Ashutosh Barot

The issue arises from insufficient session expiration when an administrator makes a security-relevant edit to an existing, logged-on user. For instance, if a user's password is changed by an administrator due to a credential leak, the user account's current session remains valid after the password change. This could allow an attacker who initially compromised the credential to stay logged in and cause further damage.

The issue allows an attacker to expose information by utilizing the Inspect Element browser feature when a user's session has ended due to inactivity. This enables the attacker to remove the login panel and view the details available in the last webpage visited by the previous user.

The issue allows an attacker to expose information when a user's session has ended due to inactivity. By using the inspect element browser feature, an attacker can remove the login panel and view the details available in the last webpage visited by the previous user.

The issue concerns the transmission of quarantine and sysinfo files via clear text. This means that sensitive information could be intercepted and read by unauthorized parties.

The issue allows attackers with local admin rights to modify sensitive anti-virus settings via a brute-force attack on the settings password. This can be exploited by attackers to compromise the security of the system.

The issue allows attackers with local admin rights to obtain access to files in the File Vault via a brute-force attack on the `password`. This can be exploited by attackers to gain unauthorized access to sensitive files.

A missing rate limit in the process of adding a wallet via email address allows remote attackers to submit a large number of email addresses, potentially identifying valid ones. This issue can be exploited in conjunction with a username enumeration technique to enumerate a large number of valid users' email addresses.

A Username Enumeration via Error Message issue was discovered because an "EMAIL DOES NOT EXIST" error message occurs whenever a submitted email address is incorrect, but there is a different error message for invalid credentials with a correct email address.

An issue allows an adversary to gain access to a miner's information, including recent payments, unclaimed balance, old balance, projected payout, and mining statistics such as profitability and efficiency, by exploiting missing authorization. A valid email address is required to retrieve this information.

The issue allows an attacker to perform harmful database operations by deceiving a user into clicking on a crafted URL, potentially leading to actions such as deleting records or dropping/truncating tables.