Ashish Kamble

The issue concerns the use of the Accusoft Prizm Content flash component in the Accellion FTP server, which contains multiple parameters, such as `customTabCategoryName` and `customButton1Image`, that are vulnerable to cross-site scripting.

The issue allows an attacker to determine valid user accounts by enumerating them, as the server only returns the username in the response if the username is invalid.

The issue allows remote authenticated users to bypass an intended administrative-authentication requirement. This enables them to read or change parameter values by making a direct request.

The issue allows remote attackers to enumerate account names via a series of authentication attempts, due to different error messages being provided for failed authentication attempts depending on whether the username exists.

The issue allows remote attackers to bypass authentication and restart the software.

The issue allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and daemon crash, via crafted GET or POST requests.

The issue concerns a hardcoded serial-console password for a privileged account in the firmware of the affected switches. This might allow physically proximate attackers to obtain access by establishing a console session to a nonstandard installation where this account is enabled, and leveraging knowledge of this password.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the web-server component. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

The issue concerns the use of hardcoded RSA private keys and certificates in the firmware of affected devices. This makes it easier for remote attackers to defeat cryptographic protection mechanisms for HTTPS sessions by leveraging knowledge of a private key from another installation.

A cross-site request forgery issue allows remote attackers to hijack the authentication of arbitrary users.

The issue allows remote attackers to obtain sensitive information. This can be achieved by sending a "pretty=true" action to the " cluster/health" API endpoint.

The issue is related to an unrestricted file upload vulnerability. This allows remote attackers to execute arbitrary code by uploading a file with an executable extension and the image/jpeg content type.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occur via two main avenues: the search field in `plugin/index.html` or the title field in the Create Featured Result form in `admin/main.jsp`.

The issue allows remote attackers to obtain sensitive information without requiring authentication for FTP sessions. This can be achieved via RETR commands.

The issue allows remote attackers to obtain access via unspecified vectors due to a hardcoded password of `admin` for the `admin` account.