ApeosPort Print C5570, ApeosPort 5570/4570/5570G/4570G, ApeosPort 3560/3060/2560/3560G/3060G/2560G, ApeosPort-VII 5021/ 4021, ApeosPort-VII P5021, DocuPrint CP 555 d/505 d, DocuPrint P505 d, PrimeLink C9065/C9070, DocuPrint CP475AP, and DocuPrint P475AP) Description: The issue allows an attacker to cause a denial of service (DoS) condition and abnormal end (ABEND) of the affected products via sending a specially crafted command. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.