Antonio José Gálvez Sánchez

**Name of the Vulnerable Software and Affected Versions** Advanced IP Scanner (affected versions not specified) Advanced Port Scanner (affected versions not specified) **Description** The issue involves the unauthorized exposure of confidential information when the applications initiate a network scan, sending the NTLM hash of the user performing the scan. This can be exploited by intercepting network traffic to a legitimate server or by setting up a fake server, affecting both local and remote scenarios, and is relevant for both HTTP/HTTPS and SMB protocols. **Recommendations** For Advanced IP Scanner, consider restricting the use of the network scan feature until a fix is available. For Advanced Port Scanner, avoid using the network scan functionality until the issue is resolved. As a temporary workaround, consider disabling the network scan feature in both applications to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenGnsys version 1.1.1d (Espeto) **Description** A SQL Injection issue has been discovered, allowing an attacker to inject malicious SQL code into the login page. This could enable the attacker to bypass the login or retrieve all the information stored in the database. **Recommendations** For OpenGnsys version 1.1.1d (Espeto), as a temporary workaround, consider restricting access to the login page until a patch is available. Avoid using the login functionality with untrusted input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenGnsys version 1.1.1d (Espeto) **Description** The issue allows an attacker to send a POST request to the endpoint '/opengnsys/images/M Icons.php' and modify the file extension due to a lack of file extension verification. This results in a webshell injection. **Recommendations** For OpenGnsys version 1.1.1d (Espeto), as a temporary workaround, consider restricting access to the '/opengnsys/images/M Icons.php' endpoint until a patch is available. Additionally, implement file extension verification to prevent unauthorized file uploads.

**Name of the Vulnerable Software and Affected Versions** OpenGnsys version 1.1.1d (Espeto) **Description** The issue allows an attacker to view a php backup file, specifically `controlaccess.php-LAST`, where database credentials are stored. This is an information exposure vulnerability. **Recommendations** For OpenGnsys version 1.1.1d (Espeto), consider restricting access to the `controlaccess.php-LAST` file to prevent unauthorized viewing of database credentials. As a temporary workaround, restrict access to this file until a patch is available.

**Name of the Vulnerable Software and Affected Versions** OpenGnsys version 1.1.1d (Espeto) **Description** The issue allows an attacker to enumerate all files in the web tree by accessing a php file. This is an information exposure vulnerability. **Recommendations** For OpenGnsys version 1.1.1d (Espeto), consider restricting access to php files until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: LaborOfficeFree version 19.10 Description: The issue is related to inadequate access control in the backup directory of LaborOfficeFree, allowing any authenticated user to read backup files in the directory '%programfiles(x86)% LaborOfficeFree BackUp'. This could potentially lead to the disclosure of protected information. Recommendations: For version 19.10, consider restricting access to the backup directory '%programfiles(x86)% LaborOfficeFree BackUp' to prevent unauthorized users from reading sensitive files. As a temporary workaround, limit the permissions of authenticated users to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** LaborOfficeFree version 19.10 **Description** The issue affects the executable files LOF service.exe and LaborOfficeFree.exe, allowing an attacker to read and extract the username and password from the database. This can lead to unauthorized access to the application's database backup. The attacker can log in remotely with root-like privileges. **Recommendations** For version 19.10, consider disabling the executable files LOF service.exe and LaborOfficeFree.exe until a patch is available to prevent exploitation. Restrict access to the directory '%programfiles(x86)%LaborOfficeFree' to minimize the risk of unauthorized access. Avoid using the default credentials for the database to reduce the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LaborOfficeFree version 19.10 **Description** The issue is related to weak password requirements in LaborOfficeFree, which can be exploited to perform a brute force attack. This allows an attacker to easily discover the root password of the MySQL database. **Recommendations** For version 19.10, update the MySQL database root password to a stronger one to prevent brute force attacks. As a temporary workaround, consider restricting access to the MySQL database to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** LaborOfficeFree version 19.10 **Description** The issue is related to a weak MySQL database root password in LaborOfficeFree. This allows an attacker to calculate the root password of the MySQL database used by LaborOfficeFree using two constants. The vulnerability is associated with weak password requirements. Exploitation of this issue may enable an attacker to obtain the root password of the MySQL database. **Recommendations** For LaborOfficeFree version 19.10, consider changing the MySQL database root password to a stronger one to prevent exploitation. As a temporary workaround, restrict access to the MySQL database until a more secure password is implemented.