Hyp3Rlinx

A buffer overflow exists in the FTP banner parsing functionality within the WCMDPA10.dll component. When the client connects to a remote FTP server and receives an overly long '220 Server Ready' response, the component overflows a stack buffer, potentially leading to arbitrary code execution under the context of the user.

An authenticated command injection vulnerability exists in OP5 Monitor. A user with access to the web interface can exploit the 'Test this command' feature to execute arbitrary shell commands as the unprivileged web application user. The vulnerability resides in the configuration section of the application and requires valid login credentials with access to the command testing functionality. The vulnerable parameter is `cmd str` in the `/command test.php` endpoint.

An OS command injection vulnerability exists within the tutorial interface. An unauthenticated attacker can send a crafted PUT request containing arbitrary Lua `os.execute()` code to the `/examples/save.lsp` endpoint. This code is then persisted on disk and triggered via a subsequent GET request to `/examples/manage.lsp`, allowing remote command execution on the underlying operating system, impacting both Windows and Unix-based deployments.

The issue allows an authenticated attacker to bypass Navigator for i interface restrictions by sending a specially crafted request, enabling them to remotely perform operations that the user is not allowed to perform when using Navigator for i.

The issue is related to server-side request forgery (SSRF), which may allow an authenticated attacker to send unauthorized requests from the system. This could potentially lead to network enumeration or facilitate other attacks.

An issue was discovered where the TELNET service prompts for a password only after a valid username is entered. This might make it easier for remote attackers to enumerate user accounts.

An issue allows remote attackers to restart the device via a "/device/reboot" GET request.

An issue allows remote attackers to discover cleartext passwords via a SoftAP "GET /device/config" request. This is due to a lack of encrypted confidential data.

The issue is related to incorrect session management in IBM i Access Client Solutions, which can allow an attacker to intercept a user's session and disclose protected NT LAN Manager (NTLM) hash information. If NTLM is enabled, the Windows operating system will attempt to authenticate using the current user's session, potentially allowing a hostile server to capture the NTLM hash information and obtain the user's credentials. This is achieved by modifying UNC capable paths within the ACS configuration files to point to a hostile server.

The issue allows local and admin Windows user accounts to modify the endpoint agent service configuration, either disabling it completely or running user-supplied code or commands. This bypasses tamper-protection features via ACL modification.

The issue is related to insufficient input validation in the Windows Contacts component of Windows operating systems. This can be exploited by an attacker to execute arbitrary code using a specially crafted malicious file. The estimated number of potentially affected devices worldwide is not available. There have been real-world incidents where this issue was exploited. Technical details about exploitation include the use of a specially created malicious file to execute arbitrary code.

The issue allows local users to gain privileges by replacing an executable file with a Trojan horse due to insecure permissions for the installation directory.

The issue allows remote attackers to trigger an invalid-pointer write access violation via concurrent HTTP requests with a long URI or long HTTP headers when virtual files or folders are used.

A sensitive information disclosure vulnerability was discovered in the web interface component of Avaya IP Office, potentially allowing a local user to gain unauthorized access to the component. This issue may lead to password disclosure.

The issue concerns the use of insecure proprietary password encryption in CarbonFTP. Specifically, the software uses a hard-coded weak encryption key for local FTP server passwords, which is embedded directly in the binary. This poses a significant risk to the security of passwords stored by the application.

The issue allows an attacker to execute arbitrary code, potentially gaining elevated privileges and tampering with protected services by preventing them from starting. This can be achieved by disabling the services. It is noted that an attacker must already have administrator privileges on the target machine to exploit this issue.

A Persistent Arbitrary Code Execution issue exists in the Trend Micro Security consumer family of products, potentially allowing an attacker to create a malicious program to escalate privileges and attain persistence on a vulnerable system.

The issue allows for Pre-Authentication SQL Injection via the "/elegant6/login" API endpoint, specifically through the `username` field in the LoginForm when double quotes are used.

The issue is related to Insecure Permissions for the installation directory, which can lead to privilege escalation via a Trojan horse executable file.

The issue is related to an Unauthenticated Remote Buffer Overflow in SnmpAdm.exe. This can be triggered via a long string to the CE Remote feature listening on Port 987.