Vipin Chaudhary

يفشل منطق التحقق من صحة الأجهزة في تطبيق إجراءات حماية دليل المكونات الإضافية بشكل متسق عند استخدام خيار مسار تدقيق الملفات القديم.

يفشل محرك PKI للتحقق من صحة ACME في رفض الأهداف المحلية أثناء إصدار تحديات «http-01» و«tls-alpn-01». قد يؤدي هذا الخلل إلى توجيه الطلبات إلى أهداف داخل الشبكة المحلية، مما قد يؤدي إلى تسرب المعلومات.

The issue is related to improper authorization on specific APIs in the API implementation of Cisco ACI Multi-Site Orchestrator (MSO). This allows an authenticated, remote attacker to elevate privileges on an affected device by sending crafted HTTP requests. A successful exploit could allow an attacker who is authenticated with non-Administrator privileges to elevate to Administrator privileges on an affected device.

A directory traversal issue has been discovered, potentially allowing an unauthenticated attacker to access files outside the restricted directory on the remote server.

A Stored Cross-Site Scripting issue could potentially be exploited by malicious users to compromise the affected system via a filename of an uploaded image file.

A Reflected Cross-Site Scripting issue could potentially be exploited by malicious users to compromise the affected system. The issue is related to the servlet/Download, ` docbase` or ` username` parameter.

The issue concerns a CSRF vulnerability in the add vhost.php file.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `virtual del` parameter. This can lead to the execution of malicious scripts on the client-side.