Hyp3Rlinx

**Name of the Vulnerable Software and Affected Versions** WinaXe FTP Client version 7.7 **Description** A buffer overflow exists in the FTP banner parsing functionality within the WCMDPA10.dll component. When the client connects to a remote FTP server and receives an overly long '220 Server Ready' response, the component overflows a stack buffer, potentially leading to arbitrary code execution under the context of the user. **Recommendations** Update to a newer version of WinaXe FTP Client that addresses this issue.

**Name of the Vulnerable Software and Affected Versions** OP5 Monitor versions through 7.1.9 **Description** An authenticated command injection vulnerability exists in OP5 Monitor. A user with access to the web interface can exploit the 'Test this command' feature to execute arbitrary shell commands as the unprivileged web application user. The vulnerability resides in the configuration section of the application and requires valid login credentials with access to the command testing functionality. The vulnerable parameter is `cmd str` in the `/command test.php` endpoint. **Recommendations** Update to version 7.2.0 or later.

**Name of the Vulnerable Software and Affected Versions:** Mako Server versions 2.5 and 2.6 **Description:** An OS command injection vulnerability exists within the tutorial interface. An unauthenticated attacker can send a crafted PUT request containing arbitrary Lua `os.execute()` code to the `/examples/save.lsp` endpoint. This code is then persisted on disk and triggered via a subsequent GET request to `/examples/manage.lsp`, allowing remote command execution on the underlying operating system, impacting both Windows and Unix-based deployments. **Recommendations:** Mako Server version 2.5: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Mako Server version 2.6: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IBM i versions 7.3, 7.4, and 7.5 **Description** The issue allows an authenticated attacker to bypass Navigator for i interface restrictions by sending a specially crafted request, enabling them to remotely perform operations that the user is not allowed to perform when using Navigator for i. **Recommendations** For IBM i versions 7.3, 7.4, and 7.5, consider restricting access to the Navigator for i interface until a patch is available. As a temporary workaround, consider disabling the interface or limiting its functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IBM i versions 7.3 through 7.5 **Description** The issue is related to server-side request forgery (SSRF), which may allow an authenticated attacker to send unauthorized requests from the system. This could potentially lead to network enumeration or facilitate other attacks. **Recommendations** For IBM i versions 7.3 through 7.5, consider restricting access to vulnerable components or functions that may be exploited through SSRF until a patch is available. As a temporary workaround, disabling or limiting the functionality that allows server-side requests may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WyreStorm Apollo VX20 versions prior to 1.3.58 **Description** An issue was discovered where the TELNET service prompts for a password only after a valid username is entered. This might make it easier for remote attackers to enumerate user accounts. **Recommendations** For versions prior to 1.3.58, update to version 1.3.58 or later to resolve the issue. As a temporary workaround, consider restricting access to the TELNET service to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WyreStorm Apollo VX20 versions prior to 1.3.58 **Description** An issue allows remote attackers to restart the device via a "/device/reboot" GET request. **Recommendations** For versions prior to 1.3.58, update to version 1.3.58 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/device/reboot" API endpoint until a patch is available.

**Name of the Vulnerable Software and Affected Versions** WyreStorm Apollo VX20 versions prior to 1.3.58 **Description** An issue allows remote attackers to discover cleartext passwords via a SoftAP "GET /device/config" request. This is due to a lack of encrypted confidential data. **Recommendations** For versions prior to 1.3.58, update to version 1.3.58 or later to resolve the issue. As a temporary workaround, consider restricting access to the SoftAP /device/config endpoint until a patch is available.

