Juan Vazquez

The issue allows a remote attacker to bypass authentication in the web interface of the affected systems, enabling them to retrieve the device configuration.

An issue was discovered in "soap.cgi?service=WANIPConn1" where Command Injection via shell metacharacters is possible in the `NewInternalClient`, `NewExternalPort`, or `NewInternalPort` element of a SOAP POST request.

Name of the Vulnerable Software and Affected Versions: Ektron Content Management System (CMS) versions prior to 8.02 SP5 Description: The issue allows remote attackers to execute arbitrary code with NETWORK SERVICE privileges via crafted XSL data, due to the use of the XslCompiledTransform class with enablescript set to true. Recommendations: For versions prior to 8.02 SP5, update to version 8.02 SP5 or later to resolve the issue. As a temporary workaround, consider disabling the use of the XslCompiledTransform class with enablescript set to true until a patch is available. Restrict access to XSL data to minimize the risk of exploitation.

The issue is caused by a stack-based buffer overflow in the agent. This allows a remote attacker to execute arbitrary code by sending a large amount of data, potentially in environments lacking relationship-based firewalling. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited.

The issue allows remote attackers to execute arbitrary code via unspecified vectors due to an integer underflow. This can potentially lead to the execution of arbitrary code, posing a significant risk.

The issue allows remote attackers to execute arbitrary OGNL expressions via certain parameters, such as the pageTitle parameter in the !getPageTitle sub-URL to roller-ui/login.rol. This is possible due to certain getText methods in the ActionSupport controller.

The issue allows remote authenticated users to upload and execute arbitrary programs, read arbitrary files, or cause a denial of service via multiple directory traversal vulnerabilities in the EditDocument servlet. This can be achieved through various parameters in different operations, including the `uploadPath` parameter in an UPLOAD operation, the `paths[]` parameter in DELETE, CUT, or COPY operations, or the `newPath` parameter in CUT or COPY operations.

The issue is related to a use-after-free vulnerability in the CDwnBindInfo function of the mshtml.dll library in Internet Explorer. This vulnerability allows a remote attacker to execute arbitrary JavaScript code by sending a specially crafted HTML file. The vulnerability may corrupt memory, enabling an attacker to execute arbitrary code in the context of the current user. It has been exploited in the wild, with reported incidents of remote code execution, including a watering hole attack on the Council on Foreign Relations website in 2012.

A directory traversal issue exists, allowing remote attackers to upload and execute files. This is achieved by sending a request with a `..` (dot dot) in a `FILE` element of an `FSFUI` record, specifically via a "130 /FSF/CMD" request.

The issue allows remote attackers to read arbitrary files via a "/FSF/CMD" request with a .. (dot dot) in a `FILE` element of an FSFUI record. This is a directory traversal vulnerability in NFRAgent.exe.

The issue allows remote attackers to read arbitrary files due to an absolute path traversal vulnerability in NFRAgent.exe. This can be exploited via a /FSF/CMD request with a full pathname in a PATH element of an SRS record.

A heap-based buffer overflow issue exists, allowing remote attackers to execute arbitrary code by sending a large number of VOL elements in an SRS record.

The issue concerns the rtrlet web application in the Web Console, where a hard-coded username and password are used for certain operations. Specifically, the `GetFile Password` and `GetConfigInfo Password` operations utilize the hard-coded credentials, allowing remote attackers to obtain sensitive information. This can be achieved by crafting a request for the `HandleMaintenanceCalls` function.