Steven Seeley

A critical vulnerability has been identified in Apache Struts, allowing attackers to manipulate file upload parameters and enable path traversal, potentially leading to remote code execution. This issue is related to the file upload component of Apache Struts, which contains a directory traversal vulnerability. The vulnerability can be exploited by manipulating the `uploadFileName` parameter, allowing attackers to upload malicious files to arbitrary locations on the server.

The issue is related to the ParameterVersionJavaSerializationCodec class in Inductive Automation Ignition, which is associated with weaknesses in the authentication procedure. This allows a remote attacker to execute arbitrary code in the context of SYSTEM due to the lack of proper validation of user-supplied data, resulting in the deserialization of untrusted data. No authentication is required to exploit this issue.

The issue is related to errors in data serialization within the JavaSerializationCodec class of Inductive Automation Ignition. This allows remote attackers to execute arbitrary code on affected installations without requiring authentication. The problem stems from the lack of proper validation of user-supplied data, leading to the deserialization of untrusted data. An attacker can leverage this to execute code in the context of SYSTEM.

A low privileged attacker could create a local ZIP file containing a malicious script in any location, which could be abused to load a DLL with SYSTEM privileges. The vulnerability is related to the use of dangerous methods or functions.

The issue is related to improper path validation, which could allow an attacker to upload a specially crafted malicious file or delete any file or directory with SYSTEM privileges. This could result in local privilege escalation or a denial-of-service condition. The vulnerability is associated with errors in processing relative paths to directories.

The affected products are vulnerable to an integer overflow or wraparound, which could allow an attacker to crash the server and remotely execute arbitrary code.

The issue is related to an improper validation of array index. This could allow an attacker to crash the server and remotely execute arbitrary code.

The issue is related to the ZipUtils class in the NETGEAR ProSAFE Network Management System, which is caused by improper restriction of a directory path with limited access. This allows a remote attacker to bypass security restrictions and execute arbitrary code. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The flaw exists due to the lack of proper validation of a user-supplied path prior to using it in file operations, allowing an attacker to execute code in the context of SYSTEM.

The issue is related to an unrestricted file upload vulnerability in the UpLoadServlet class, which can be exploited by remote attackers to execute arbitrary code on affected installations. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The flaw exists due to the lack of proper validation of user-supplied data, allowing the upload of arbitrary files. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.

This issue allows remote attackers to escalate privileges on affected installations. Although authentication is required to exploit this issue, the existing authentication mechanism can be bypassed. The specific flaw exists within the `clearAlertByIds` function, resulting from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this issue to escalate privileges to resources normally protected from the user.

This issue allows remote attackers to escalate privileges on affected installations. Although authentication is required to exploit this, the existing authentication mechanism can be bypassed. The specific flaw exists within the `createUser` function, resulting from the lack of authorization prior to allowing access to functionality. An attacker can leverage this to escalate privileges to resources normally protected from the user.

This issue allows remote attackers to bypass authentication on affected installations of the NETGEAR ProSAFE Network Management System. The specific flaw exists within the MyHandlerInterceptor class, resulting from improper implementation of the authentication mechanism. An attacker can leverage this vulnerability to bypass authentication on the system, potentially impacting the confidentiality, integrity, and availability of protected information.

This issue allows remote attackers to execute arbitrary code on affected installations. Although authentication is required to exploit this issue, the existing authentication mechanism can be bypassed. The specific flaw exists within the `getNodesByTopologyMapSearch` function, resulting from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this issue to execute code in the context of SYSTEM.

This issue allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Although authentication is required to exploit this issue, the existing authentication mechanism can be bypassed. The specific flaw exists within the BkreProcessThread class, resulting from an exposed dangerous function, which can be leveraged to execute code in the context of SYSTEM.

The issue is related to the lack of proper validation of user-supplied data in the MFileUploadController class, allowing the upload of arbitrary files. This can enable a remote attacker to execute arbitrary code on affected installations, even though authentication is typically required. The existing authentication mechanism can be bypassed, and an attacker can leverage this issue to execute code in the context of SYSTEM.

The issue is related to the SettingConfigController class in the NETGEAR ProSAFE Network Management System, which lacks an authorization procedure. This allows a remote attacker to execute arbitrary code in the context of SYSTEM by leveraging an exposed dangerous function. Although authentication is typically required, the existing mechanism can be bypassed.

O problema é uma vulnerabilidade de execução remota de código autenticada. Foi classificada como de gravidade “Importante”. A vulnerabilidade pode ser acionada por um administrador autenticado. Já foram divulgadas vulnerabilidades anteriores de contorno de autenticação, que poderiam ser potencialmente utilizadas em conjunto com este problema.

Esta vulnerabilidade permite que invasores na mesma rede executem código arbitrário nas instalações afetadas. A falha está presente na configuração do servidor HTTP lighttpd, resultante da permissão para a execução de arquivos provenientes de fontes não confiáveis. Um invasor pode aproveitar isso para executar código no contexto do usuário root. Não é necessária autenticação para explorar esta vulnerabilidade.

O problema está relacionado ao tratamento de dados JSON e decorre da falta de validação adequada do comprimento dos dados fornecidos pelo usuário antes de copiá-los para um buffer baseado em pilha de comprimento fixo. Isso pode permitir que um invasor remoto execute código arbitrário no contexto do root. É necessária autenticação para explorar esta vulnerabilidade. A falha específica existe na funcionalidade de análise JSON `rex cgi`.

Esta vulnerabilidade permite que invasores remotos executem código arbitrário em instalações afetadas. É necessária a interação do usuário, na qual o alvo deve visitar uma página maliciosa ou abrir um arquivo malicioso. A falha existe na análise de arquivos APP devido à falta de validação adequada dos dados fornecidos pelo usuário, resultando na desserialização de dados não confiáveis. Um invasor pode aproveitar isso para executar código no contexto do processo atual.