Jose Antonio Pérez Piedra

**Name of the Vulnerable Software and Affected Versions** Wavlink WN575A4 and WN579X3 devices through 2020-05-15 **Description** The issue allows unauthenticated remote users to inject commands via the `key` parameter in a "login request" API endpoint. **Recommendations** For Wavlink WN575A4 and WN579X3 devices through 2020-05-15, avoid using the `key` parameter in the affected login request until the issue is resolved. Restrict access to the login functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: QNAP Systems Inc. Helpdesk versions prior to 3.0.3 Description: The issue is related to improper access control, which could allow attackers to compromise the security of the software by gaining privileges or reading sensitive information. If exploited, this vulnerability could also allow attackers to obtain control of a QNAP device. Recommendations: For versions prior to 3.0.3, update to version 3.0.3 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information and privileges to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** X-Plane versions prior to 11.41 **Description** The issue allows for Arbitrary Memory Write via crafted network packets, which could cause a denial of service or arbitrary code execution. **Recommendations** For versions prior to 11.41, update to version 11.41 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** X-Plane versions prior to 11.41 **Description** The issue is related to multiple improper path validations that could allow reading and writing files from/to arbitrary paths, or a leak of OS credentials to a remote system, via crafted network packets. This could be used to execute arbitrary commands on the system. **Recommendations** For versions prior to 11.41, update to version 11.41 or later to resolve the issue. As a temporary workaround, consider restricting network access to the system until the update is applied.

**Name of the Vulnerable Software and Affected Versions** OpenVPN versions through 2.4.5 **Description** A cross-protocol scripting issue was discovered in the management interface of OpenVPN. When this interface is enabled over TCP without a password and no other clients are connected, attackers can execute arbitrary management commands, obtain sensitive information, or cause a denial of service (SIGTERM) by triggering XMLHttpRequest actions in a web browser. This can be demonstrated by a multipart/form-data POST to "http://localhost:23000" with a "signal SIGTERM" command in a `TEXTAREA` element. The vendor disputes this as a vulnerability, stating it is the result of improper configuration rather than an intrinsic vulnerability. **Recommendations** For OpenVPN versions through 2.4.5, consider disabling the management interface over TCP without a password as a temporary workaround until a more secure configuration can be implemented. Restrict access to the management interface to minimize the risk of exploitation. Avoid using the management interface without proper authentication and authorization mechanisms in place. At the moment, there is no information about a newer version that contains a fix for this vulnerability.