Ni9Htmar3

Name of the Vulnerable Software and Affected Versions: Dut Computer Control Engineering Co.'s PLC MAC1100 (affected versions not specified) Description: The issue allows attackers to gain access to the system and escalate privileges via a crafted packet. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Dut Computer Control Engineering Co.'s PLC MAC1100 (affected versions not specified) Description: An issue in the PLC MAC1100 allows attackers to cause persistent denial of service (DOS) via a crafted packet. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Dut Computer Control Engineering Co.'s PLC MAC1100 (affected versions not specified) Description: An arbitrary memory access issue in the EPA protocol allows attackers to read the contents of any variable area. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Dut Computer Control Engineering Co.'s PLC MAC1100 (affected versions not specified) Description: An information disclosure issue exists within the system, potentially allowing unauthorized access to sensitive information. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TENGCONTROL T-920 PLC version 5.5 **Description** An issue allows remote attackers to cause a denial of service, resulting in a persistent failure mode. This can be achieved by sending a series of specific requests, identified as `UID 0x43`, to the TCP port 502. **Recommendations** For TENGCONTROL T-920 PLC version 5.5, as a temporary workaround, consider restricting access to TCP port 502 to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** zzcms version 8.2 **Description** An issue in zzcms allows remote attackers to delete arbitrary files via directory traversal sequences in the `oldimg` parameter in an `action=modify` request to the "user/ppsave.php" endpoint. This can be leveraged for database access by deleting install.lock. **Recommendations** For zzcms version 8.2, consider restricting access to the "user/ppsave.php" endpoint or disabling the `action=modify` request until a patch is available to prevent exploitation. Additionally, restrict the use of the `oldimg` parameter to minimize the risk of arbitrary file deletion.

**Name of the Vulnerable Software and Affected Versions** zzcms version 8.2 **Description** An issue in zzcms allows remote attackers to delete arbitrary files via directory traversal sequences in the `oldimg` parameter in an `action=modify` request to the "user/licence save.php" endpoint. This can be leveraged for database access by deleting install.lock. **Recommendations** For zzcms version 8.2, consider restricting access to the "user/licence save.php" endpoint or disabling the `action=modify` request functionality until a patch is available. Additionally, restrict the use of the `oldimg` parameter to prevent directory traversal attacks.

**Name of the Vulnerable Software and Affected Versions** zzcms version 8.2 **Description** An issue was discovered that allows remote attackers to delete arbitrary files via directory traversal sequences in the `oldimg` or `oldflv` parameter in an "action=modify" request to the "user/manage.php" endpoint. This can be leveraged for database access by deleting install.lock. **Recommendations** For zzcms version 8.2, restrict access to the "user/manage.php" endpoint to minimize the risk of exploitation, and avoid using the `oldimg` or `oldflv` parameters in requests until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** zzcms version 8.2 **Description** The issue allows SQL injection via the `id` parameter in an "adv2.php?action=modify" request. **Recommendations** For zzcms version 8.2, avoid using the `id` parameter in the "adv2.php?action=modify" request until the issue is resolved. Consider restricting access to the adv2.php module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** zzcms version 8.2 **Description** An issue in zzcms allows PHP code injection via the `siteurl` parameter to the "install/index.php" endpoint, enabling the injection of PHP code, such as a `phpinfo()` call, into "/inc/config.php". **Recommendations** For zzcms version 8.2, avoid using the `siteurl` parameter in the "install/index.php" endpoint until the issue is resolved. As a temporary workaround, consider restricting access to the "install/index.php" endpoint to minimize the risk of exploitation.