Gregory Draperi

The software may be susceptible to a COM Hijacking issue. This type of issue allows an attacker to attempt to establish persistence and evade detection by hijacking COM references in the Windows Registry.

A path traversal vulnerability exists due to improper input validation in the log filtering functionality exposed via the management web interface. An authenticated attacker can exploit this flaw by submitting crafted filter expressions to the `log filter` endpoint using the `filterStr` parameter. This input is processed by a backend parser that permits execution of file expansion syntax, allowing the attacker to retrieve arbitrary system files via the log viewing interface.

Name of the Vulnerable Software and Affected Versions: Smart Touch Call versions prior to 1.0.0.5 Description: The issue is related to improper access control, allowing arbitrary webpage loading in the webview component. Recommendations: For versions prior to 1.0.0.5, update to version 1.0.0.5 or later to resolve the issue.

The issue is related to the floppy driver in the Linux kernel, specifically the `show floppy` function in `drivers/block/floppy.c`. This function uses `printk` calls to reveal the addresses of kernel functions and global variables. An attacker can read this information from `dmesg` and use the addresses to find the locations of kernel code and data, potentially bypassing kernel security protections. The exploitation of this issue may allow an attacker to bypass kernel security and gain unauthorized access to protected information.

The issue allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language (VTL) in the weblog page template.

The issue allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted request.