Nolan B. Kennedy

A stored XSS issue affects the software via multiple input fields, including `Login Message`, `Banner Message`, and `Password Instructions`, of the `com.threeis.webta.H261configMenu` servlet. This can be exploited by an authenticated administrator.

The issue concerns a Stored XSS vulnerability. It can be triggered by setting the Application Banner input field of the "/ApplicationBanner" page as an authenticated administrator.

The issue is related to an Insecure Direct Object Reference (IDOR) vulnerability in the Web Time and Expense (WebTE) interface. This vulnerability can be exploited by a remote attacker to gain unauthorized access to arbitrary reports by specifying arbitrary values for the `recId` and `filename` parameters. The attacker can download arbitrary files using the `/Home/GetAttachment` function.

The issue concerns Stored XSS that can be triggered via input fields of certain tooltips, and on specific pages such as Tags, Sequences, and Actors.