Tobias

يوجد في البرنامج تقييد غير صحيح لمسار اسم ملف يؤدي إلى دليل مقيد، وهو ما يُعرف باسم «عبور المسار» (Path Traversal). وهذا يسمح بالوصول إلى الملفات أو الدلائل خارج المجلد المقيد المقصود.

توجد مشكلة في نظام التفويض في WebinarIgnition، مما يسمح باستغلال مستويات أمان التحكم في الوصول التي تم تكوينها بشكل غير صحيح.

The issue is an unauthenticated remote code execution vulnerability that can be triggered by an HTTP endpoint exposed to the network.

The issue affects devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" and allows for the leakage of the database, including system settings and user accounts. This can be triggered by an HTTP endpoint exposed to the network.

The issue is related to an origin bypass via the host header in an HTTP request. This can be triggered by an HTTP endpoint exposed to the network.

The issue allows remote attackers to bypass intended per-title read restrictions. This is achieved via a parse action to the "api.php" endpoint.

The issue is related to multiple race conditions that can be exploited by remote authenticated users. This can happen in opportunistic circumstances by leveraging the lack of thread safety. The exploitation can occur through a rapid series of operations, such as mail-sending or draft-saving. This allows attackers to read the private e-mail of other persons.