Federico Draghelli

The issue is related to the XML Database component, allowing a low-privileged attacker with network access via HTTP to compromise the XML Database. Successful attacks require human interaction and can result in unauthorized update, insert, or delete access to some XML Database accessible data, as well as unauthorized read access to a subset of XML Database accessible data.

The issue is related to the storage of passwords in plain text. This could allow an attacker to disclose protected information. A local user can read the user credentials stored in plain text.

An issue was discovered in the web application where the access token of an authenticated user is inserted inside GET requests. The query string for the URL could be saved in the browser's history, passed through Referers to other web sites, stored in web logs, or otherwise recorded in other sources. If the query string contains sensitive information such as session identifiers, then attackers can use this information to launch further attacks. Because the access token is sent in GET requests, this could lead to complete account takeover.

The issue is related to improper input validation in the Web application, allowing authenticated users to execute commands on the Operating System.

An issue was discovered where the server does not properly handle application errors, leading to a disclosure of information about the server. An unauthenticated user can craft specific requests to make the application generate an error, revealing information such as the absolute path of the source code of the application. This information can help an attacker perform other attacks against the system. The issue can be exploited without authentication.

An issue was discovered where the web application inserts cleartext passwords in the HTML source code. An authenticated user can edit the configuration of the email server. When accessing the edit function, the web application fills the edit form with the current credentials for the email account, including the cleartext password.

An issue was discovered in the product where it does not neutralize or incorrectly neutralizes output that is written to logs. The web application writes logs using a GET query string parameter, which can be modified by an attacker to attribute every action they perform to a different user. This can be exploited without authentication.

A stored cross-site scripting (XSS) issue allows authenticated and unauthenticated remote attackers to inject arbitrary web script or HTML into a GET parameter. This reflects/stores the user input without sanitization.

An issue was discovered where the web server fails to sanitize input data, allowing remote unauthenticated attackers to read arbitrary files on the filesystem.

An issue was discovered in the web application where it does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

The issue is related to a stack-based out-of-bounds write vulnerability that can be exploited by an authenticated remote attacker to write data into the stack. This can lead to a denial-of-service condition, memory overwriting, or remote code execution. The vulnerability is associated with a buffer overflow in memory, which can be exploited to cause a denial-of-service condition or execute arbitrary code.