Spoo1K

A vulnerability was identified in cemtan sar2html 4.0.0. Affected is the function updateDb of the file sar2html.py of the component File Upload. The manipulation leads to path traversal. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.

A security flaw has been discovered in cemtan sar2html 4.0.0. Affected by this vulnerability is an unknown functionality of the file sar2html.py. The manipulation of the argument SECRET KEY results in hard-coded credentials. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.

A weakness has been identified in cemtan sar2html 4.0.0. Affected by this issue is the function index of the file sar2html.py. This manipulation of the argument sort causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

A security vulnerability has been detected in cemtan sar2html 4.0.0. This affects the function deleteHost/deleteRange/deleteAll of the file sar2html.py. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of the file sar2html.py of the component Archive Processing. The manipulation of the argument s2host results in sql injection. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.

اسم البرنامج المعرض للخطر والإصدارات المتأثرة إصدارات FreeScout السابقة للإصدار 1.8.212 الوصف يتأثر FreeScout، وهو مكتب مساعدة وصندوق بريد مشترك تم إنشاؤه باستخدام Laravel، بمشكلة تتمثل في أن نقطة نهاية واجهة برمجة التطبيقات (API) GET `/thread/read/{conversation id}/{thread id}` لا تتطلب مصادقة وتفتقر إلى التحقق من صحة البيانات لضمان أن `thread id` ينتمي إلى `conversation id` المحدد. وهذا يسمح لمهاجم غير مصدق عليه بوضع علامة «مقروء» على أي سلسلة محادثة باستخدام معرّفات عشوائية، وتعداد معرّفات سلاسل المحادثة الصالحة من خلال رموز استجابة HTTP (200 مقابل 404)، والتلاعب بالطوابع الزمنية `opened at` عبر المحادثات. هذه مشكلة من نوع IDOR (الإشارة المباشرة غير الآمنة إلى الكائنات). التوصيات الترقية إلى الإصدار 1.8.212 أو أحدث من FreeScout.