Wen Bin Kong

An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication (XPC) while masquerading as an Apple-signed process.

Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistent root access that remained effective after the ABR session ended.

The issue allows for stored XSS attacks via the Login Page Disclaimer, enabling low-privileged users to target higher-privileged users.

The issue concerns a stored XSS vulnerability in the file upload feature. An unauthenticated malicious user with network access could store an arbitrary web script that would be executed by other users.

The issue concerns the lack of cross-site request forgery protection. A remote unauthenticated user could craft a malicious site that executes requests to Spring Batch Admin. This has not been patched because Spring Batch Admin has reached end of life.