Yokoacc

The regular expression used for validating host and event action script input allows bypass of the validation check when multiline mode is enabled. Specifically, the use of anchors (`^` and `$`) in administrator-defined input validation can be circumvented by injecting a newline character. This allows authenticated users to inject and execute shell commands.

The issue was addressed with improved UI. Visiting a malicious website may lead to address bar spoofing.

The issue allows an attacker to execute code via the `DYLIB INSERT LIBRARIES` environment variable. This is a code injection problem in Remote Desktop Manager on macOS.

An inconsistent user interface issue was addressed with improved state management. Visiting a malicious website may lead to address bar spoofing.

The issue involves the WebKit component and allows remote attackers to spoof the address bar via a crafted web site. This can be achieved by manipulating a website to deceive users about the actual URL being visited.

The issue allows for CSRF, potentially resulting in obtaining admin privileges. The affected endpoint is "public/rolechangeadmin".

The issue allows for remote execution of arbitrary PHP code through a CSRF vulnerability. It is specifically found in the "admin/home#/logos/" endpoint.

The issue allows for obtaining admin privileges through CSRF in the "admin/home#/person/" endpoint.

A CSRF issue exists, allowing the Navigation Social to be changed by manipulating the `value[#][*]` parameter in the "admin/settings/update/" page.

The issue concerns a CSRF problem. It affects the "admin/settings/update/" page, specifically with the `value` parameter. This allows an attacker to change the Colophon.

The issue concerns a CSRF problem. It affects the "admin/settings/update/" page, specifically with the `nav-social` parameter. This allows an attacker to change the Navigation Social settings.

The issue concerns a CSRF problem. It affects the "admin/settings/update/" page, specifically with the `colophon` parameter. This allows the Colophon to be changed.

The issue concerns a CSRF problem. It affects the "admin/ajax/users/delete/" page, specifically with the `id` parameter. This allows an unauthorized user deletion.

The issue is related to an untrusted search path vulnerability in the installer. This vulnerability can be exploited by a local user to gain privileges via a Trojan horse DLL in the current working directory.