Allegra vulnerabilities

Allegra contains a Cross-Site Scripting (XSS) vulnerability in the downloadAttachment method, allowing authentication bypass. The issue results from lack of input validation, enabling arbitrary script injection. User interaction is required (visiting a malicious page or opening a file).

A directory traversal vulnerability in Allegra's exportReport method. Allows remote disclosure of sensitive information. Authentication required.

A Directory Traversal Information Disclosure vulnerability in the DatabaseBackupBL class of Allegra allows remote attackers to disclose sensitive information on affected installations. The flaw results from the lack of proper validation of a user-supplied path prior to using it in file operations. Authentication is required, and an attacker can leverage this to disclose information in the context of the service account.