Nikola Kojic

A remote attack can trigger an out-of-bounds read within the `rtpproxy` component. This issue occurs specifically in the `rtpproxy offer()` and `rtpproxy answer()` functions.

An issue exists where authenticated attackers with administrator-level access and above can perform Directory Traversal, a technique used to access files and directories that are stored outside the web root folder. By manipulating the `backup file` parameter, an attacker can read arbitrary files on the server that may contain sensitive information. The `basename()` normalization in the handler fails to protect existing files because it only executes when the target path does not exist.

The User Login History plugin for WordPress contains a SQL Injection flaw, which occurs when an application fails to properly sanitize or escape input used in a database query, allowing an attacker to interfere with the queries. This issue is caused by insufficient escaping of the user-supplied `blog id` parameter and a lack of proper preparation of the SQL query. Authenticated attackers with Administrator-level access or higher can append additional SQL queries to extract sensitive information from the database. This issue is only exploitable on multisite installations.

A mitigation bypass exists within the PDF Viewer component.

A malicious unauthorized PAM user can access the administration configuration data and change the values.

The issue concerns unauthenticated reflected cross-site scripting (XSS) that allows a remote attacker to introduce arbitrary JavaScript. This is achieved through the manipulation of an unsanitized GET parameter during a password change, specifically in the forgotPasswordChange.jsp page with a key parameter.