Daniele Scanu

The issue is related to an out-of-bounds write vulnerability in the SecuExtender SSL VPN Client software. This vulnerability could allow an authenticated local user to gain privilege escalation by sending a crafted CREATE message. The vulnerability is associated with a buffer overflow in memory, which can be exploited to elevate privileges.

The issue concerns SQL injection in the modules/News/function.admin articlestab.php file. Specifically, the `$sortby` variable is concatenated with `$query1`, allowing for the injection of arbitrary SQL language without using the '.' character.

The issue affects baserCMS, an open source content management system with a focus on Japanese language support. Users with upload privilege may upload crafted zip files capable of path traversal on the host operating system. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users.

The issue exists due to the absence of a check on the `storeId` parameter in the `collectionsActionGet` and `groupsActionGet` methods within the `ClassificationstoreController` class.

A Local File Inclusion issue exists in the `downloadCsvAction` function of the `CustomReportController` class. This can be reached by an authenticated user through a GET request at the endpoint "/admin/reports/custom-report/download-csv?exportFile=`filename`". The `exportFile` variable is not sanitized, allowing an attacker to exploit this issue.

The issue affects the data classification functionality in ClassificationstoreController, allowing for SQL Injection. This can be exploited by sending a specifically-crafted input in the `relationIds` parameter. For example, a request to "/admin/classificationstore/relations" with a manipulated `relationIds` parameter can demonstrate this exploit.

An issue allows an attacker with classes permission to exploit the unserialize function by sending a POST request to "/admin/class/bulk-commit" and passing untrusted values in the `data` parameter to `bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php`.

An issue was discovered that allows unauthenticated blind time-based SQL injection via the `m1 idlist` parameter in the News module. This can be achieved through a crafted URL. The issue is related to SQL injection and has been reportedly exploited in real-world scenarios, with examples provided on platforms like TryHackMe.

The issue concerns the `class.showtime2 image.php` file in CMS Made Simple, where it fails to verify that a watermark file has a standard image file extension, such as GIF, JPG, JPEG, or PNG.