Pascal Zenker

A critical issue has been found in the Email Handler component of MailCleaner, leading to os command injection. The manipulation can be initiated remotely. The issue affects some unknown processing of the component, and the exploit has been disclosed to the public.

A critical issue has been found in MailCleaner, affecting the SOAP Service component. The vulnerability leads to os command injection, which can be exploited with local access. The affected function includes getStats, Services silentDump, Services stopStartMTA, Config saveDateTime, Config hostid, Logs StartGetStat, and dumpConfiguration. An exploit for this issue has been disclosed publicly.

A critical issue affects an unknown part of the component Admin Endpoints, leading to path traversal. The manipulation can be initiated remotely. The issue has been disclosed publicly and may be exploited.

A vulnerability was found in the Log File Endpoint component, which can be exploited to lead to cross-site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

A critical issue has been found in the Admin Endpoints component of MailCleaner, affecting an unknown functionality. This issue leads to os command injection, allowing remote attacks. The exploit for this issue has been disclosed publicly.

A problematic vulnerability was found in the Admin Interface component of MailCleaner, affecting an unknown function. The manipulation of Mail Message leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

A vulnerability has been found in the Web Interface component, leading to protection mechanism failure. The attack can be launched remotely. The vendor does not regard this as a vulnerability, considering it a feature for customers with various environmental needs met through different firmware builds. To avoid potential roll-back attacks, the vendor removes vulnerable builds from public servers as a remediation effort. The exploit has been disclosed to the public and may be used.

A vulnerability has been found in the Web Configuration Application component of the affected devices. The manipulation leads to insufficiently random values. It is possible to initiate the attack remotely. The complexity of an attack is rather high, and the exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.

A vulnerability was found in the HTTP Header Handler component, where the manipulation of the `Cookie` argument leads to denial of service. The attack can be initiated remotely.

The issue is related to a lack of necessary checks when changing the password, allowing a remote attacker to change the administrator's password. The manipulation of the `device.auth.localAdminPassword` argument leads to an unverified password change. It is possible to launch the attack remotely.

The issue affects some unknown processing of the component Diagnostic Telnet Mode, leading to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

A critical issue was found in the Test Automation Mode component of the Poly Trio 8800, which can be manipulated to create a backdoor. The attack can be launched on the physical device. Additionally, there is a vulnerability related to undocumented configuration commands in the Poly Lens Management Cloud Registration component of Poly Trio phones and acoustic systems for conference calls, which can allow an attacker to elevate their privileges.

A vulnerability was found in the Poly Lens Management Cloud Registration component, affecting an unknown part of it. The manipulation leads to missing authorization, and it is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. This issue is related to deficiencies in the authorization procedure of the Poly Lens application interface for Poly Trio phones and acoustic systems for conference calls.

A problematic vulnerability has been found, affecting some unknown functionality. The manipulation leads to the use of a risky cryptographic algorithm. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.

A problematic issue has been found in the API component, affecting the processing of the file /api/browserextension/UpdatePassword/. The manipulation of the `PasswordID` argument leads to authorization bypass. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

A problematic vulnerability was found in the component URL Field Handler of Click Studios Passwordstate and Passwordstate Browser Extension Chrome. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

A critical issue affects the Browser Extension Provisioning component, leading to improper authorization. The attack can be initiated remotely. It is estimated that an unknown number of devices may be affected.

A vulnerability has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome, classified as problematic. This issue affects unknown code, leading to insufficiently protected credentials. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

A critical vulnerability was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome, affecting the component API. The manipulation leads to authentication bypass by assumed-immutable data, and the attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Researchers discovered seven types of vulnerabilities, including problems related to authentication and authorization bypass, incorrect password protection, hardcoded credentials, and XSS vulnerability. The vulnerability may allow an unauthenticated attacker to extract user passwords. Given the product's wide adoption, including by Fortune 500 companies, Passwordstate is a frequent target for hackers.

A problematic vulnerability was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome, affecting an unknown part. The manipulation leads to hard-coded credentials and can be initiated remotely. The exploit has been disclosed to the public and may be used.