Maxim Suslov

A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system and execute commands on the underlying operating system. This vulnerability is due to a lack of authentication in a specific API and improper validation of user-supplied data. An attacker could exploit this vulnerability by uploading arbitrary files to an affected system. A successful exploit could allow the attacker to store malicious files on the system, execute arbitrary commands on the operating system, and elevate privileges to root.

A command injection issue exists in the `show zysync server contents` function, allowing an unauthenticated attacker to execute some operating system commands by sending a crafted HTTP POST request. This is due to the lack of neutralization of special elements used in the operating system command. The exploitation of this issue may allow a remote attacker to execute arbitrary code.

A command injection issue exists in the web server of the Zyxel NAS326 and NAS542 firmware due to the lack of neutralization of special elements used in operating system commands. This could allow a remote attacker to execute arbitrary operating system commands by sending a specially crafted URL to a vulnerable device.

The issue is related to an improper authentication vulnerability in the authentication module of the Zyxel NAS326 and NAS542 firmware. This vulnerability could allow an unauthenticated attacker to obtain system information by sending a crafted URL to a vulnerable device. The vulnerability is associated with deficiencies in the authentication procedure, which can be exploited to gain unauthorized access to the device.

The pre-authentication command injection issue in Zyxel NAS devices could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request. This could enable an attacker to run arbitrary commands on affected systems.

A vulnerability in the web management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to bypass security protections and upload malicious files to the affected system. This is due to improper validation of files uploaded to the web management interface. An attacker could exploit this by uploading a maliciously crafted file, allowing them to store malicious files on the device and potentially execute arbitrary code on the affected device with root privileges.

A vulnerability in the web services interface could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. This issue is due to insufficient validation of user-supplied input by the web services interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link, potentially allowing the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.