Johannes Greil

Kiuwan SAST improperly authorizes SSO logins for mapped user accounts that have been locally disabled. This allows users whose accounts are disabled in the user admin settings to maintain access to the application.

The issue arises when the Kiuwan Local Analyzer uploads scan results to the Kiuwan SAST web application, which processes XML files containing external entities. This leads to an XML external entity injection attack. An attacker with privileges to scan source code can extract files from the operating system with the application server user's rights, potentially gaining access to sensitive files like configuration and passwords. The attacker can also initiate connections to internal systems for port scans or access other internal functions and applications.

The issue concerns an API endpoint "/saas/rest/v1/info/application" that allows access to information about any application, using the `application` parameter. This endpoint lacks proper access control, enabling other authenticated users to read application information without the necessary rights.

The Kiuwan Local Analyzer (KLA) Java scanning application contains several hard-coded secrets in plain text format, potentially compromising the confidentiality of scan results. Credentials were found in the JAR files, including `insight.github.user` and `insight.github.password` in the "InsightServicesConfig.properties" file, and an encryption key in the "es/als/security/Encryptor.properties" file. At least one specified username corresponds to a valid GitHub account.

The issue allows for an unauthenticated reflected cross-site scripting attack on the login page "login.html" when SSO (single sign-on) is enabled. This is due to the `message` request parameter values being directly included in a JavaScript block in the response. This is particularly critical in business environments using AD SSO authentication, where attackers could potentially steal AD passwords.

A privilege escalation issue affects the devices, allowing attackers to access the command line interface (CLI) if it was previously disabled by the ISP, escalate privileges, and conduct further attacks.

The issue allows attackers to gain root access on the device and extract sensitive configuration data, such as VoIP credentials, or attack the internal network of the ISP.

The issue allows attackers to bypass authorization and access settings within the web interface that are normally restricted to end users, such as those controlled by the ISP. This could enable an attacker to modify settings, for example, by enabling the TELNET server.

The issue is related to the `setUpSubtleUserAccount` function in `/bin/bw`, which has a hardcoded password for the `1MB@tMaN` account. This makes it easier for remote attackers to obtain access via SSH or HTTP sessions.

The issue is related to the `setUpSubtleUserAccount` function in `/bin/bw`, which has a hardcoded password for the BlackWidow account. This makes it easier for remote attackers to obtain access via SSH or HTTP sessions.

The issue allows remote attackers to modify the account settings of arbitrary users. This is achieved via the `customer.customerId` parameter to the "shop/profile/register.action" endpoint.

The issue allows remote authenticated users to execute arbitrary commands. This is possible through vectors involving file editing in the System File Overview feature of the NeDi component.

The issue concerns the Foundation webapp admin interface in GroundWork Monitor Enterprise, where it uses the nagios account as the owner of writable files under /usr/local/groundwork. This setup allows attackers to bypass intended filesystem restrictions by leveraging access to a GroundWork script.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The vulnerabilities are related to vectors involving the foundation-webapp/admin/ directory, the NeDi component, or the Noma component.

The issue allows remote authenticated users to execute arbitrary commands and obtain sensitive information by leveraging a JOSSO SSO cookie. This is related to the monarch scan.cgi in the MONARCH component.

The issue is related to an XML External Entity (XXE) problem, allowing remote authenticated users to read arbitrary files. This is possible through the Profile Importer feature in monarch.cgi in the MONARCH component, when an XML document containing an external entity declaration is used in conjunction with an entity reference.

The issue allows remote authenticated users to bypass intended access restrictions. This can be achieved via a direct request for a log file or a configuration file.

The issue allows remote authenticated users to obtain sensitive information via a direct request for certain files or contexts, including (1) a configuration file, (2) a database dump, or (3) the Tomcat status context.

The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in the scan functionality in the System / NeDi menu, specifically in the html/System-NeDi.php file of the NeDi component.

The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks.