Dave B

The issue allows remote attackers who acquire a certificate signed by a Certificate Authority to perform a man-in-the-middle attack due to the failure to verify the Common Name field of SSL certificates.

The issue allows remote attackers to insert arbitrary JavaScript due to insufficient checking in comments, potentially leading to Cross Site Scripting (XSS) attacks.

A cross-site scripting (XSS) issue exists in the web management interface, specifically in the httpd/cgi-bin/ipinfo.cgi file. This allows remote attackers to inject arbitrary web script or HTML via the `IP` parameter in a "Run" action.

A cross-site request forgery (CSRF) issue exists in the web management interface, specifically in the httpd/cgi-bin/shutdown.cgi endpoint. This allows remote attackers to hijack the authentication of administrators for requests that perform a reboot via a request to "cgi-bin/shutdown.cgi".

The issue allows remote attackers to inject arbitrary web script or HTML via a crafted table name, triggering improper HTML rendering on a Tracking page. This is related to the libraries/tbl links.inc.php and tbl tracking.php files.

The issue allows remote attackers to spoof certificates and bypass intended access restrictions via a man-in-the-middle (MITM) attack because libcloud does not verify SSL certificates for HTTPS connections. This is partly due to an upstream issue with python's SSL module.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the `ifnum` or `ifname` parameters in the graph.php file.