Joshua Lehr

A Remote Code Execution issue in the addon CUx-Daemon allows remote authenticated attackers to execute system commands as root remotely via a simple HTTP request.

A Local File Inclusion (LFI) issue in the addon CUx-Daemon 1.11a allows remote authenticated attackers to read sensitive files via a simple HTTP Request.

The issue allows session fixation, where an attacker can create session IDs and send them to the victim. After the victim logs in to the session, the attacker can use that session. This could lead to the creation of SSH logins after a valid session, potentially compromising the system.

The issue allows for Remote Code Execution in the `ReGa.runScript` method. An authenticated attacker can easily execute code and compromise the system.

A Remote Code Execution issue in the DNS Query Web UI allows remote authenticated attackers to execute arbitrary commands via a crafted DNS Query address field in a JSON API request.