Gregor Kopf

A flaw was found in the Libreoffice package. An attacker can craft an odb containing a "database/script" file with a `SCRIPT` command where the contents of the file could be written to a new file whose location was determined by the attacker.

The issue allows for eval injection, which can be used for unauthenticated remote code execution.

The issue allows remote attackers to read the first line of an arbitrary file on the CCU2's filesystem through the User.getLanguage method. This can be exploited by unauthenticated attackers with access to the web interface.

The issue allows exploitation by sending arbitrary XML-RPC requests to control attached BidCos devices, due to an open XML-RPC port without authentication.

The issue allows authenticated attackers to perform Remote Code Execution in the addon installation process. This enables them to create or overwrite arbitrary files or install malicious software on the device.

The issue concerns the download of software update packages via the HTTP protocol, which lacks cryptographic protection. An attacker with a privileged network position can exploit this to provide malicious firmware updates, potentially resulting in a full system compromise.

The issue is related to a Remote Code Execution vulnerability in the TCL script interpreter. This allows remote attackers to obtain read/write access and execute system commands on the device. The vulnerability can be exploited by unauthenticated attackers with access to the web interface. It is associated with shortcomings in the security mechanisms of the TCL script interpreter, enabling remote attackers to read and write arbitrary files and execute system commands on the device using the web interface.

The issue is related to a method called `User.setLanguage` and is associated with security mechanism weaknesses. This allows remote attackers to write arbitrary files to the device's filesystem and potentially execute arbitrary code on the device using the web interface. The vulnerability can be exploited by unauthenticated attackers with access to the web interface.

The issue is related to a sandbox escape in the libxpc component, specifically with the launchctl process, due to insufficient access control. This could allow a local attacker to elevate their privileges.

The issue is related to the FortiManager protocol service in Fortinet FortiOS, which does not prevent the use of anonymous ciphersuites. This makes it easier for man-in-the-middle attackers to obtain sensitive information or interfere with communications by modifying the client-server data stream. The vulnerability can be exploited by a remote attacker to perform a man-in-the-middle attack, gain access to protected information, and redirect network traffic.

The issue concerns a double free vulnerability in the prepare exec function, which can be exploited remotely. This vulnerability may lead to a breach of confidentiality, integrity, and availability of protected information. It allows remote attackers to execute arbitrary commands via crafted strings in a log file.

The issue concerns the Data Security component's failure to check the basicConstraints parameter during the validation of X.509 certificate chains. This allows man-in-the-middle attackers to spoof an SSL server by using a non-CA certificate to sign a certificate for an arbitrary domain.

The issue allows remote authenticated administrators to read and possibly modify arbitrary files via a crafted parameter.

The issue is related to the jumpUrl implementation in tslib/class.tslib fe.php, which does not properly compare certain hash values during access-control decisions. This allows remote attackers to read arbitrary files via unspecified vectors. The vulnerability can be exploited remotely and may lead to a breach of confidentiality of protected information.

The issue concerns multiple vulnerabilities in the TYPO3 package that can lead to a breach of protected information. These vulnerabilities can be exploited remotely. A specific function, `t3lib div::validEmail`, does not properly restrict input, allowing remote attackers to cause a denial of service by consuming memory and crashing the application via a long email address string.

The issue allows remote authenticated users to gain privileges via a crafted POST request that creates a user account with arbitrary group memberships. Multiple vulnerabilities in the TYPO3 package may lead to a breach of protected information, and exploitation can be done remotely.

The issue allows remote attackers to inject arbitrary web script or HTML via vectors related to the RemoveXSS function, and allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the backend. This can lead to a breach of protected information. The exploitation of the vulnerabilities can be carried out remotely.