Pedro Ribeiro

**Name of the Vulnerable Software and Affected Versions** Raptor RDF Syntax Library versions 2.0.0 through 2.0.16 **Description** The issue is related to an integer underflow when normalizing a URI with the turtle parser in the `raptor uri normalize path()` function. This problem occurs in the Raptor RDF Syntax Library. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** For Raptor RDF Syntax Library versions 2.0.0 through 2.0.16, update to a version later than 2.0.16 to resolve the issue. As a temporary workaround, consider restricting the use of the `raptor uri normalize path()` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Raptor RDF Syntax Library versions 2.0.16 and earlier **Description** A heap-based buffer over-read issue occurs when parsing triples with the nquads parser in the `raptor ntriples parse term internal()` function. This issue affects the Raptor RDF Syntax Library. **Recommendations** For versions 2.0.16 and earlier, consider disabling the `raptor ntriples parse term internal()` function until a patch is available to prevent exploitation of the heap-based buffer over-read vulnerability.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 17.1 iPadOS versions prior to 17.1 watchOS versions prior to 10.1 iOS versions prior to 16.7.2 iPadOS versions prior to 16.7.2 macOS Sonoma versions prior to 14.1 Safari versions prior to 17.1 tvOS versions prior to 17.1 **Description** A logic issue was addressed with improved checks. Processing web content may lead to arbitrary code execution. The issue is related to insufficient input validation in the WebKit browser's web page display modules. Exploitation of the issue may allow a remote attacker to execute arbitrary code. **Recommendations** For iOS versions prior to 17.1, update to iOS 17.1 or later. For iPadOS versions prior to 17.1, update to iPadOS 17.1 or later. For watchOS versions prior to 10.1, update to watchOS 10.1 or later. For iOS versions prior to 16.7.2, update to iOS 16.7.2 or later. For iPadOS versions prior to 16.7.2, update to iPadOS 16.7.2 or later. For macOS Sonoma versions prior to 14.1, update to macOS Sonoma 14.1 or later. For Safari versions prior to 17.1, update to Safari 17.1 or later. For tvOS versions prior to 17.1, update to tvOS 17.1 or later.

**Name of the Vulnerable Software and Affected Versions** ManageEngine ADSelfService Plus (affected versions not specified) **Description** This issue allows physically present attackers to execute arbitrary code on affected installations of ManageEngine ADSelfService Plus. Authentication is not required to exploit this issue. The specific flaw exists within the Password Reset Portal used by the GINA client, resulting from the lack of proper authentication of data received via HTTP. An attacker can leverage this issue to bypass authentication and execute code in the context of SYSTEM. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Western Digital My Cloud devices before OS5 **Description** The issue concerns a nobody account with a blank password in Western Digital My Cloud devices. **Recommendations** For Western Digital My Cloud devices before OS5, consider changing the password of the nobody account to a secure one to prevent unauthorized access. As a temporary workaround, restrict access to the device until a secure configuration can be applied.

**Name of the Vulnerable Software and Affected Versions** AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000) **Description** This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within the handling of APP files, specifically due to the process loading a library from an unsecured location. An attacker can leverage this to execute code in the context of the current process. **Recommendations** For AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000), consider restricting access to unsecured locations where libraries are loaded to minimize the risk of exploitation. As a temporary workaround, avoid handling APP files from untrusted sources until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Softing Secure Integration Server version V1.22 **Description** The issue allows for authentication bypass via a machine-in-the-middle attack. The administration interface is accessible via plaintext HTTP protocol by default, which facilitates the attack. An HTTP request may contain a session cookie that can be captured and used for authenticating to the server. **Recommendations** For Softing Secure Integration Server version V1.22, consider disabling the administration interface's accessibility via plaintext HTTP protocol as a temporary workaround until a patch is available. Restrict access to the administration interface to minimize the risk of exploitation. Avoid using the session cookie in HTTP requests until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Softing Secure Integration Server version V1.22 **Description** A denial-of-service condition can be created in the software by sending a crafted HTTP packet without a content-type header. **Recommendations** For Softing Secure Integration Server version V1.22, as a temporary workaround, consider restricting access to the HTTP endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Softing Secure Integration Server version V1.22 **Description** A denial-of-service condition can be created in the software by sending a crafted HTTP packet with a large `content-length` header. This issue affects the Softing Secure Integration Server. **Recommendations** For Softing Secure Integration Server version V1.22, consider restricting access to the HTTP endpoint to minimize the risk of exploitation until a patch is available. As a temporary workaround, limiting the size of the `content-length` header may help prevent the denial-of-service condition. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Softing Secure Integration Server version V1.22 **Description** A denial-of-service condition can be created in the software by sending a crafted HTTP packet with a -1 content-length header. This issue affects the Softing Secure Integration Server, allowing an attacker to potentially disrupt service. **Recommendations** For Softing Secure Integration Server version V1.22, consider restricting access to the HTTP endpoint to minimize the risk of exploitation until a patch is available. As a temporary workaround, disabling the handling of HTTP packets with negative content-length headers may help mitigate the issue.

