Reza Rashidi

Name of the Vulnerable Software and Affected Versions: PNETLab version 4.2.10 Description: The issue arises from the application's failure to properly sanitize user inputs in its file access mechanisms, allowing attackers to perform directory traversal by manipulating file paths in HTTP requests. This enables access to sensitive files outside the intended directory. Recommendations: For PNETLab version 4.2.10, consider implementing proper input sanitation for file access mechanisms to prevent directory traversal attacks. As a temporary workaround, restrict access to sensitive files and directories to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** NTFS Tools version 3.5.1 **Description** The issue is related to insecure information storage. An attacker could exploit this to obtain the application password. The password is stored in the `/Users/user/Library/Application Support/ntfs-tool/config.json` file. **Recommendations** For NTFS Tools version 3.5.1, consider removing or securing the `config.json` file to prevent unauthorized access to the application password. As a temporary workaround, restrict access to the `/Users/user/Library/Application Support/ntfs-tool/` directory until a patch is available.

**Name of the Vulnerable Software and Affected Versions** NetBox versions up to 3.7.0 **Description** A problematic issue has been found in the processing of the file /core/config-revisions of the component Home Page Configuration. The manipulation with the input `<h1 onload=alert(1)>`test`</h1>` leads to cross site scripting. The attack may be initiated remotely. The real existence of this vulnerability is still doubted at the moment. **Recommendations** For versions up to 3.7.0, as a temporary workaround, consider restricting access to the /core/config-revisions file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ioLogik E1200 Series firmware versions v3.3 and prior **Description** A Cross-Site Request Forgery (CSRF) vulnerability has been identified, which may allow an attacker to trick a client into making an unintentional request to the web server. This request will be treated as an authentic request, potentially leading the attacker to perform operations on behalf of the victimized user. **Recommendations** For ioLogik E1200 Series firmware versions v3.3 and prior, consider updating to a version that is not affected by this issue, as no specific fix is provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ioLogik E1200 Series firmware versions v3.3 and prior **Description** A weak cryptographic algorithm vulnerability has been identified, which can help an attacker compromise the confidentiality of sensitive data and may lead to unexpected authorization. The vulnerability is related to the use of defective cryptographic algorithms, allowing a remote attacker to gain unauthorized access to protected information. **Recommendations** For ioLogik E1200 Series firmware versions v3.3 and prior, consider updating to a newer version that addresses the weak cryptographic algorithm vulnerability. As a temporary workaround, restrict access to sensitive data and consider disabling any features that rely on the vulnerable cryptographic algorithms until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.