Yokoacc

يسمح التعبير النمطي المستخدم للتحقق من صحة مدخلات المضيف ونصوص إجراءات الأحداث بتجاوز عملية التحقق عند تمكين الوضع متعدد الأسطر. وعلى وجه التحديد، يمكن التحايل على استخدام علامات التثبيت (`^` و`$`) في عملية التحقق من صحة المدخلات التي يحددها المسؤول عن طريق إدخال حرف سطر جديد. وهذا يسمح للمستخدمين المصادق عليهم بإدخال أوامر شل وتنفيذها.

The issue was addressed with improved UI. Visiting a malicious website may lead to address bar spoofing.

The issue allows an attacker to execute code via the `DYLIB INSERT LIBRARIES` environment variable. This is a code injection problem in Remote Desktop Manager on macOS.

An inconsistent user interface issue was addressed with improved state management. Visiting a malicious website may lead to address bar spoofing.

The issue involves the WebKit component and allows remote attackers to spoof the address bar via a crafted web site. This can be achieved by manipulating a website to deceive users about the actual URL being visited.

The issue allows for CSRF, potentially resulting in obtaining admin privileges. The affected endpoint is "public/rolechangeadmin".

The issue allows for remote execution of arbitrary PHP code through a CSRF vulnerability. It is specifically found in the "admin/home#/logos/" endpoint.

The issue allows for obtaining admin privileges through CSRF in the "admin/home#/person/" endpoint.

A CSRF issue exists, allowing the Navigation Social to be changed by manipulating the `value[#][*]` parameter in the "admin/settings/update/" page.

The issue concerns a CSRF problem. It affects the "admin/settings/update/" page, specifically with the `value` parameter. This allows an attacker to change the Colophon.

The issue concerns a CSRF problem. It affects the "admin/settings/update/" page, specifically with the `nav-social` parameter. This allows an attacker to change the Navigation Social settings.

The issue concerns a CSRF problem. It affects the "admin/settings/update/" page, specifically with the `colophon` parameter. This allows the Colophon to be changed.

The issue concerns a CSRF problem. It affects the "admin/ajax/users/delete/" page, specifically with the `id` parameter. This allows an unauthorized user deletion.

The issue is related to an untrusted search path vulnerability in the installer. This vulnerability can be exploited by a local user to gain privileges via a Trojan horse DLL in the current working directory.