**Name of the Vulnerable Software and Affected Versions** Softing Secure Integration Server, edgeConnector, and edgeAggregator software (affected versions not specified) **Description** The issue concerns the use of default administrator credentials, with the username as `admin` and the password as `admin`. This allows for direct login to the server to perform administrative functions without prompting the user to change the default password upon installation or first login. The process to change the password is complex and requires multiple steps. **Recommendations** For Softing Secure Integration Server, edgeConnector, and edgeAggregator software, change the default administrator password `admin` to a strong, unique password as soon as possible to prevent unauthorized access. As a temporary workaround, consider restricting access to the server until the default password is changed. Avoid using the default `admin` credentials for any administrative functions until the password is updated.

**Name of the Vulnerable Software and Affected Versions** Softing Secure Integration Server version V1.22 **Description** The issue is related to a denial-of-service condition that can be triggered by a crafted HTTP packet with a missing HTTP URI. This can cause a NULL pointer dereference, leading to a denial-of-service condition. **Recommendations** For Softing Secure Integration Server version V1.22, consider implementing packet validation to ensure all HTTP packets contain a valid HTTP URI to prevent the denial-of-service condition. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Softing Secure Integration Server version V1.22 Dahua ASI7213X-T1 (affected versions not specified) **Description** The issue is related to an uncontrolled search path element that allows an attacker to execute arbitrary code by placing a malicious dll. This can lead to privilege escalation. Additionally, there is a vulnerability in the Dahua ASI7213X-T1 access control terminal software that allows bypassing the authentication procedure, enabling remote access to the device without a password. **Recommendations** For Softing Secure Integration Server version V1.22, consider restricting access to the wbemcomn module to minimize the risk of exploitation. For Dahua ASI7213X-T1, as a temporary workaround, restrict remote access to the device until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco Small Business RV Series Routers versions RV160, RV260, RV340, and RV345 **Description** The issue is caused by a stack-based buffer overflow in the SSL VPN module of the Cisco Small Business RV340, RV340W, RV345, and RV345P routers. This can be exploited by a remote attacker using a specially crafted HTTP request, allowing them to execute arbitrary code with root privileges. The vulnerability can also lead to elevation of privileges, execution of arbitrary commands, bypassing of authentication and authorization protections, fetching and running unsigned software, and denial of service (DoS). **Recommendations** For Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers, update to a fixed version to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TP-Link TL-WA1201 version 1.0.1 Build 20200709 rel.66244(5553) **Description** This issue allows remote attackers to execute arbitrary code on affected installations of TP-Link TL-WA1201 wireless access points. Authentication is not required to exploit this issue. The specific flaw exists within the handling of DNS responses. A crafted DNS message can trigger an overflow of a fixed-length, stack-based buffer. An attacker can leverage this issue to execute code in the context of root. **Recommendations** For TP-Link TL-WA1201 version 1.0.1 Build 20200709 rel.66244(5553), as a temporary workaround, consider disabling the handling of DNS responses until a patch is available. Restrict access to the DNS handling module to minimize the risk of exploitation. Avoid using crafted DNS messages in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** TP-Link Archer C90 version 1.0.6 Build 20200114 rel.73164(5553) **Description** This issue allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer C90 routers. Authentication is not required to exploit this issue. The specific flaw exists within the handling of DNS responses. A crafted DNS message can trigger an overflow of a fixed-length, stack-based buffer. An attacker can leverage this issue to execute code in the context of root. **Recommendations** For TP-Link Archer C90 version 1.0.6 Build 20200114 rel.73164(5553), as a temporary workaround, consider restricting access to the DNS response handling mechanism until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Western Digital My Cloud devices before OS5 **Description** The issue allows REST API access by low-privileged accounts, as demonstrated by API commands for firmware uploads and installation. This can potentially lead to the execution of arbitrary code by a remote attacker. The vulnerability is related to the implementation of the Western Digital MyCloud PR4100 network storage device's software interface, which is associated with unrestricted uploads of dangerous file types. **Recommendations** For Western Digital My Cloud devices before OS5, consider disabling REST API access for low-privileged accounts until a patch is available. Restrict access to API commands for firmware uploads and installation to minimize the risk of exploitation. Avoid using the API for firmware updates until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Western Digital My Cloud devices before OS5 **Description** The issue is related to incorrect cryptographic signature verification in the Western Digital MyCloud PR4100 firmware. This could allow a remote attacker to execute arbitrary code. The problem arises because Western Digital My Cloud devices before OS5 do not use cryptographically signed firmware upgrade files. **Recommendations** For Western Digital My Cloud devices before OS5, consider updating to OS5 or later to address the issue of unsigned firmware upgrade files, as this update likely includes cryptographically signed firmware upgrades. At the moment, there is no information about additional mitigation measures for this specific issue.

**Name of the Vulnerable Software and Affected Versions** Arlo Q Plus version 1.9.0.3 278 **Description** This issue allows attackers with physical access to escalate privileges on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the SSH service, where the device can be booted into a special operation mode and hard-coded credentials are accepted for SSH authentication. An attacker can leverage this issue to escalate privileges and execute arbitrary code in the context of root. **Recommendations** For Arlo Q Plus version 1.9.0.3 278, as a temporary workaround, consider disabling the SSH service until a patch is available. Restrict physical access to the device to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** GdkPixbuf versions prior to 2.42.8 **Description** The issue is related to a heap-based buffer overflow in the composite frame() function of the GdkPixbuf library when handling GIF files. This overflow can be exploited to execute arbitrary code, particularly on 32-bit systems. **Recommendations** For versions prior to 2.42.8, update to version 2.42.8 or later to resolve the issue. As a temporary workaround, consider restricting the use of the composite frame() function when handling GIF files until a patch is available.