Alessandro Tanasi

The issue concerns multiple directory traversal vulnerabilities in the return application language function. These vulnerabilities allow remote attackers to include and execute arbitrary local files. This can be achieved by providing a .. (dot dot) in specific parameters, such as the `lang crm` parameter to "phprint.php" or the `current language` parameter in an Accounts Import action to "graph.php".

The issue arises from Varnish writing data to a log file without sanitizing non-printable characters. This could potentially allow remote attackers to modify a window's title or possibly execute arbitrary commands or overwrite files via an HTTP request containing an escape sequence for a terminal emulator. The vendor disputes the significance of this report, stating that the real problem lies in the mistaken belief that one can safely use the `cat(1)` command on a random log file to their terminal.

The issue allows remote attackers to potentially modify a window's title or execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator, as the software writes data to a log file without sanitizing non-printable characters.

The issue allows remote attackers to potentially modify a window's title or execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator, as mini httpd writes data to a log file without sanitizing non-printable characters.

The issue allows remote attackers to potentially modify a window's title or execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator. This is due to thttpd writing data to a log file without sanitizing non-printable characters.

The issue allows remote attackers to potentially modify a window's title or execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator, as WEBrick writes data to a log file without sanitizing non-printable characters.

The issue allows remote attackers to potentially modify a window's title, execute arbitrary commands, or overwrite files via an HTTP request containing an escape sequence for a terminal emulator. This is because nginx writes data to a log file without sanitizing non-printable characters.

The issue allows remote attackers to potentially modify a window's title or execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator, as the software writes data to a log file without sanitizing non-printable characters.

The issue allows remote attackers to potentially modify a window's title or execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator, as Yaws writes data to a log file without sanitizing non-printable characters.

The issue allows remote attackers to potentially modify a window's title, execute arbitrary commands, or overwrite files via an HTTP request containing an escape sequence for a terminal emulator. This occurs because the software writes data to a log file without sanitizing non-printable characters.

The issue allows remote attackers to potentially modify a window's title, execute arbitrary commands, or overwrite files via an HTTP request containing an escape sequence for a terminal emulator. This is related to the handling of specific parameters and headers, including the `Age` parameter in the Cookie Dump Servlet, the `A` parameter in jsp/expr.jsp, and the `Content-Length` HTTP header.

The issue allows remote attackers to potentially modify a window's title or execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator, as the software writes data to a log file without sanitizing non-printable characters.