Tseng

Name of the Vulnerable Software and Affected Versions: udn News Android APP (affected versions not specified) Description: The issue concerns the storage of user sessions in the logcat file when a user logs into the udn News Android APP. This allows a malicious APP or an attacker with physical access to the Android device to retrieve the session and use it to log into the news APP and other services provided by udn. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: udn News Android APP (affected versions not specified) Description: The issue concerns the storage of unencrypted user sessions in the local database of the udn News Android APP when a user logs in. This allows a malicious APP or an attacker with physical access to the Android device to retrieve the session and use it to log into the news APP and other services provided by udn. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Combodo iTop (affected versions not specified) **Description** The issue is related to a stored Cross-site Scripting vulnerability. This can be exploited by uploading a file that contains a malicious script. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Combodo iTop (affected versions not specified) **Description** The issue is related to Broken Access Control in a function within Combodo iTop. This allows an unauthorized attacker to inject commands and disclose system information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Combodo iTop (affected versions not specified) **Description** The issue is related to a cross-site request forgery (CSRF) vulnerability. This means that attackers can execute specific commands by forging requests from a malicious site. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Combodo iTop (affected versions not specified) **Description** A security misconfiguration exists in Combodo iTop, which can expose sensitive information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Combodo iTop (affected versions not specified) **Description** The issue concerns the lack of validation for inputted parameters, allowing attackers to inject malicious commands and initiate a cross-site scripting (XSS) attack. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.