Gionathan Armando Reale

The issue allows a local attacker to obtain sensitive information via the plaintext storage of credentials. This is due to insufficiently protected credentials in the software.

The issue arises from a discrepancy in response headers when responding to different HTTP methods. Additionally, predictable responses occur when accessing and interacting with the `SITE PATH QUERY`. This allows for potential fingerprinting.

The issue arises from mishandled data saved from websites in the online vault, leading to a Cross Site Scripting (XSS) problem.

A full path disclosure issue was discovered, allowing a user to trigger an error and discover the full path of Matomo on the disk. This occurs because `lastError.file` is used in `plugins/CorePluginsAdmin/templates/safemode.twig`. The vendor disputes the significance of this issue.

The issue allows remote attackers to obtain potentially sensitive information. This is achieved via a request to the "ws/gatshipWs.asmx/SqlVersion" API endpoint.