Ryan Wincey

An OS command injection issue exists in the `recbackup` component. An authenticated administrator can provide specially crafted backup-area configuration input that is passed to a shell command, enabling the execution of arbitrary commands with the privileges of the `nvr` user.

The firmware contains a hardcoded, undocumented recovery account with shared credentials that cannot be modified, disabled, or rotated. An unauthenticated remote attacker can utilize this account to authenticate to the password-reset workflow. This account does not grant standard administrator access, and further vulnerabilities would be necessary to achieve a full administrator takeover.

The administrator password-reset unlock-code design lacks a per-device secret or server-side cryptographic material. An attacker with physical-console access and access to the privileged password-reset workflow can forge a valid unlock code offline to reset the administrator password.

The software trusts an `X-Forwarded-For` header provided by a client to determine the request source address. This allows an unauthenticated remote attacker to spoof a loopback address and bypass security controls that restrict access to local connections on non-TLS web interfaces, leading to the disclosure of configuration information.

An unauthenticated remote code execution issue exists in the survey passthrough routing and Data Import processing logic. A malicious actor can manipulate HTTP requests to access an unintended controller route from a public survey context and provide a crafted `file-path/stream` parameter during import handling. This allows the execution of arbitrary code on the server. While authentication is not required, the attacker must possess a valid public survey hash. Real-world incidents have been observed where attackers used this flaw to deploy a Blade webshell and install XMRig, a cryptocurrency miner, which was disguised as a JPG file and renamed to `syslog` to evade detection.

A stack-based buffer overflow exists in the `/usr/sbin/auth user pass` function. An unauthenticated remote attacker with access to the management interface can send a crafted authentication request that triggers an unchecked copy into a fixed-size stack buffer, potentially leading to arbitrary code execution with root privileges. The management interface is disabled by default and requires manual activation by the user to be accessible.

An OS command injection issue exists in the xtremed daemon. An unauthenticated remote attacker with access to the management interface can send crafted input to the 'AuthFormServlet' endpoint, which causes authentication data to be processed by a shell, allowing the execution of arbitrary commands with root privileges.

The issue concerns a privilege escalation vulnerability through DLL hijacking. The vulnerability is fixed in version 5.0.2.

The issue is related to the auto-update service of Okta Verify for Windows, which is vulnerable to two flaws that can be combined to execute arbitrary code. This could allow a remote attacker to perform malicious actions. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

The issue allows local privilege escalation via vectors involving `pconfig` and the `+RESTART -host` options.

A SQL injection issue exists in the “reporter events type” feature of the ScienceLogic SL1. This feature takes unsanitized user-controlled input and passes it directly to a SQL query, allowing for the injection of arbitrary SQL before being executed against the database.

A SQL injection issue exists in the `vendor state` parameter of the "vendor print report" feature, allowing arbitrary SQL injection before execution against the database. This occurs because the feature takes unsanitized user-controlled input and passes it directly to a SQL query.

A SQL injection issue exists in the “admin brand portal” feature of the ScienceLogic SL1. This feature takes unsanitized user-controlled input and passes it directly to a SQL query, allowing for the injection of arbitrary SQL before being executed against the database.

A SQL injection issue exists in the `vendor country` parameter of the "vendor print report" feature. This feature takes unsanitized user-controlled input and passes it directly to a SQL query, allowing for the injection of arbitrary SQL before being executed against the database.

A SQL injection issue exists in the "admin dynamic app mib errors" feature, where unsanitized user-controlled input is passed directly to a SQL query, allowing the injection of arbitrary SQL that is then executed against the database.

A SQL injection issue exists in the “topology data service” feature, where unsanitized user-controlled input is passed directly to a SQL query, allowing the injection of arbitrary SQL before execution against the database.

A SQL injection issue exists in the “notes view” feature of the ScienceLogic SL1. This feature takes unsanitized user-controlled input and passes it directly to a SQL query, allowing for the injection of arbitrary SQL before being executed against the database.

A command injection issue exists in the download and convert report feature, where unsanitized user-controlled input is passed directly to a shell command, allowing the injection of arbitrary commands to the underlying operating system.

A SQL injection issue exists in the "json walker" feature, where unsanitized user-controlled input is passed directly to a SQL query, allowing the injection of arbitrary SQL that is then executed against the database.

A SQL injection issue exists in the "ticket template watchers" feature, where unsanitized user-controlled input is passed directly to a SQL query, allowing the injection of arbitrary SQL before execution against the database.