Matt Hamilton

The issue is related to a denial of service (DoS) attack, which can be initiated remotely. It is caused by sending requests with a Content-Length header value that exceeds the actual byte count of the request body, potentially leading to unlimited memory allocation. This can allow an attacker to cause a service disruption. The estimated number of potentially affected devices is not specified.

The default admin password is set to the argocd-server pod name, which could be abused for privilege escalation by insiders with access to the cluster or logs, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are not meant to be kept secret and could wind up just about anywhere.

An issue was discovered that allows Cross-Site Request Forgery (CSRF) to be used to send API requests.

An issue in ConnectWise Control allows remote code execution. Administrative users could upload an unsigned extension ZIP file containing executable code that is subsequently executed by the server.

An issue was discovered where certain HTTP security headers are not used, which could potentially lead to security risks.

An issue was discovered that allows an unauthenticated attacker to determine with certainty if an account exists for a given username, due to a user enumeration vulnerability.

A CORS misconfiguration issue allows JavaScript running on any domain to interact with the server APIs, enabling administrative actions without the victim's knowledge. This is due to the server reflecting the Origin provided by incoming requests.

An issue was discovered in ConnectWise Control, where there is stored XSS in the Appearance modifier.

The issue allows an unauthenticated attacker to read the application's error log via the `components/api.py` component.