Nguyen Quoc Viet

The issue is related to insufficient access control in the Zoho ManageEngine ADManager Plus software for managing Active Directory services. It allows a remote attacker to execute arbitrary commands with superuser privileges. Admin users can execute commands on the host machine.

This issue allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. The specific flaw exists within the `ResponseParser` method, resulting from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. User interaction is required to exploit this vulnerability, as the target must connect to a malicious server.

The issue is related to the Base64Element class in Inductive Automation Ignition, which has flaws in its deserialization mechanism. This allows remote attackers to execute arbitrary code on affected installations. The problem stems from the lack of proper validation of user-supplied data, leading to the deserialization of untrusted data. An attacker can exploit this to execute code in the context of SYSTEM. Authentication is required to exploit this vulnerability.

The issue is related to the deserialization mechanism in the RunQuery class of Inductive Automation Ignition, allowing remote attackers to execute arbitrary code on affected installations. The problem stems from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Authentication is required to exploit this vulnerability.

This issue allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. The specific flaw exists within the ModuleInvoke class, resulting from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Authentication is required to exploit this vulnerability.

A Directory Traversal issue allows a remote attacker to obtain sensitive information via the `file` parameter to the "suricata/suricata logs browser.php" endpoint. This enables access to files outside the intended directory, potentially revealing confidential data.