Wietse Boonstra
Researcher level 3
Security Researcher, bugbounty hunter, ethical hacker and loads more from the backcorner of the Netherlands!!!
CSIRT cases
- DIVD-2024-00043 - CyberAudit-Web - SSRF and Authentication bypass CVEs Registered
- DIVD-2024-00024 - Multiple vulnerabilities found in the SOPlanning tool
- DIVD-2024-00011 - Six vulnerabilities in Enphase IQ Gateway devices
- DIVD-2023-00023 - SQL injection in MOVEit Transfer - CVE-2023-34362
- DIVD-2022-00058 - ZK Framework - ZK AuUploader Servlet Upload Vulnerability
Show more Show less
- DIVD-2022-00025 - VMware - CVE-2022-22954
- DIVD-2022-00010 - Auth bypass in SAP
- DIVD-2022-00004 - Post-Log4J Open Database C2 and Monero Miner Infections
- DIVD-2021-00038 - Apache Log4j2
- DIVD-2021-00037 - Critical vulnerabilities in ITarian MSP platform and on-premise solution
- DIVD-2021-00029 - Smartertrack
- DIVD-2021-00026 - Omigod: Microsoft Open Management Interface RCE
- DIVD-2021-00020 - OSNexsus QuantaStor limited disclosure and product warning
- DIVD-2021-00014 - Kaseya Unitrends
- DIVD-2021-00011 - Kaseya VSA Disclosure
- DIVD-2021-00006 - SmarterMail
- DIVD-2021-00002 - Kaseya VSA
- DIVD-2020-00011 - Four critical vulnerabilities in Vembu BDR
CVE Records
- Authentication Bypass in CyberAudit-Web
- SSRF in CyberAudit-Web videx-legacy-ssl
- Remote Code Execution through File Upload in SOPlanning before 1.52.02
- Remote Code Execution through File Upload in SOPlanning before 1.52.02
- Insecure Direct Object Reference to export Database in SOPlanning before 1.52.02
Show more Show less
- SQL Injection in SOPlanning before 1.52.02
- Upload of encrypted packages allows authenticated command execution in Enphase IQ Gateway v4.x and v5.x
- URL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway version 4.x <= 7.x
- URL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway v4.x to v8.x and < v8.2.4225
- Command Injection through Unsafe File Name Evaluation in internal script in Enphase IQ Gateway v4.x to and including 8.x
- Insecure File Generation Based on User Input in Enphase IQ Gateway version 4.x to 8.x and < 8.2.4225
- Unauthenticated Path Traversal via URL Parameter in Enphase IQ Gateway version < 8.2.4225
- ITarian - Local privilege escalation in Endpoint Manager agent on Windows
- ITarian - Any user with a valid session token can create and execute agent procedures and bypass mandatory approvals
- ITarian - Session cookie not protected by HttpOnly flag
- File upload and overwrite to app_data/Config in SmarterTrack v100.0.8019.14010
- Stored XSS in SmarterTrack v100.0.8019.14010
- Information disclosure via direct object access on SmarterTrack v100.0.8019.14010
- Reflective XSS on SmarterTrack v100.0.8019.14010
- Authenticated Remote COmmand Execution as root in OSNEXUS QuantaStor version 6.0.0.355 and others
- SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows XSS.
- Authenticated Stored XSS in OSNEXUS QuantaStor 6.0.0.335
- Local Privilege Escalation to root in OSNEXUS QuantaStor before 6.0.0.355
- Authenticated Remote Command Execution vulnerability in OSNEXUS QuantaStor before 6.0.0.355
- Reflected XSS vulnerability in OSNEXUS QuantaStor before 6.0.0.355
- SSRF vulnerability in OSNEXUS QuantaStor before 6.0.0.355
- Kaseya Unitrends Backup Software before 10.5.5-2 authenticated RCE
- Kaseya Unitrends Client/Agent through 10.5.5 allows remote attackers to execute arbitrary code
- Privilege escalation in Kaseya Unitrends Backup Software before 10.5.5-2
- SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution.
- SmarterTools SmarterMail before Build 7776 allows XSS.
- Unauthenticated XML External Entity vulnerability in Kaseya VSA < v9.5.6
- (Semi-)Authenticated local file inclusion in Kaseya VSA < v9.5.6
- 2FA bypass in Kaseya VSA <= v9.5.6
- Authenticated Authenticated reflective XSS in Kaseya VSA <= v9.5.6
- Unauthenticated Remote Code Execution in Kaseya VSA < v9.5.5
- Authenticated SQL injection in Kaseya VSA < v9.5.6
- Unauthenticated credential leak and business logic flaw in Kaseya VSA <= v9.5.6
- UNAUTHENTICATED SERVER SIDE REQUEST FORGERY IN VEMBU PRODUCTS
- Unauthenticated arbitrary file upload and command execution in Vembu products
- Unauthenticated remote command execution with SYSTEM privileges in Vembu products
- Unauthenticated remote command execution in Vembu products