Frycos

The issue is related to an XML External Entity (XXE) problem. An authenticated and remote attacker can send crafted HTTP requests to read arbitrary system files.

The issue is related to a .NET deserialization problem. A remote and authenticated attacker can execute arbitrary code by sending crafted serialized .NET data when joining a Multi-Server setup.

The issue is related to deficiencies in the authentication procedure of Microsoft Dynamics 365 Business Central. Exploitation of this issue may allow a remote attacker to elevate their privileges.

The issue is related to flaws in the deserialization mechanism of Microsoft Dynamics 365 Business Central, allowing a remote attacker to execute arbitrary code.

The issue is related to a lack of protection for service data in Skype for Business Server, which can be exploited to disclose protected information. This is a privilege escalation issue.

An issue was discovered in the webmail component's 2FASetup function, which is vulnerable to a stack-based Buffer Overflow. This occurs via an authenticated request with a long `primaryEMailAddress` field to the "webmail/api/jsonrpc" URI.

An issue allows an unauthenticated attacker to bypass the authentication check filter completely by introducing a specially crafted request with relative path segments.

The issue allows for Directory Traversal, which can lead to the disclosure of arbitrary content on the file system.

An issue allows an authenticated attacker to change the Office directory setting to point to an arbitrary remote network path, triggering the execution of the soffice binary under the attacker's control. This leads to arbitrary remote code execution (RCE).

A local privilege escalation issue exists, allowing a local attacker to escalate to NT Authority/SYSTEM by sending a crafted serialized payload to a .NET Remoting Service.