Maciej Kazulak

Calling system commands via RunCommand

Conditional RCE via the "system" function

Unauthenticated access to module configuration endpoint

RCE on uhcapache user permissions

Session generation possible with certificate number only

Missing authentication in APIs returning statistical data along with session IDs

Missing authentication in API returning request logs containing session IDs

Missing authentication in API returning a list of all active sessions

Session ID leakage in Zone.Identifier of downloaded files

Missing authentication in APIs allowing data retrieval and modification