Casp3R0X0

FOG هو نظام مجاني ومفتوح المصدر يضم مجموعة أدوات للنسخ/التصوير/الاستعادة وإدارة المخزون. تحتوي الإصدارات 1.5.10.1673 والإصدارات الأقدم منها على ثغرة في تجاوز المصادقة تسمح لمهاجم غير مصادق عليه بإجراء نسخ كامل لقاعدة بيانات SQL دون الحاجة إلى بيانات اعتماد.

A vulnerability has been found in ProjectSend, affecting the `get preview` function of the `process.php` file. This issue leads to improper control of resource identifiers and can be initiated remotely. The estimated number of potentially affected devices is not provided. There is no information about real-world incidents where this issue was exploited.

A vulnerability was found in the Password Reset Token Handler component, specifically in the `generate random string` function of the file includes/functions.php. This issue leads to insufficiently random values, which can be exploited remotely. The complexity of an attack is rather high, and the exploitability is difficult.

The issue exists due to the lack of protection of the web page structure in the Lab Handler component of EVE-NG, allowing a remote attacker to conduct a cross-site scripting (XSS) attack. The manipulation of some unknown functionality of the Lab Handler component leads to this issue. The attack may be launched remotely.