Benjamin K.M

The issue is related to insufficient access control for various commands. The affected commands include `/set dname`, `/mylogo`, `/LocalPlay`, `/irdevice.xml`, `/Sendkey`, `/setvol`, `/hotkeylist`, `/init`, `/playlogo.jpg`, `/stop`, `/exit`, `/back`, and `/playinfo`.

The issue is related to an undocumented TELNET service within the BusyBox subsystem, which can lead to root access.

The issue concerns an XSS vulnerability in the error msg exception-handling value for the `ldap user` parameter to the `cgi-mod/ldap load entry.cgi` module. The injection point of the issue is the Add Update module.

The issue allows remote attackers to bypass intended GET restrictions via a brute-force approach. This is because the password is appended to the URI for authorization. For example, attackers can use "GET /login.html passwd1" and "GET /login.html passwd2" and so on to bypass restrictions.

A persistent XSS issue is located in the `FTP Link` element of the `Private Message` module. The editor of the private message module allows inserting links without sanitizing the content, enabling remote attackers to inject malicious script code payloads as a private message. The injection point is the editor `FTP Link` element and the execution point occurs in the message body context on arrival. The request method to inject is POST with restricted user privileges.

A cross-site scripting (XSS) issue was found in the Weblication CMS Core & Grid. The vulnerability is located in the `wFilemanager.php` and `index.php` files of the `/grid5/scripts/` modules. The injection point is the Project `Title`, and the execution point is the `Inhaltsprojekte` output listing section. Remote attackers with privileged user accounts can inject malicious script code to compromise user session credentials or manipulate the web-application module output context. The injection is done through the POST request method.

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel versions through v0.9.8.12 Description: The issue concerns an XSS vulnerability. It can be exploited via the `id` parameter to the `phpini editor` module or the `email address` parameter to the `mail add-new` module in the `index.php` file. Recommendations: For versions through v0.9.8.12, avoid using the `id` parameter in the `phpini editor` module and the `email address` parameter in the `mail add-new` module until a fix is available. As a temporary workaround, consider restricting access to these modules to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to a stack-based buffer overflow that can occur via the `SqlName`, `SqlPswd`, `Database`, `UserName`, or `Password` field in a SilentInstall XML document. However, the vendor disputes this issue, stating that neither a buffer overflow nor a crash can be reproduced, and that reading XML documents is implemented exclusively with managed code within the Microsoft .NET Framework.

The issue is related to a Cross-Site Scripting (XSS) problem. It affects the CFS Custom Category and Cloud AV DB Exclusion Settings screens.

The issue is related to a Cross-Site Scripting (XSS) vulnerability, which occurs via the Configure SSO screens. This allows for potential malicious script execution.