Stefan Walter

Improper access control in the Windows SMB Client, specifically within the `mrxsmb.sys` driver, allows an authorized or unauthenticated remote attacker to elevate privileges to the `NT AUTHORITYSYSTEM` level. The issue stems from flaws in access restriction during authentication relay. Attackers can use authentication coercion techniques, such as forcing a request to a UNC path, to compel a Windows host to connect to a malicious system via SMB. By manipulating `CREDENTIAL TARGET INFORMATIONW` and forcing the use of Kerberos over NTLM, an attacker can capture a Kerberos ticket from a computer account (`DOMAINMACHINE$`) and relay it back to the same host. This process results in a session with full system control over the target machine via standard RPC/SMB services.

An issue was discovered due to path traversal in `private/SchemaSetUpload.do` for uploaded ZIP files. This allows an executable script to be uploaded by web application administrators, giving the attacker remote code execution on the underlying server via an `imgs/*.jsp` URI.

The navigation tree in the web application is susceptible to XSS, allowing the injection of JavaScript into its nodes. This issue can be exploited by users with the role of Configuration Administrator or Administrator, who have the capability to create such nodes.

An issue was discovered in several functions, which are vulnerable to reflected XSS. This is demonstrated by various API endpoints, such as "private/index.jsp?partners/ShowNonLocalPartners.do?localID=", "private/index.jsp", "private/index.jsp?database/databaseTab.jsp", "private/index.jsp?activation/activationMainTab.jsp", "private/index.jsp?communication/serverTab.jsp", and "private/index.jsp?emailNotification/notificationTab.jsp".

The issue is related to an insufficient password reset mechanism in the Team Password Manager application. Exploitation of this issue may allow a remote attacker to gain unauthorized access to protected information by resetting passwords.

The issue is related to the Udisks program for querying and managing storage devices, specifically for ext2/3/4 file systems. It is caused by the default configuration to stop the machine in case of an error. An attacker can exploit this to cause a denial of service using a specially crafted image. This flaw allows an attacker to input a specially crafted image file or USB, leading to a kernel panic. The highest threat from this issue is to system availability.