Sayli Ambure

Name of the Vulnerable Software and Affected Versions: Digisol DG-HR3400 (affected versions not specified) Description: The issue is a Cross Site Scripting (XSS) vulnerability that can be exploited via the NTP server name in the Time and date module and the `Keyword` in the URL Filter. This allows for potential malicious script execution. Recommendations: As a temporary workaround, consider restricting access to the Time and date module and the URL Filter to minimize the risk of exploitation. Avoid using the `Keyword` in the URL Filter until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tata Sonata Smart SF Rush version 1.12 **Description** An issue has been identified where the smart band operates with no pairing, utilizing mode 0 Bluetooth LE security level. This results in unencrypted data transmission over the air. Furthermore, the data sent to the smart band lacks authentication or signature verification, allowing any attacker to control a parameter of the device. **Recommendations** For Tata Sonata Smart SF Rush version 1.12, consider disabling Bluetooth connectivity until a patch or secure pairing mechanism is implemented to prevent unauthorized control of the device. Restrict access to the device's parameters to minimize the risk of exploitation. Avoid using the device until the issue is resolved with proper encryption and authentication measures. At the moment, there is no information about a newer version that contains a fix for this vulnerability.