A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0008), Tecnomatix Plant Simulation V2302 (All versions < V2302.0002). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted PRT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21109)

Buffer overflow vulnerability in the modem pinctrl module. Successful exploitation of this vulnerability may affect the integrity and availability of the modem.

The C:\Windows\Temp\Agent.Package.Availability\Agent.Package.Availability.exe file is automatically launched as SYSTEM when the system reboots. Since the C:\Windows\Temp\Agent.Package.Availability folder inherits permissions from C:\Windows\Temp and Agent.Package.Availability.exe is susceptible to DLL hijacking, standard users can write a malicious DLL to it and elevate their privileges.

Vulnerability of commands from the modem being intercepted in the atcmdserver module. Attackers may exploit this vulnerability to rewrite the non-volatile random-access memory (NVRAM), or facilitate the exploitation of other vulnerabilities.

Input verification vulnerability in the WMS API. Successful exploitation of this vulnerability may cause the device to restart.

Vulnerability of missing input length verification in the distributed file system. Successful exploitation of this vulnerability may cause out-of-bounds read.

Format string vulnerability in the distributed file system. Attackers who bypass the selinux permission can exploit this vulnerability to crash the program.

Vulnerability of apps' permission to access a certain API being incompletely verified in the wireless projection module. Successful exploitation of this vulnerability may affect some wireless projection features.

Pexip Infinity before 32 allows Webapp1 XSS via preconfigured links.

An issue in Archer Platform before v.6.13 fixed in v.6.12.0.6 and v.6.13.0 allows an authenticated attacker to obtain sensitive information via the log files.

Cross Site Scripting (XSS) vulnerability in Archer Platform before v.6.13 and fixed in v.6.12.0.6 and v.6.13.0 allows a remote authenticated attacker to execute arbitrary code via a crafted malicious script.

Farsight Tech Nordic AB ProVide

Farsight Tech Nordic AB ProVide version 14.5 - Multiple XSS vulnerabilities (CWE-79) can be exploited by a user with administrator privilege.

7Twenty BOT - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').

7Twenty BOT - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').

Synel Terminals - CWE-494: Download of Code Without Integrity Check

Synel Terminals - CWE-494: Download of Code Without Integrity Check

Tadiran Telecom Composit - CWE-1236: Improper Neutralization of Formula Elements in a CSV File

Tadiran Telecom Composit - CWE-1236: Improper Neutralization of Formula Elements in a CSV File

Tadiran Telecom Aeonix - CWE-22: Improper Limitation of a Pathname to a Restricted Directory

Tadiran Telecom Aeonix - CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Tadiran Telecom Aeonix - CWE-204: Observable Response Discrepancy

Tadiran Telecom Aeonix - CWE-204: Observable Response Discrepancy

AnaSystem SensMini M4 – an authenticated user can cause Denial of Service

AnaSystem SensMini M4 – Using the configuration tool, an authenticated user can cause Denial of Service for the device

JBL soundbar multibeam 5.1 - CWE-798: Use of Hard-coded Credentials

JBL soundbar multibeam 5.1 - CWE-798: Use of Hard-coded Credentials

Heights Telecom ERO1xS-Pro Dual-Band WiFi command injection

Heights Telecom ERO1xS-Pro Dual-Band FW version BZ_ERO1XP.025.