Gionathan Armando Reale

A vulnerabilidade permite que um invasor local obtenha informações confidenciais devido ao armazenamento de credenciais em texto simples. Isso ocorre porque as credenciais não estão suficientemente protegidas no software.

The issue arises from a discrepancy in response headers when responding to different HTTP methods. Additionally, predictable responses occur when accessing and interacting with the `SITE PATH QUERY`. This allows for potential fingerprinting.

The issue arises from mishandled data saved from websites in the online vault, leading to a Cross Site Scripting (XSS) problem.

A full path disclosure issue was discovered, allowing a user to trigger an error and discover the full path of Matomo on the disk. This occurs because `lastError.file` is used in `plugins/CorePluginsAdmin/templates/safemode.twig`. The vendor disputes the significance of this issue.

The issue allows remote attackers to obtain potentially sensitive information. This is achieved via a request to the "ws/gatshipWs.asmx/SqlVersion" API endpoint.