Paolo Cavaglià

VM images built with Kubernetes Image Builder Nutanix or OVA providers may use default credentials for Windows images if a user does not override them.

The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue only affects multi-site installations and installations where unfiltered html has been disabled.

The issue allows an unauthenticated attacker to achieve remote command execution on the affected PAM system. This is done by uploading a specially crafted PAM upgrade file.

The issue allows an attacker to bypass the authentication requirements for a specific PAM endpoint.

The issue allows a malicious low-privileged PAM user to perform server upgrade related actions. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

The issue allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by uploading a specially crafted PAM upgrade file.

A reflected cross-site scripting (XSS) issue exists in the PAM UI web interface, allowing a remote attacker to potentially execute arbitrary client-side code if a PAM user clicks on a specially crafted link. This could lead to the execution of code in the context of PAM UI.

The issue allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by sending a specially crafted HTTP request.

A specific authentication strategy in PAM allows a malicious attacker to learn the ids of all PAM users defined in its database.

The issue allows a malicious low-privileged PAM user to access information about other PAM users and their group memberships.

The issue allows an unauthenticated attacker to read arbitrary information from the database. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited.

An improper input validation in the PAM system allows an unauthenticated attacker to achieve remote command execution by sending a specially crafted HTTP request.

The issue is related to Reflected Cross-Site Scripting via the `target id` parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.