Nicola Staller

The issue is related to improper neutralization of input via the devices API, allowing an attacker to inject malicious JavaScript code (XSS) and attack logged-in administrator sessions. This can lead to stored Cross-Site Scripting (XSS) in AudioCodes OVOC Devices API.

A path traversal issue allows sensitive data to be read without any authentication. This means that an attacker could potentially access confidential information by manipulating file paths.

The issue allows authenticated remote attackers to execute operating system commands by crafting serialized objects due to deserialization of untrusted data in multiple functions.

The issue is related to improper authorization in multiple functions, allowing an authenticated attacker to escalate privileges.

The issue allows an authenticated attacker to read arbitrary files from the filesystem by specifying the file path, due to the functionality of the `AdminGetFirstFileContentByFilePath` function.

The issue involves the use of a hard-coded cryptographic key, allowing local users to decrypt credentials via unspecified vectors.