Vipin Chaudhary

Audit device validation logic fails to consistently apply plugin directory protections when the legacy file audit path option is utilized.

The PKI engine ACME validation fails to reject local targets during the issuance of 'http-01' and 'tls-alpn-01' challenges. This flaw may result in requests being directed to targets within the local network, which could lead to information disclosure.

The issue is related to improper authorization on specific APIs in the API implementation of Cisco ACI Multi-Site Orchestrator (MSO). This allows an authenticated, remote attacker to elevate privileges on an affected device by sending crafted HTTP requests. A successful exploit could allow an attacker who is authenticated with non-Administrator privileges to elevate to Administrator privileges on an affected device.

A directory traversal issue has been discovered, potentially allowing an unauthenticated attacker to access files outside the restricted directory on the remote server.

A Stored Cross-Site Scripting issue could potentially be exploited by malicious users to compromise the affected system via a filename of an uploaded image file.

A Reflected Cross-Site Scripting issue could potentially be exploited by malicious users to compromise the affected system. The issue is related to the servlet/Download, ` docbase` or ` username` parameter.

The issue concerns a CSRF vulnerability in the add vhost.php file.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `virtual del` parameter. This can lead to the execution of malicious scripts on the client-side.