Brian Mariani

Improper input validation in the domain creation functionality allows an attacker with high privileges to inject reserved Apache configuration directives. This action corrupts the `httpd.conf` file, which prevents Apache from starting after a server reboot, leading to a denial-of-service (DoS) condition for the web server and its hosted virtual hosts.

A path traversal issue exists in the View Logs functionality. This allows an unauthenticated attacker to access and exfiltrate files located outside the intended system logs directory, which may include sensitive system and application files. Path traversal is a flaw that allows an attacker to access files and directories that are stored outside the web root folder.

A post-authentication Stored Cross-Site Scripting (XSS) issue exists in the Appliance Management Console (AMC). This allows a remote authenticated attacker with administrator privileges to store and execute arbitrary JavaScript code within the console under specific conditions. Stored Cross-Site Scripting is a flaw where a malicious script is permanently stored on the target server, which is then served to other users.

A Zip Slip issue in the SMA1000 Appliance Management Console (AMC) interface enables an attacker to extract files outside the intended destination directory by using a specially crafted archive. This can lead to remote code execution, which is the ability of an attacker to execute arbitrary commands on a remote machine over a network.

A stored Cross-Site Scripting (XSS) issue allows an authenticated malicious user to inject persistent JavaScript or HTML content into the web application. The flaw is located in the web portal on TCP port 443, specifically within the `Description` field under Configuration → Domains. The application does not properly validate or sanitize user input before storing and rendering it. An attacker can use this to modify page content and behavior for other users, potentially altering the interface or creating phishing scenarios within the trusted context of the application.

A stored Cross-Site Scripting (XSS) flaw allows an authenticated malicious user to inject persistent JavaScript or HTML content into the web portal listening on TCP port 443. The issue occurs within the Configuration → Users → Users List section, specifically in the `Microsoft Exchange mailbox` field, due to a failure to properly validate or sanitize user-supplied input. When the affected user properties are accessed, the injected payload executes, which can prevent access to those properties and lead to a denial-of-service condition within the application's user-management functionality.

A flaw allows an attacker to force the system to load a malicious .so file (a shared object library) instead of the intended legitimate module. This occurs because the loading mechanism uses a predictable module name and fails to verify the file's origin or integrity. Consequently, a privileged process may load the malicious shared object, executing the code within that process's context and privileges, leading to arbitrary code execution and full compromise of the Mitel Linux virtual machine.

An authenticated remote attacker can delete sensitive files on the system via a directory traversal flaw. This issue occurs within the web portal on TCP port 443, specifically under the Maintenance → File Management → File Browser section. Directory traversal is a technique that allows an attacker to access files and directories that are stored outside the web root folder. By exploiting this, an attacker can access and delete files belonging to the application and the underlying Linux system, which may lead to a denial-of-service condition.

A flaw in the web portal listening on TCP port 443 allows remote attackers to execute arbitrary code, potentially requiring authentication. The issue resides in the Configuration → Services → Music on Hold functionality, where the application fails to properly validate uploaded file types. While intended for WAV audio files, an attacker can upload a malicious shared object (.so) file. When the system processes this file, the attacker-controlled code is executed within the process context, which may lead to a full compromise of the underlying Linux system.

A path traversal issue exists that allows an attacker to view or download sensitive system files. This is possible through the portal at the endpoint 'https://<ip>:8443' by navigating to the Administration -> View Logs menus. Path traversal is a flaw that allows an attacker to access files and directories stored outside the web root folder.

A flaw in the backup restoration functionality allows an attacker with access to the configured backup repository to introduce arbitrary files into the system during restoration. The issue occurs because the restoration mechanism fails to properly validate paths, file types, integrity, and authenticity of files within a restored TGZ archive (a compressed archive file). Since the application does not perform file-signature verification before extraction, a specially crafted backup can be used to place arbitrary files on the underlying Linux system. Depending on the file location and permissions, this can lead to arbitrary code execution with root privileges and a full compromise of the virtual machine. The lack of enforced backup passwords further increases the risk of unauthorized repository access.

A path traversal flaw exists in the Maintenance → System Logs functionality of the web management portal on TCP port 443. The application does not properly validate user-supplied file paths, enabling an attacker to manipulate the path and traverse the directory structure. This allows unauthorized access to and download of files outside the intended system logs directory, which may include sensitive system and application files.

An uncontrolled resource consumption issue exists in the diagnostic tasks feature. A low-privileged, authenticated user can trigger a denial of service of the system diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task via the web UI.

A flaw exists in the SonicWall Email Security appliance related to insufficient input validation. This could result in data corruption, potentially allowing a remote attacker with administrative privileges to exploit the issue by submitting specially crafted input that damages the application database.

A stored Cross-Site Scripting (XSS) issue exists in the SonicWall Email Security appliance. This is due to insufficient sanitization of user-provided data when creating web pages. A remote attacker with administrative privileges can potentially execute arbitrary JavaScript code. The attacker must be authenticated as an admin user to exploit this issue.

The SonicWall Email Security appliance contains a flaw related to improper input validation. A remote, authenticated attacker with admin privileges can exploit this to make the application unresponsive, resulting in a denial-of-service (DoS) condition.

A Path Traversal issue exists in the Email Security appliance. This allows an attacker to manipulate file system paths by injecting crafted directory-traversal sequences, such as `../`, potentially gaining access to files and directories outside the intended restricted path. The vulnerability involves manipulating file system paths.

The SonicWall Email Security appliance downloads root filesystem images without verifying signatures. This allows attackers with VMDK or datastore access to modify system files and potentially gain persistent arbitrary code execution.

The issue allows remote attackers to execute arbitrary code or cause a denial of service due to heap memory corruption. This can be achieved via a long `SidString` argument in certain methods.

Name of the Vulnerable Software and Affected Versions: Apple QuickTime versions prior to 7.3.1 Description: The issue is related to multiple unspecified vulnerabilities in the Flash media handler of Apple QuickTime. These vulnerabilities can be exploited by remote attackers via a crafted QuickTime movie, potentially allowing the execution of arbitrary code or having other unspecified impacts. Recommendations: For versions prior to 7.3.1, update to version 7.3.1 or later to resolve the issue.