Andrea Carlo Maria Dattola

An issue exists in the Console component of the WebLogic Server. A low privileged attacker with network access via HTTPS can compromise the server, provided there is human interaction from a person other than the attacker. This can lead to unauthorized access, creation, deletion, or modification of critical data or all data accessible by the WebLogic Server. The impact may extend beyond the WebLogic Server to affect additional products.

The Host HTTP parameter could cause the web application to redirect to the specified URL when the requested endpoint is "/management/domain". By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.

An issue in the web application allows Stored Cross-site Scripting (XSS) to occur under the "/api/v1/getbodyfile" endpoint via the `uri` parameter. The application does not properly check parameters sent in HTTP requests before saving them on the server. Crafted JavaScript content can then be reflected back to the end user and executed by the web browser.

An issue in SELESTA Visual Access Manager allows attackers to modify the `computer` POST parameter related to the ID of a specific reception by POST HTTP request interception. This can lead to unauthorized access to the application and control of many other receptions beyond the assigned one. The issue can be exploited via local network only.

A basic XSS issue exists under the "/api/v1/vdeskintegration/todo/createorupdate" endpoint via the `title` parameter and "/dashboard/reminders". A remote user, authenticated to the product, can store arbitrary HTML code in the reminder section title to corrupt the web page, potentially creating phishing sections to exfiltrate victims' credentials.

An issue was discovered allowing a URL Redirection to an Untrusted Site (Open Redirect) under the "/api/v1/notification/createnotification" endpoint. This enables an authenticated user to send an arbitrary push notification to any other user of the system, which can include an invisible clickable link.

An issue was discovered in the Administration of Measurements website section, where a malicious user can edit or add the `templateName` parameter to include malicious code. This code is then downloaded as a .csv or .xlsx file and executed on a victim machine. The issue involves the "/aom/html/EditTemplate.jsf" and "/aom/html/ViewAllTemplatesPage.jsf" API endpoints, where the `templateName` parameter is used.

A remote user, authenticated to the website, can visit the Site Configuration Tool section and arbitrarily upload potentially dangerous files without restrictions via the "/netact/sct" dir parameter in conjunction with the `operation`=`upload` value.

An issue was discovered in the Site Configuration Tool website section, where a malicious user can change the filename of an uploaded file to include JavaScript code. This code is then stored and executed by a victim's web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims. The API endpoint "/netact/sct" with the `filename` parameter is used for this purpose.

An issue was discovered in the Administration of Measurements website section, where a malicious user can edit or add the `templateName` parameter to include JavaScript code. This code is then stored and executed by a victim's web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims. The "/aom/html/EditTemplate.jsf" and "/aom/html/ViewAllTemplatesPage.jsf" `templateName` parameter is used.

The issue concerns a vulnerability in the REST endpoint "editprofile" where Open Redirect HTTP Header Injection can occur, potentially leading to the redirection of submitted requests to domains outside the control of the ENM deployment. An attacker would need admin or elevated access to exploit this issue.

An issue allows an Insecure Direct Object Reference to occur under the "5.6.5-3/doc/{ID-FILE}/c/{N}/{C}/websocket" endpoint. A malicious unauthenticated user can access cached files in the OnlyOffice backend of other users by guessing the `ID-FILE` of a target file.

An issue exists in the software due to Broken Access Control. This issue affects several API endpoints: "/api/v1/vdeskintegration/saml/user/createorupdate", "/settings/guest-settings", "/settings/samlusers-settings", and "/settings/users-settings". A malicious user who is already logged in as a SAML User can escalate privileges from a low-privilege user (FGM user) to an administrative user (GGU user), including the administrator, or create new users without needing an admin role.

An issue was discovered in the web application, allowing Broken Access Control to occur under the "/api/v1/registration/validateEmail" endpoint, the "/api/v1/vdeskintegration/user/adduser" endpoint, and the "/api/v1/registration/changePasswordUser" endpoint. The application is affected by flaws in authorization logic, enabling a malicious user with no privileges to perform privilege escalation to the administrator role and steal the accounts of any users on the system.

The issue is related to the command-line interface (CLI) of the Ericsson Evolved Packet Gateway (EPG) and is associated with access control deficiencies. Exploitation of the issue may allow a remote attacker to execute arbitrary commands. Authenticated users can bypass the system CLI and execute commands they are authorized to execute directly in the UNIX shell.

A security issue was found in the software, related to improper access control. It does not correctly validate requests to access or edit data and functionality in certain API endpoints, such as "/#settings/*" and "/api/settings/*". This allows a potential attacker to view sensitive data and modify system configurations, which could lead to denial of service (DoS), without being checked for user identity or permissions.

A malicious user can modify the filename of an uploaded file to include JavaScript code. This code is then stored and executed by a victim's web browser. The issue can be exploited by including malicious content as a parameter in a URL, which is then posted publicly or e-mailed to victims. Specifically, the `/netact/sct` API endpoint is used, with the `filename` parameter being vulnerable.

A remote user, authenticated to the Nokia NetAct Web Page, can upload potentially dangerous files without restrictions. This is achieved by visiting the Site Configuration Tool web site section and using the `/netact/sct` API endpoint with the `dir` parameter in conjunction with the `operation=upload` value.