Casp3R0X0

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1673 and below contain an authentication bypass that allows an unauthenticated attacker to perform a full SQL database dump without credentials.

A vulnerability has been found in ProjectSend, affecting the `get preview` function of the `process.php` file. This issue leads to improper control of resource identifiers and can be initiated remotely. The estimated number of potentially affected devices is not provided. There is no information about real-world incidents where this issue was exploited.

A vulnerability was found in the Password Reset Token Handler component, specifically in the `generate random string` function of the file includes/functions.php. This issue leads to insufficiently random values, which can be exploited remotely. The complexity of an attack is rather high, and the exploitability is difficult.

The issue exists due to the lack of protection of the web page structure in the Lab Handler component of EVE-NG, allowing a remote attacker to conduct a cross-site scripting (XSS) attack. The manipulation of some unknown functionality of the Lab Handler component leads to this issue. The attack may be launched remotely.