Sahil Dhar

The issue allows privilege escalation through the User Administration module.

The issue is related to authorization being mishandled, which allows for account takeover.

The issue is related to a sensitive data leak that can lead to privilege escalation.

The issue arises from the lack of validation of the `plugin type` parameter when generating error messages for an invalid plugin type, leading to a Cross Site Scripting (XSS) issue. This allows an attacker to execute arbitrary JavaScript code in the web browser of the affected user.

The issue allows remote code execution via BCP file overwrite through the ChangeDBAPI component.

The issue allows remote command execution when updating proxy settings through the Admin ProxySettings and Tenant ProxySettings components.

The issue arises from the lack of validation of the database schema name when handling a DR-SCHEMA-SYNC request in the DataEngine Xnode Server application. This allows an authenticated attacker to execute code in the context of the product by writing a JSP file to the webroot directory via directory traversal.

The issue allows an attacker to bypass authentication for the DataEngine Xnode server and execute all operations in the context of the admin user, due to the use of default admin credentials for communication with the server.

The issue is related to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12. This vulnerability can allow a remote attacker to access confidential data, compromise data integrity, and cause a denial of service using a specially crafted GIF file.

An issue was discovered that allows for arbitrary file upload through the `network/mesh/edit-nds.php` endpoint, enabling an attacker to upload `.php` files and execute code on the server with root user privileges. The authentication for accessing this component can be bypassed by using hard-coded credentials.

An issue in the Diagnostic Tools component of the Wifi-soft UniBox controller allows for Remote Command Execution. This is due to the `tools/ping` Ping feature being vulnerable, enabling an attacker to execute arbitrary system commands on the server with root user privileges. The authentication for accessing this component can be bypassed by utilizing hard-coded credentials.

Name of the Vulnerable Software and Affected Versions: Wicket jQuery UI versions 6.28.0 and earlier Wicket jQuery UI versions 7.9.1 and earlier Wicket jQuery UI versions 8.0.0-M8 and earlier Description: A security issue has been discovered in the WYSIWYG editor of Wicket jQuery UI, allowing an attacker to submit arbitrary JS code to the WYSIWYG editor. Recommendations: For versions 6.28.0 and earlier, update to a version later than 6.28.0 to resolve the issue. For versions 7.9.1 and earlier, update to a version later than 7.9.1 to resolve the issue. For versions 8.0.0-M8 and earlier, update to a version later than 8.0.0-M8 to resolve the issue.

The issue allows an authenticated attacker to deny service for privileged users due to the lack of password protection for CRUD operations on these users.

The issue concerns SQL Injection via the `sSortDir 0` parameter in the List Users API, specifically affecting the `/admin/user list backend.php` endpoint. This allows an attacker to potentially gain access to the data in a connected MySQL database.

The issue concerns SQL Injection in the Batch Manager component of Piwigo. Specifically, the `element ids` parameter in the "admin/batch manager unit.php" endpoint is vulnerable when in unit mode. This allows an attacker to potentially gain access to the data in a connected MySQL database.

The Configuration component of Piwigo is vulnerable to SQL Injection via the `order by` array parameter in the admin/configuration.php file. An attacker can exploit this to gain access to the data in a connected MySQL database.