Hyp3Rlinx

يوجد تجاوز سعة المخزن المؤقت في وظيفة تحليل شعار FTP في المكون WCMDPA10.dll. عندما يتصل العميل بخادم FTP بعيد ويتلقى استجابة «220 Server Ready» طويلة بشكل مفرط، يتسبب المكون في حدوث تجاوز سعة المخزن المؤقت للمكدس، مما قد يؤدي إلى تنفيذ تعليمات برمجية تعسفية في سياق المستخدم.

توجد ثغرة أمنية تتعلق بحقن الأوامر بعد المصادقة في OP5 Monitor. يمكن للمستخدم الذي يتمتع بإمكانية الوصول إلى واجهة الويب استغلال ميزة «اختبار هذا الأمر» لتنفيذ أوامر شل تعسفية بصفته مستخدمًا غير متمتع بامتيازات في تطبيق الويب. تكمن الثغرة الأمنية في قسم إعدادات التطبيق وتتطلب بيانات اعتماد تسجيل دخول صالحة مع إمكانية الوصول إلى وظيفة اختبار الأوامر. المعلمة المعرضة للخطر هي `cmd str` في نقطة النهاية `/command test.php`.

توجد ثغرة أمنية تتعلق بحقن أوامر نظام التشغيل في واجهة البرنامج التعليمي. يمكن لمهاجم غير معتمد إرسال طلب PUT مُعدّل يحتوي على كود Lua `os.execute()` تعسفي إلى نقطة النهاية `/examples/save.lsp`. يتم بعد ذلك حفظ هذا الكود على القرص وتشغيله عبر طلب GET لاحق إلى `/examples/manage.lsp`، مما يسمح بتنفيذ الأوامر عن بُعد على نظام التشغيل الأساسي، مما يؤثر على كل من عمليات النشر المستندة إلى Windows وUnix.

The issue allows an authenticated attacker to bypass Navigator for i interface restrictions by sending a specially crafted request, enabling them to remotely perform operations that the user is not allowed to perform when using Navigator for i.

The issue is related to server-side request forgery (SSRF), which may allow an authenticated attacker to send unauthorized requests from the system. This could potentially lead to network enumeration or facilitate other attacks.

An issue was discovered where the TELNET service prompts for a password only after a valid username is entered. This might make it easier for remote attackers to enumerate user accounts.

An issue allows remote attackers to restart the device via a "/device/reboot" GET request.

An issue allows remote attackers to discover cleartext passwords via a SoftAP "GET /device/config" request. This is due to a lack of encrypted confidential data.

The issue is related to incorrect session management in IBM i Access Client Solutions, which can allow an attacker to intercept a user's session and disclose protected NT LAN Manager (NTLM) hash information. If NTLM is enabled, the Windows operating system will attempt to authenticate using the current user's session, potentially allowing a hostile server to capture the NTLM hash information and obtain the user's credentials. This is achieved by modifying UNC capable paths within the ACS configuration files to point to a hostile server.

The issue allows local and admin Windows user accounts to modify the endpoint agent service configuration, either disabling it completely or running user-supplied code or commands. This bypasses tamper-protection features via ACL modification.

The issue is related to insufficient input validation in the Windows Contacts component of Windows operating systems. This can be exploited by an attacker to execute arbitrary code using a specially crafted malicious file. The estimated number of potentially affected devices worldwide is not available. There have been real-world incidents where this issue was exploited. Technical details about exploitation include the use of a specially created malicious file to execute arbitrary code.

The issue allows local users to gain privileges by replacing an executable file with a Trojan horse due to insecure permissions for the installation directory.

The issue allows remote attackers to trigger an invalid-pointer write access violation via concurrent HTTP requests with a long URI or long HTTP headers when virtual files or folders are used.

A sensitive information disclosure vulnerability was discovered in the web interface component of Avaya IP Office, potentially allowing a local user to gain unauthorized access to the component. This issue may lead to password disclosure.

The issue concerns the use of insecure proprietary password encryption in CarbonFTP. Specifically, the software uses a hard-coded weak encryption key for local FTP server passwords, which is embedded directly in the binary. This poses a significant risk to the security of passwords stored by the application.

The issue allows an attacker to execute arbitrary code, potentially gaining elevated privileges and tampering with protected services by preventing them from starting. This can be achieved by disabling the services. It is noted that an attacker must already have administrator privileges on the target machine to exploit this issue.

A Persistent Arbitrary Code Execution issue exists in the Trend Micro Security consumer family of products, potentially allowing an attacker to create a malicious program to escalate privileges and attain persistence on a vulnerable system.

The issue allows for Pre-Authentication SQL Injection via the "/elegant6/login" API endpoint, specifically through the `username` field in the LoginForm when double quotes are used.

The issue is related to Insecure Permissions for the installation directory, which can lead to privilege escalation via a Trojan horse executable file.

The issue is related to an Unauthenticated Remote Buffer Overflow in SnmpAdm.exe. This can be triggered via a long string to the CE Remote feature listening on Port 987.