**Name of the Vulnerable Software and Affected Versions** IBM i Access Client Solutions versions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.4 **Description** The issue is related to incorrect session management in IBM i Access Client Solutions, which can allow an attacker to intercept a user's session and disclose protected NT LAN Manager (NTLM) hash information. If NTLM is enabled, the Windows operating system will attempt to authenticate using the current user's session, potentially allowing a hostile server to capture the NTLM hash information and obtain the user's credentials. This is achieved by modifying UNC capable paths within the ACS configuration files to point to a hostile server. **Recommendations** For IBM i Access Client Solutions versions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.4, consider disabling NTLM authentication or restricting access to UNC capable paths within the ACS configuration files to minimize the risk of exploitation. As a temporary workaround, avoid using NTLM authentication until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** RSA NetWitness Platform versions prior to 12.2 **Description** The issue allows local and admin Windows user accounts to modify the endpoint agent service configuration, either disabling it completely or running user-supplied code or commands. This bypasses tamper-protection features via ACL modification. **Recommendations** For versions prior to 12.2, update to version 12.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the endpoint agent service configuration to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Windows Contacts (affected versions not specified) **Description** The issue is related to insufficient input validation in the Windows Contacts component of Windows operating systems. This can be exploited by an attacker to execute arbitrary code using a specially crafted malicious file. The estimated number of potentially affected devices worldwide is not available. There have been real-world incidents where this issue was exploited. Technical details about exploitation include the use of a specially created malicious file to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WinGate version 9.4.1.5998 **Description** The issue allows local users to gain privileges by replacing an executable file with a Trojan horse due to insecure permissions for the installation directory. **Recommendations** For version 9.4.1.5998, consider restricting access to the installation directory to prevent local users from replacing executable files until a patch is available. As a temporary workaround, ensure that the directory permissions are set to prevent unauthorized modifications. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** rejetto HFS (aka HTTP File Server) version 2.3m Build #300 **Description** The issue allows remote attackers to trigger an invalid-pointer write access violation via concurrent HTTP requests with a long URI or long HTTP headers when virtual files or folders are used. **Recommendations** For rejetto HFS (aka HTTP File Server) version 2.3m Build #300, consider disabling the use of virtual files or folders as a temporary workaround until a patch is available. Restrict access to the server to minimize the risk of exploitation by limiting concurrent HTTP requests.

**Name of the Vulnerable Software and Affected Versions** Avaya IP Office versions 9.x through 11.0.4.3 **Description** A sensitive information disclosure vulnerability was discovered in the web interface component of Avaya IP Office, potentially allowing a local user to gain unauthorized access to the component. This issue may lead to password disclosure. **Recommendations** For versions 9.x through 11.0.4.3, consider restricting access to the web interface component until a patch is available. As a temporary workaround, disabling the web interface component may help minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** CarbonFTP version 1.4 **Description** The issue concerns the use of insecure proprietary password encryption in CarbonFTP. Specifically, the software uses a hard-coded weak encryption key for local FTP server passwords, which is embedded directly in the binary. This poses a significant risk to the security of passwords stored by the application. **Recommendations** For CarbonFTP version 1.4, consider disabling the use of the proprietary password encryption mechanism until a secure alternative is implemented. Restrict access to the local FTP server to minimize the risk of exploitation. Avoid using the hard-coded encryption key for any sensitive data storage. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Trend Micro Security 2019 version 15 **Description** The issue allows an attacker to execute arbitrary code, potentially gaining elevated privileges and tampering with protected services by preventing them from starting. This can be achieved by disabling the services. It is noted that an attacker must already have administrator privileges on the target machine to exploit this issue. **Recommendations** For Trend Micro Security 2019 version 15, consider restricting access to protected services to minimize the risk of exploitation until a fix is available. As a temporary workaround, avoid disabling or modifying protected services to prevent potential tampering. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Trend Micro Security versions 15 through 160 **Description** A Persistent Arbitrary Code Execution issue exists in the Trend Micro Security consumer family of products, potentially allowing an attacker to create a malicious program to escalate privileges and attain persistence on a vulnerable system. **Recommendations** For versions 15 through 160, update to a version that contains a fix for this issue to prevent potential exploitation. As a temporary workaround, consider restricting access to sensitive system components to minimize the risk of privilege escalation until a patch is available.

**Name of the Vulnerable Software and Affected Versions** NAPC Xinet Elegant 6 Asset Library version 6.1.655 **Description** The issue allows for Pre-Authentication SQL Injection via the "/elegant6/login" API endpoint, specifically through the `username` field in the LoginForm when double quotes are used. **Recommendations** For NAPC Xinet Elegant 6 Asset Library version 6.1.655, avoid using double quotes in the `username` field of the LoginForm at the "/elegant6/login" API endpoint until a fix is available. Consider temporarily restricting access to this endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Scanguard through 2019-11-12 on Windows **Description** The issue is related to Insecure Permissions for the installation directory, which can lead to privilege escalation via a Trojan horse executable file. **Recommendations** For Scanguard through 2019-11-12 on Windows, consider restricting access to the installation directory to prevent unauthorized modifications until a fix is available.

**Name of the Vulnerable Software and Affected Versions** MAPLE WBT SNMP Administrator version 2.0.195.15 **Description** The issue is related to an Unauthenticated Remote Buffer Overflow in SnmpAdm.exe. This can be triggered via a long string to the CE Remote feature listening on Port 987. **Recommendations** For MAPLE WBT SNMP Administrator version 2.0.195.15, as a temporary workaround, consider disabling the CE Remote feature listening on Port 987 until a patch is available. Restrict access to the SnmpAdm.exe to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.