Simon Rawet

The issue allows remote logging to be accessed by unauthenticated users, enabling an attacker to hijack system logs. This can include sensitive data such as user names and HTTP data.

The system is affected by remote and local file inclusion due to a lack of restrictions on targeted files. This can lead to attacks such as system fingerprinting, internal port scanning, Server Side Request Forgery (SSRF), or remote code execution (RCE).

A DOM-based cross-site scripting issue was found in a legacy utility of the software, which can be exploited for cross-site scripting (XSS) attacks.

The issue allows authenticated code execution. Authenticated users with the right to create reports can utilize BIRT templates to execute code.

The issue allows remote command execution through the "go get" command. By using custom domains, an attacker can trick "go get" into reusing a Git checkout from a Subversion repository, potentially executing malicious commands in .git/hooks/ on the system running "go get". This can be achieved by arranging custom domains so that example.com/pkg1 points to a Subversion repository and example.com/pkg1/pkg2 points to a Git repository, and including a Git checkout in the Subversion repository's pkg2 directory.

An issue exists where the PLAIN authentication scheme is used on network connections not secured with TLS, contrary to the requirements of RFC 4954. This allows a man-in-the-middle SMTP server to obtain the username and password. The `smtp.PlainAuth` implementation in Go sends the username and password if a man-in-the-middle SMTP server does not advertise STARTTLS but does advertise that PLAIN auth is acceptable.

The issue allows remote attackers to write to arbitrary .ini files by using a crafted language.save task.

The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability. This is achieved by using a .. (dot dot) in the `filename` parameter within a "ticket.download attachment" task.

The issue allows remote attackers to execute arbitrary SQL commands via the `ticket code` or `email` parameter. Additionally, remote authenticated users can execute arbitrary SQL commands via the `filter order` parameter.

The issue allows remote attackers to inject arbitrary web script or HTML via vectors related to `name` and `message`.

The issue allows remote attackers to read the support tickets of arbitrary users by obtaining the target ticketId and navigating to the "http://{target}/component/helpdeskpro/?view=ticket&id={ticketId}" endpoint.