Jcameron

The issue allows remote authenticated administrators to conduct cross-site scripting (XSS) attacks. This is achieved by exploiting the description field in the custom command functionality of the custom/run.cgi module.

A CSRF issue exists, allowing an attacker to execute arbitrary commands by sending a GET request to the "at/create job.cgi" endpoint with specific parameters in the URI, such as `dir=/` and `cmd=`.

The issue allows remote authenticated users to execute arbitrary Perl code via a crafted file associated with the `type` parameter, also referred to as the monitor type name.

The issue allows remote authenticated users to execute arbitrary commands via an invalid character in a pathname. This can be achieved by using a | (pipe) character in the file/show.cgi endpoint.

The issue allows remote attackers to read arbitrary files without proper authorization. This is due to a lack of authorization check in the file/edit html.cgi component, which permits access to a file's unedited contents via the file field.

A cross-site scripting (XSS) issue allows local users to inject arbitrary web script or HTML via a chfn command that changes the real field, related to useradmin/index.cgi and useradmin/user-lib.pl.