Mr Me

The issue allows the opening of a specially crafted report format file, which may cause an out of bounds read. This can lead to a system crash, allow data exfiltration, or enable remote code execution.

The issue allows execution of script code by opening a specially crafted report format file, which may lead to remote code execution, data exfiltration, or cause a system crash. Multiple vulnerabilities have been identified in the LAquis SCADA LGX Report, including path traversal, information disclosure, remote code execution, and arbitrary file creation.

The issue allows a user-supplied path in file operations prior to proper validation, which can be leveraged by an attacker to disclose sensitive information under the context of the web server process.

The issue allows an attacker to execute remote code on the server due to improper sanitation of user input. This can be achieved through command injection vulnerabilities in various components of the LAquis SCADA Web Server, including the relatorioindividual TAG, acompanhamentotela TAGALTERE, acompanhamentotela PAGINA, and relatorioindividual TITULO.

The issue allows for an out of bounds read when opening a specially crafted project file. This may cause a system crash or allow data exfiltration.

The issue allows an attacker to execute remote code on the server due to improper authorization or sanitation of user input. This can be achieved through command injection in certain parameters, such as `relatorionome TAG`, `relatorionome TITULO`, and `relatorionome NOME`.

The issue allows an attacker to gain unauthorized access to the system with high privileges due to the use of hard-coded credentials.

The issue allows an authentication bypass, which may enable an attacker to access sensitive data.

The issue allows an attacker to supply a pointer for a controlled memory address using a specially crafted project file. This may lead to remote code execution, data exfiltration, or cause a system crash.