Adam Caudill

The issue allows man-in-the-middle attackers to execute arbitrary code by modifying fields in the client-server data stream, as the software relies on unverified HTTP data for updates.

The issue is related to the PasswordReset.Controllers.ResetController.ChangePasswordIndex method in PasswordReset.dll, which has inadequate access control. This allows remote attackers to reset arbitrary passwords via a crafted request with a valid `username`.

The issue is related to weaknesses in the authentication procedure of the ScreenOS operating system. This allows a remote attacker to gain administrative access by entering a specially crafted password during an SSH or TELNET session.

The issue allows remote attackers to obtain access more easily due to a hardcoded password 'donotedit' for the `VDAD` and `VDCL` users.

The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in the `extension` parameter in an OriginateVDRelogin action to "manager send.php" API endpoint.

A cross-site scripting (XSS) issue exists due to improper handling of the `openid error` parameter in error messages when `openid.mode` is set to error. This allows remote attackers to inject arbitrary web script or HTML.

The issue concerns SQL injection vulnerabilities in the agent interface of VICIDIAL dialer. These vulnerabilities allow remote attackers to execute arbitrary SQL commands via the `campaign` variable in "SCRIPT multirecording AJAX.php", or remote authenticated users to execute arbitrary SQL commands via the `server ip` parameter to "manager send.php". There are also other unspecified vectors.

The issue allows remote attackers to execute arbitrary SQL commands via the `value` parameter in a `username` action. This is related to a SQL injection vulnerability in the `signup check.php` file.