Ismael Nava

**Name of the Vulnerable Software and Affected Versions** aSc TimeTables version 2020.11.4 **Description** The application can be crashed, leading to a denial of service, by overwriting the Subject title field with a large buffer. An attacker can generate a 1000-character buffer and paste it into the Subject title to trigger an application crash and potential instability. The vulnerable field is the Subject title. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Core FTP LE version 2.2 **Description** The application can be crashed by overwriting the account field with a large buffer, leading to a denial of service. An attacker can create a text file containing 20,000 repeated characters and paste it into the account field, causing the application to become unresponsive and require reinstallation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SpotFTP-FTP Password Recover version 2.4.8 **Description** The software contains a denial of service issue that allows attackers to crash the application. This is achieved by triggering a large buffer overflow. An attacker can create a text file containing 1000 'Z' characters and provide it as a registration code, leading to the application crash. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** aSc TimeTables versão 2021.6.2 **Description** Um problema de negação de serviço permite que atacantes causem a falha do aplicativo ao sobrescrever os campos de título da disciplina com dados excessivos. Ao gerar um buffer de 10.000 caracteres e colá-lo no título da disciplina, um atacante pode causar instabilidade no aplicativo e um possível travamento. **Recommendations** No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** TapinRadio version 2.13.7 **Description** TapinRadio version 2.13.7 contains a denial of service issue in the application proxy settings. An attacker can cause the program to crash by overflowing input fields. Specifically, pasting a large buffer of approximately 20,000 characters into the `username` and `address` fields leads to the application becoming unresponsive and requiring reinstallation. **Recommendations** Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, limit the input length allowed in the `username` and `address` fields within the application proxy settings.

**Name of the Vulnerable Software and Affected Versions** Kite versão 1.2020.1119.0 **Description** O serviço Windows KiteService contém um problema de caminho de serviço não entre aspas. Atacantes locais podem explorar o caminho não entre aspas em 'C:Program FilesKiteKiteService.exe' para injetar executáveis maliciosos, potencialmente levando à execução de código arbitrário e escalonamento de privilégios no sistema. **Recommendations** Para a versão 1.2020.1119.0, certifique-se de que o caminho do serviço para o KiteService esteja devidamente entre aspas para evitar a execução de binários maliciosos.

**Name of the Vulnerable Software and Affected Versions** Nsauditor version 3.2.2.0 **Description** The software contains a denial of service issue that allows attackers to crash the application. This is achieved by overwriting the Event Description field with a large buffer. Specifically, a 10,000-character 'U' buffer, when pasted into the Event Description field, triggers the application crash. The vulnerable field is the Event Description field. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AgataSoft PingMaster Pro version 2.1 **Description** The software contains a denial of service issue within the Trace Route feature. An attacker can cause the application to crash by exploiting a buffer overflow in the host name input field. Specifically, providing a 10,000-character buffer to the `hostname` input can trigger the crash and potentially lead to system instability. **Recommendations** Apply a fix that properly validates the length of the input provided to the `hostname` field in the Trace Route feature. As a temporary workaround, limit the number of characters allowed in the `hostname` input field.

**Name of the Vulnerable Software and Affected Versions** Managed Switch Port Mapping Tool version 2.85.2 **Description** The software contains a denial of service issue that allows attackers to crash the application. This is achieved by creating an oversized buffer. Specifically, attackers can generate a 10,000-character buffer and paste it into the IP Address and SNMP Community Name fields to trigger the application crash. The vulnerable parameters are the IP Address and SNMP Community Name fields. **Recommendations** Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, limit the length of input accepted in the IP Address and SNMP Community Name fields.

**Name of the Vulnerable Software and Affected Versions** PDF Complete Corporate Edition version 4.1.45 **Description** The software contains an unquoted service path issue in the `pdfcDispatcher` service. This allows local attackers to potentially execute arbitrary code. Exploitation involves leveraging the unquoted path in the service binary location to inject malicious executables, which will then run with elevated LocalSystem privileges. **Recommendations** Apply appropriate quoting to the service path to prevent the execution of unauthorized code.

**Name of the Vulnerable Software and Affected Versions** MacPaw Encrypto versão 1.0.1 **Description** Um problema de caminho de serviço não delimitado por aspas existe na configuração do Encrypto Service. Atacantes locais podem explorar o caminho não delimitado em 'C:Program FilesEncrypto' para injetar executáveis maliciosos, potencialmente levando à execução de código arbitrário e escalonamento de privilégios em sistemas Windows. **Recommendations** No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** iDailyDiary version 4.30 **Description** The application contains a denial of service issue that allows attackers to crash it. This is achieved by overflowing the preferences tab name field with a large input, specifically a 2,000,000 character buffer, when pasting it into the default diary tab name. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** RarmaRadio version 2.72.8 **Description** The software contains a denial of service issue that allows attackers to crash the application. This is achieved by overflowing network configuration fields with large character buffers. An attacker can create a 100,000 character buffer and input it into multiple network settings fields, leading to application instability and a potential crash. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Flame II HSPA USB Modem (affected versions not specified) **Description** The Flame II HSPA USB Modem contains a flaw due to an unquoted service path in its Windows service configuration. This allows attackers to potentially execute arbitrary code with elevated system privileges by exploiting the unquoted path located at 'C:Program Files (x86)Internet TelcelApplicationController.exe'. The `ApplicationController.exe` executable is vulnerable. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tftpd32 SE version 4.60 **Description** The software contains an unquoted service path issue that may allow local attackers to execute arbitrary code with elevated privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious executables that will be run with system-level permissions. **Recommendations** Update to a newer version that addresses this issue. As a temporary workaround, consider modifying the service configuration to use quoted paths to prevent the execution of unauthorized code.