Casp3R0X0

**Name of the Vulnerable Software and Affected Versions** FOG versions 1.5.10.1673 and below **Description** FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1673 and below contain an authentication bypass that allows an unauthenticated attacker to perform a full SQL database dump without credentials. **Recommendations** Upgrade to the latest version of either the dev-branch or working-1.6 branch.

**Name of the Vulnerable Software and Affected Versions** ProjectSend versions up to r1605 **Description** A vulnerability has been found in ProjectSend, affecting the `get preview` function of the `process.php` file. This issue leads to improper control of resource identifiers and can be initiated remotely. The estimated number of potentially affected devices is not provided. There is no information about real-world incidents where this issue was exploited. **Recommendations** For ProjectSend versions up to r1605, upgrade to version r1720 to address this issue. As a temporary workaround, consider disabling the `get preview` function of the `process.php` file until the patch is applied. Restrict access to the `process.php` file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ProjectSend versions up to r1605 **Description** A vulnerability was found in the Password Reset Token Handler component, specifically in the `generate random string` function of the file includes/functions.php. This issue leads to insufficiently random values, which can be exploited remotely. The complexity of an attack is rather high, and the exploitability is difficult. **Recommendations** For versions up to r1605, upgrade to version r1720 to address this issue. As a temporary workaround, consider restricting the use of the `generate random string` function in the Password Reset Token Handler until the upgrade is applied.

**Name of the Vulnerable Software and Affected Versions** EVE-NG versions 5.0.1-13 **Description** The issue exists due to the lack of protection of the web page structure in the Lab Handler component of EVE-NG, allowing a remote attacker to conduct a cross-site scripting (XSS) attack. The manipulation of some unknown functionality of the Lab Handler component leads to this issue. The attack may be launched remotely. **Recommendations** For EVE-NG versions 5.0.1-13, consider disabling the Lab Handler component until a patch is available to prevent potential cross-site scripting attacks. Restrict access to the affected component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.