Dr. Adrian Vollmer

A critical issue affects the Cookie Handler component, where manipulation of the `UWA SID` argument leads to sql injection. This can be initiated remotely. The issue has been publicly disclosed and may be exploited.

A critical issue affects some unknown processing in the software. The manipulation of the `path` argument with a specific input leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed publicly.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `querytext` parameter to the "userdashboard.jsp" endpoint.