Paulino Calderon

A vulnerabilidade existe devido à validação insuficiente de entradas no componente Reactive WebServer do Helidon, permitindo que um invasor não autenticado com acesso à rede via HTTP comprometa o Helidon. Ataques bem-sucedidos podem resultar na tomada de controle do Helidon. A vulnerabilidade é difícil de explorar e pode ser aproveitada por um invasor para executar código arbitrário usando solicitações HTTP.

The issue allows remote attackers to inject arbitrary web script or HTML via the PATH INFO, affecting multiple pages, including "manage config email page.php", "manage config workflow page.php", and "bugs/plugin.php".

The issue allows remote attackers to inject arbitrary web script or HTML via the `os`, `os build`, or `platform` parameter to bug reporting or update pages, related to the use of the Projax library. This can be achieved by accessing specific API endpoints, such as bug report page.php or bug update advanced page.php.

The issue allows remote attackers to bypass authentication and gain administrator privileges. This is achieved by setting the `userName` cookie in the `admin.php` file.

Name of the Vulnerable Software and Affected Versions: JAWS version 0.4 Description: A cross-site scripting (XSS) issue exists in the NewTerm function in GlossaryModel.php, allowing remote attackers to inject arbitrary web script or HTML via the `term` or `description` variables. Recommendations: For JAWS version 0.4, as a temporary workaround, consider disabling the NewTerm function in GlossaryModel.php until a patch is available. Restrict input for the `term` and `description` variables to minimize the risk of exploitation.