Notnotnotveg

**Name of the Vulnerable Software and Affected Versions** GoHarbor versions prior to 2.15.0 **Description** The use of hard-coded credentials in GoHarbor allows attackers to use the default password and gain access to the web user interface. **Recommendations** Update GoHarbor to version 2.15.0 or later.

**Name of the Vulnerable Software and Affected Versions** Leviton AcquiSuite and Energy Monitoring Hub (affected versions not specified) **Description** Leviton AcquiSuite and Energy Monitoring Hub are susceptible to a cross-site scripting issue. An attacker can craft a malicious payload within URL parameters. When accessed by a user, this payload executes in the client browser, potentially allowing session token theft and control of the service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Western Telematic (WTI) products (affected versions not specified) **Description** The issue concerns a local file inclusion attack (LFI) in the web interface of Western Telematic products. Any authenticated user has privileged access to files on the device's filesystem. The attack is being actively exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Evertz microsystems MViP-II Firmware version 8.6.5 Evertz microsystems XPS-EDGE-* Build 1467 Evertz microsystems evEDGE-EO-* Build 0029 Evertz microsystems MMA10G-* Build 0498 Evertz microsystems 570IPG-X19-10G Build 0691 **Description** The issue allows a remote attacker to execute arbitrary code via a crafted payload to the `login parameters`. This can lead to unauthorized access. **Recommendations** For Evertz microsystems MViP-II Firmware version 8.6.5, update the firmware to a version that includes the fix for this issue. For Evertz microsystems XPS-EDGE-* Build 1467, update the build to a version that includes the fix for this issue. For Evertz microsystems evEDGE-EO-* Build 0029, update the build to a version that includes the fix for this issue. For Evertz microsystems MMA10G-* Build 0498, update the build to a version that includes the fix for this issue. For Evertz microsystems 570IPG-X19-10G Build 0691, update the build to a version that includes the fix for this issue. As a temporary workaround, consider validating input for the `login parameters` to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ATX Ucrypt versions 3.5 and earlier **Description** The web interface of ATX Ucrypt allows authenticated users, or attackers using default credentials for the admin, master, or user account, to include files via a URL in the "/hydra/view/get cc url" url parameter. This can result in Server-Side Request Forgery (SSRF). **Recommendations** For ATX Ucrypt versions 3.5 and earlier, consider disabling access to the "/hydra/view/get cc url" url parameter until a patch is available. Additionally, changing default credentials for the admin, master, and user accounts can help mitigate the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Samsung Harman AMX N-Series N1115 Wallplate Video Encoder versions prior to 1.15.61 Samsung Harman AMX N-Series N1x22A Video Encoder/Decoder versions prior to 1.15.61 Samsung Harman AMX N-Series N1x33A Video Encoder/Decoder versions prior to 1.15.61 Samsung Harman AMX N-Series N1x33 Video Encoder/Decoder versions prior to 1.15.61 Samsung Harman AMX N-Series N2x35 Video Encoder/Decoder versions prior to 1.15.61 Samsung Harman AMX N-Series N2x35A Video Encoder/Decoder versions prior to 1.15.61 Samsung Harman AMX N-Series N2xx2 Video Encoder/Decoder versions prior to 1.15.61 Samsung Harman AMX N-Series N2xx2A Video Encoder/Decoder versions prior to 1.15.61 Samsung Harman AMX N-Series N3000 Video Encoder/Decoder versions prior to 2.12.105 Samsung Harman AMX N-Series N4321 Audio Transceiver versions prior to 1.00.06 **Description** The web interface on multiple Samsung Harman AMX N-Series devices allows directory listing for the `/tmp/` directory without authentication, exposing sensitive information such as command history and screenshots of files being processed. **Recommendations** For Samsung Harman AMX N-Series N1115 Wallplate Video Encoder versions prior to 1.15.61, update to version 1.15.61 or later. For Samsung Harman AMX N-Series N1x22A Video Encoder/Decoder versions prior to 1.15.61, update to version 1.15.61 or later. For Samsung Harman AMX N-Series N1x33A Video Encoder/Decoder versions prior to 1.15.61, update to version 1.15.61 or later. For Samsung Harman AMX N-Series N1x33 Video Encoder/Decoder versions prior to 1.15.61, update to version 1.15.61 or later. For Samsung Harman AMX N-Series N2x35 Video Encoder/Decoder versions prior to 1.15.61, update to version 1.15.61 or later. For Samsung Harman AMX N-Series N2x35A Video Encoder/Decoder versions prior to 1.15.61, update to version 1.15.61 or later. For Samsung Harman AMX N-Series N2xx2 Video Encoder/Decoder versions prior to 1.15.61, update to version 1.15.61 or later. For Samsung Harman AMX N-Series N2xx2A Video Encoder/Decoder versions prior to 1.15.61, update to version 1.15.61 or later. For Samsung Harman AMX N-Series N3000 Video Encoder/Decoder versions prior to 2.12.105, update to version 2.12.105 or later. For Samsung Harman AMX N-Series N4321 Audio Transceiver versions prior to 1.00.06, update to version 1.00.06 or later.