Steven Seeley

A critical vulnerability has been identified in Apache Struts, allowing attackers to manipulate file upload parameters and enable path traversal, potentially leading to remote code execution. This issue is related to the file upload component of Apache Struts, which contains a directory traversal vulnerability. The vulnerability can be exploited by manipulating the `uploadFileName` parameter, allowing attackers to upload malicious files to arbitrary locations on the server.

The issue is related to the ParameterVersionJavaSerializationCodec class in Inductive Automation Ignition, which is associated with weaknesses in the authentication procedure. This allows a remote attacker to execute arbitrary code in the context of SYSTEM due to the lack of proper validation of user-supplied data, resulting in the deserialization of untrusted data. No authentication is required to exploit this issue.

The issue is related to errors in data serialization within the JavaSerializationCodec class of Inductive Automation Ignition. This allows remote attackers to execute arbitrary code on affected installations without requiring authentication. The problem stems from the lack of proper validation of user-supplied data, leading to the deserialization of untrusted data. An attacker can leverage this to execute code in the context of SYSTEM.

A low privileged attacker could create a local ZIP file containing a malicious script in any location, which could be abused to load a DLL with SYSTEM privileges. The vulnerability is related to the use of dangerous methods or functions.

The issue is related to improper path validation, which could allow an attacker to upload a specially crafted malicious file or delete any file or directory with SYSTEM privileges. This could result in local privilege escalation or a denial-of-service condition. The vulnerability is associated with errors in processing relative paths to directories.

The affected products are vulnerable to an integer overflow or wraparound, which could allow an attacker to crash the server and remotely execute arbitrary code.

The issue is related to an improper validation of array index. This could allow an attacker to crash the server and remotely execute arbitrary code.

The issue is related to the ZipUtils class in the NETGEAR ProSAFE Network Management System, which is caused by improper restriction of a directory path with limited access. This allows a remote attacker to bypass security restrictions and execute arbitrary code. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The flaw exists due to the lack of proper validation of a user-supplied path prior to using it in file operations, allowing an attacker to execute code in the context of SYSTEM.

The issue is related to an unrestricted file upload vulnerability in the UpLoadServlet class, which can be exploited by remote attackers to execute arbitrary code on affected installations. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The flaw exists due to the lack of proper validation of user-supplied data, allowing the upload of arbitrary files. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.

This issue allows remote attackers to escalate privileges on affected installations. Although authentication is required to exploit this issue, the existing authentication mechanism can be bypassed. The specific flaw exists within the `clearAlertByIds` function, resulting from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this issue to escalate privileges to resources normally protected from the user.

This issue allows remote attackers to escalate privileges on affected installations. Although authentication is required to exploit this, the existing authentication mechanism can be bypassed. The specific flaw exists within the `createUser` function, resulting from the lack of authorization prior to allowing access to functionality. An attacker can leverage this to escalate privileges to resources normally protected from the user.

This issue allows remote attackers to bypass authentication on affected installations of the NETGEAR ProSAFE Network Management System. The specific flaw exists within the MyHandlerInterceptor class, resulting from improper implementation of the authentication mechanism. An attacker can leverage this vulnerability to bypass authentication on the system, potentially impacting the confidentiality, integrity, and availability of protected information.

This issue allows remote attackers to execute arbitrary code on affected installations. Although authentication is required to exploit this issue, the existing authentication mechanism can be bypassed. The specific flaw exists within the `getNodesByTopologyMapSearch` function, resulting from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this issue to execute code in the context of SYSTEM.

This issue allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Although authentication is required to exploit this issue, the existing authentication mechanism can be bypassed. The specific flaw exists within the BkreProcessThread class, resulting from an exposed dangerous function, which can be leveraged to execute code in the context of SYSTEM.

The issue is related to the lack of proper validation of user-supplied data in the MFileUploadController class, allowing the upload of arbitrary files. This can enable a remote attacker to execute arbitrary code on affected installations, even though authentication is typically required. The existing authentication mechanism can be bypassed, and an attacker can leverage this issue to execute code in the context of SYSTEM.

The issue is related to the SettingConfigController class in the NETGEAR ProSAFE Network Management System, which lacks an authorization procedure. This allows a remote attacker to execute arbitrary code in the context of SYSTEM by leveraging an exposed dangerous function. Although authentication is typically required, the existing mechanism can be bypassed.

The issue is an authenticated remote code execution vulnerability. It has been evaluated to be in the Important severity range. The vulnerability can be triggered by an authenticated administrator. Past authentication bypass vulnerabilities have been published, which could potentially be used in conjunction with this issue.

This issue allows network-adjacent attackers to execute arbitrary code on affected installations. The flaw exists within the configuration of the lighttpd HTTP server, resulting from allowing execution of files from untrusted sources. An attacker can leverage this to execute code in the context of root. Authentication is not required to exploit this issue.

The issue is related to the handling of JSON data and results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. This can allow a remote attacker to execute arbitrary code in the context of root. Authentication is required to exploit this vulnerability. The specific flaw exists within the `rex cgi` JSON parsing functionality.

This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within the parsing of APP files due to the lack of proper validation of user-supplied data, resulting in deserialization of untrusted data. An attacker can leverage this to execute code in the context of the current process.