John Page

توجد ثغرة أمنية تتعلق بحقن أوامر نظام التشغيل في واجهة البرنامج التعليمي. يمكن لمهاجم غير معتمد إرسال طلب PUT مُعدّل يحتوي على كود Lua `os.execute()` تعسفي إلى نقطة النهاية `/examples/save.lsp`. يتم بعد ذلك حفظ هذا الكود على القرص وتشغيله عبر طلب GET لاحق إلى `/examples/manage.lsp`، مما يسمح بتنفيذ الأوامر عن بُعد على نظام التشغيل الأساسي، مما يؤثر على كل من عمليات النشر المستندة إلى Windows وUnix.

The issue allows an authenticated attacker to bypass Navigator for i interface restrictions by sending a specially crafted request, enabling them to remotely perform operations that the user is not allowed to perform when using Navigator for i.

The issue is related to incorrect session management in IBM i Access Client Solutions, which can allow an attacker to intercept a user's session and disclose protected NT LAN Manager (NTLM) hash information. If NTLM is enabled, the Windows operating system will attempt to authenticate using the current user's session, potentially allowing a hostile server to capture the NTLM hash information and obtain the user's credentials. This is achieved by modifying UNC capable paths within the ACS configuration files to point to a hostile server.

The issue is related to insufficient input validation in the Windows Contacts component of Windows operating systems. This can be exploited by an attacker to execute arbitrary code using a specially crafted malicious file. The estimated number of potentially affected devices worldwide is not available. There have been real-world incidents where this issue was exploited. Technical details about exploitation include the use of a specially created malicious file to execute arbitrary code.

The issue allows local users to gain privileges by replacing an executable file with a Trojan horse due to insecure permissions for the installation directory.

A sensitive information disclosure vulnerability was discovered in the web interface component of Avaya IP Office, potentially allowing a local user to gain unauthorized access to the component. This issue may lead to password disclosure.

The issue concerns the use of insecure proprietary password encryption in CarbonFTP. Specifically, the software uses a hard-coded weak encryption key for local FTP server passwords, which is embedded directly in the binary. This poses a significant risk to the security of passwords stored by the application.

The issue allows an attacker to execute arbitrary code, potentially gaining elevated privileges and tampering with protected services by preventing them from starting. This can be achieved by disabling the services. It is noted that an attacker must already have administrator privileges on the target machine to exploit this issue.

A Persistent Arbitrary Code Execution issue exists in the Trend Micro Security consumer family of products, potentially allowing an attacker to create a malicious program to escalate privileges and attain persistence on a vulnerable system.

The issue allows an attacker to place malicious files in the same directory, potentially leading to arbitrary remote code execution (RCE) when executed.

The issue is related to an Unauthenticated Remote Buffer Overflow in SnmpAdm.exe. This can be triggered via a long string to the CE Remote feature listening on Port 987.

The issue allows for an Invalid Pointer Write Denial of Service (DoS) in the HC.Server service.

The issue is related to improper process resource handling in the system scanning component. This could allow a local attacker to disable the scanning functionality, enabling executable files to be launched without being analyzed for threats. An attacker could exploit this by gaining local access to a system running Microsoft Windows and executing a malicious file, preventing the scanning services from functioning properly and leaving the system unprotected from further intrusion.

The issue allows local users to cause a denial of service, resulting in menu functionality loss. This is achieved by creating an LNK file that points to a second LNK file associated with a Start menu. The root cause is a Directory Traversal bug via the `id` parameter in the `sensor details.html` file, enabling the creation of empty files in arbitrary directories.

The issue allows attackers to gain privileges via a Trojan horse wintab32.dll file located in the same directory as a .nxs file. This can be executed when the .nxs file and the DLL are in the current working directory. The directory could be on a local filesystem or a network share.

The issue is related to XML External Entity (XXE) errors, which can allow a remote attacker to disclose protected information using a specially crafted file.

The issue is related to errors in XML link restrictions on external objects (XXE) in Microsoft SQL Server Management Studio. Exploitation of this issue may allow a remote attacker to disclose protected information using a specially crafted file.

Name of the Vulnerable Software and Affected Versions: Microsoft SQL Server Management Studio (affected versions not specified) Description: The issue is related to insufficient restriction of XML external entity (XXE) references in Microsoft SQL Server Management Studio. This could allow a remote attacker to disclose protected information by using a specially crafted XML file. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows unauthenticated directory traversal, resulting in file disclosure. This is achieved by using a ..%2F in the `RESULTPAGE` parameter of the "WEBACCOUNT.CGI" endpoint.

The issue is related to the FTP service, which allows remote attackers to conduct a PORT command bounce scan via port 8000, resulting in a Server-Side Request Forgery (SSRF) attack. This can also lead to network port scanning and potentially enable a man-in-the-middle attack. The vulnerability is associated with incorrect security requirements of the FTP Server component.