Yu-Jen

The issue is related to the improper validation of a specific parameter in the administrator interface of IDExpert, allowing remote attackers with administrator privileges to read arbitrary system files.

The issue is related to improper validation of a parameter for a specific functionality in IDExpert, allowing unauthenticated remote attackers to inject JavaScript code and perform Reflected Cross-site scripting attacks.

Name of the Vulnerable Software and Affected Versions: MCUsystem (affected versions not specified) Description: The issue concerns the login page in the MCUsystem, which fails to filter special characters. This oversight allows remote attackers to inject JavaScript without privilege, thereby performing reflected XSS attacks. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.