Milocat

**Name of the Vulnerable Software and Affected Versions** diem-project diem versions prior to 5.1.4 **Description** An OS command injection flaw exists in the Administrative Console component. A remote attacker can exploit this by manipulating the `dm command` argument passed to the `executeCommand()` function within the `dmAdminPlugin/modules/dmConsole/actions/actions.class.php` file. OS command injection is a flaw that allows an attacker to execute arbitrary operating system commands on the server. **Recommendations** As a temporary workaround, restrict access to the `executeCommand()` function in the Administrative Console until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** diem-project diem versions prior to 5.1.4 **Description** A flaw in the Widget Editor component allows for unrestricted upload of files. This issue occurs within an unknown function located in the file `dmFrontPlugin/lib/dmWidget/media/dmWidgetContentBaseMediaForm.php` and can be triggered remotely. **Recommendations** Update diem-project diem to version 5.1.4 or later. As a temporary mitigation, restrict access to the `dmFrontPlugin/lib/dmWidget/media/dmWidgetContentBaseMediaForm.php` file.