Warisse Valentin

A path traversal issue exists in the Desktop API, where improper limitation of a pathname to a restricted directory allows remote attackers to write limited files and conduct limited denial-of-service attacks. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with input that is not properly neutralized.

A server-side request forgery (SSRF) issue exists in the PersonMail API. This allows remote authenticated users to obtain non-sensitive information. SSRF is a flaw where an attacker can induce the server to make requests to an unintended location.

An improper neutralization of input during web page generation, known as Cross-site Scripting (XSS), occurs in the extract domain component. This allows remote authenticated users, through UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM. This issue may also expose users to session theft, credential compromise, or unauthorized actions within the application.

An improper neutralization of input during web page generation, known as Cross-site Scripting (XSS), occurs in the extract domain component. This allows remote authenticated users to read or write restricted files and perform limited denial-of-service attacks in DSM through UI interaction.

يؤدي التعطيل غير السليم للمدخلات أثناء إنشاء صفحة الويب إلى حدوث مشكلة في البرمجة النصية عبر المواقع (XSS) في وظيفة جهات الاتصال. وهذا يسمح للمستخدمين المصادق عليهم عن بُعد بقراءة أو كتابة ملفات محددة تحتوي على معلومات غير حساسة عبر نواقل غير محددة.

An improper neutralization of CRLF sequences, known as CRLF injection, exists in the User API. This issue allows remote authenticated users to read or write arbitrary files and perform denial-of-service attacks following a system reboot. CRLF injection occurs when an application fails to properly filter Carriage Return (CR) and Line Feed (LF) characters, allowing an attacker to inject new lines into the output stream.