Travis Lee

The issue concerns the /setup URI, which allows remote attackers to bypass intended page-access restrictions or modify passwords by leveraging knowledge of a `handle` parameter value.

The issue allows remote attackers to obtain root access by leveraging knowledge of hardcoded account credentials and establishing a TELNET session.

The issue allows context-dependent attacks to obtain sensitive information by reading cleartext strings. The devices store passwords in a cleartext base64 format and require cleartext credentials in HTTP Cookie headers.

The issue allows remote attackers to execute arbitrary code by uploading a file via an unspecified page, due to multiple unrestricted file upload vulnerabilities.

The issue allows remote attackers to execute arbitrary commands, related to a command injection problem.

The issue allows remote attackers to obtain sensitive information via requests to unspecified pages because database credentials are stored in cleartext.

The issue makes it easier for context-dependent attackers to obtain sensitive information. This is due to the use of an XOR format for password encryption, allowing attackers to read a key file and the encrypted strings.

The issue allows remote attackers to inject arbitrary web script or HTML via an arbitrary text field, which can lead to cross-site scripting (XSS) attacks.

The issue allows remote attackers to hijack the authentication of arbitrary users for requests that modify passwords, accounts, or permissions due to multiple cross-site request forgery (CSRF) vulnerabilities.

The issue allows remote attackers to perform arbitrary actions via crafted packets to the TCP port 41014, also known as the download port.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the GuestAccess.jsp file within the Guest/Contractor access component of the administrative interface. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via unspecified fields.

The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities in the administrative interface. These vulnerabilities allow remote attackers to hijack the authentication of administrators for requests, including inserting XSS sequences or sending messages to clients.

The issue allows remote attackers to trigger the display of arbitrary text on a workstation via a crafted packet to "UDP port 4567", as demonstrated by a replay attack, due to the lack of authentication requirement for messages.

A cross-site request forgery issue exists, allowing remote attackers to hijack administrator authentication for password change requests. The issue is related to the password-manager/changePasswords.do endpoint.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the status program. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters. The vulnerable parameters are the `loginname` parameter in a forgotpass action and the `username` parameter.

The issue allows context-dependent attackers to determine cleartext passwords more easily via a rainbow-table approach because it does not use a salt during the calculation of a password hash.

The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities in the administrative interface. These vulnerabilities allow remote attackers to hijack the authentication of administrators for requests that perform administrative actions.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via web traffic examined within the Bloxx Reports component. Additionally, remote authenticated administrators can inject arbitrary web script or HTML via vectors involving administrative menu functions.

The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of arbitrary users for specific requests, including changing a PIN, deleting messages, adding a delivery address, or changing a delivery address.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML, potentially via a delivery address and possibly a PIN.