An authenticated XCC user can change permissions for any user through a crafted API command

A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a format string injection vulnerability in…

A valid, authenticated XCC user with read only access may gain elevated privileges through a specifically crafted API call

A valid XCC user's local account permissions overrides their active directory permissions under specific configurations

A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to execute system commands when performing a…

A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC CLI

A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC

A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an external LDAP server in…