Wietse Boonstra

Security Researcher, bugbounty hunter, ethical hacker and loads more from the backcorner of the Netherlands!!!1111oneoneone

Social media

Icon - wietsman
Icon - Wietse Boonstra

Articles / cases / cves

CSIRT Cases

• DIVD-2021-00014 - Kaseya Unitrends
• DIVD-2021-00011 - Kaseya VSA Limited Disclosure
• DIVD-2021-00006 - SmarterMail
• DIVD-2021-00002 - Kaseya VSA
• DIVD-2020-00011 - Four critical vulnerabilities in Vembu BDR

CVEs discovered

• CVE-2021-26471 - Unauthenticated remote command execution in Vembu products
• CVE-2021-26472 - Unauthenticated remote command execution with SYSTEM privileges in Vembu products
• CVE-2021-26473 - Unauthenticated arbitrary file upload and command execution in Vembu products
• CVE-2021-26474 - Unauthenticated server side request forgery in Vembu products
• CVE-2021-30116 - Unautheticated credential leak and business logic flaw in Kaseya VSA <= v9.5.6
• CVE-2021-30117 - Autheticated SQL injection in Kaseya VSA < v9.5.6
• CVE-2021-30118 - Unautheticated RCE in Kaseya VSA < v9.5.5
• CVE-2021-30119 - Authenticated Authenticated reflective XSS in Kaseya VSA <= v9.5.6
• CVE-2021-30120 - 2FA bypass in Kaseya VSA <= v9.5.6
• CVE-2021-30121 - Authenticated local file inclusion in Kaseya VSA < v9.5.6
• CVE-2021-30201 - Authenticated XML External Entity vulnerability in Kaseya VSA < v9.5.6
• CVE-2021-32233 - SmarterTools SmarterMail before Build 7776 allows XSS
• CVE-2021-32234 - SmarterTools SmarterMail before Build 7776 allows RCE
• CVE-2021-40385 - Privilege escalation from read-only to administrator in web interface of UniTrends Server < v10.5.5-2
• CVE-2021-40386 - Undisclosed critical vulnerability in Unitrends Client, currently unpatched
• CVE-2021-40387 - Authenticated Remote Code Execution in UniTrends Server < v10.5.5-2
• CVE-2021-43977 - SmarterTools SmarterMail before 100.0.7803 allows XSS