Eunsol Lee

**Name of the Vulnerable Software and Affected Versions** Groupware (affected versions not specified) **Description** The issue is related to the hslogin2.dll ActiveX Control in Groupware, which lacks integrity verification of policy files during the update process. This allows a remote attacker to induce a user to visit a crafted web page, potentially leading to malicious code infection by downloading and executing remote files. The attacker can exploit this by setting specific arguments to the ActiveX method. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Reportexpress ProPlus (affected versions not specified) **Description** The issue allows for arbitrary code execution by inserting VBscript into the configure file (rxp). This can be achieved through the configuration file, potentially allowing malicious actions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Kaoni ezHTTPTrans versions 1.0.0.70 and prior **Description** The issue allows a remote attacker to download arbitrary files by setting specific arguments to an ActiveX method, potentially leading to code execution if the victim's PC is rebooted. **Recommendations** For versions 1.0.0.70 and prior, consider disabling the vulnerable ActiveX control until a patch is available. Restrict access to the affected ActiveX method to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Kaoni ezHTTPTrans versions 1.0.0.70 and prior **Description** The issue allows a remote attacker to download and execute arbitrary files by setting the arguments to the ActiveX method, which can be leveraged for code execution. **Recommendations** For versions 1.0.0.70 and prior, consider disabling the ActiveX control until a patch is available to prevent remote attackers from downloading and executing arbitrary files.