Daniele Scanu

**Name of the Vulnerable Software and Affected Versions** SecuExtender SSL VPN Client version 4.0.4.0 **Description** The issue is related to an out-of-bounds write vulnerability in the SecuExtender SSL VPN Client software. This vulnerability could allow an authenticated local user to gain privilege escalation by sending a crafted CREATE message. The vulnerability is associated with a buffer overflow in memory, which can be exploited to elevate privileges. **Recommendations** For version 4.0.4.0, consider restricting access to the CREATE message functionality until a patch is available. As a temporary workaround, disabling the vulnerable component related to the out-of-bounds write vulnerability may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CMS Made Simple versions 2.2.15 and earlier **Description** The issue concerns SQL injection in the modules/News/function.admin articlestab.php file. Specifically, the `$sortby` variable is concatenated with `$query1`, allowing for the injection of arbitrary SQL language without using the '.' character. **Recommendations** For CMS Made Simple versions 2.2.15 and earlier, consider restricting access to the `function.admin articlestab.php` file until a patch is available. As a temporary workaround, avoid using the `$sortby` variable in the affected query until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** baserCMS versions 4.5.3 and earlier **Description** The issue affects baserCMS, an open source content management system with a focus on Japanese language support. Users with upload privilege may upload crafted zip files capable of path traversal on the host operating system. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. **Recommendations** For baserCMS versions 4.5.3 and earlier, update to the latest version of baserCMS as soon as possible. As a temporary workaround, consider restricting upload privileges to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** pimcore/pimcore versions prior to 10.0.7 **Description** The issue exists due to the absence of a check on the `storeId` parameter in the `collectionsActionGet` and `groupsActionGet` methods within the `ClassificationstoreController` class. **Recommendations** For versions prior to 10.0.7, update to version 10.0.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the `collectionsActionGet` and `groupsActionGet` methods within the `ClassificationstoreController` class until a patch is available. Avoid using the `storeId` parameter in the affected API endpoints until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** pimcore/pimcore versions prior to 6.8.8 **Description** A Local File Inclusion issue exists in the `downloadCsvAction` function of the `CustomReportController` class. This can be reached by an authenticated user through a GET request at the endpoint "/admin/reports/custom-report/download-csv?exportFile=`filename`". The `exportFile` variable is not sanitized, allowing an attacker to exploit this issue. **Recommendations** For versions prior to 6.8.8, update to version 6.8.8 or later to resolve the issue. As a temporary workaround, consider disabling the `downloadCsvAction` function in the `CustomReportController` class until a patch is available. Restrict access to the `/admin/reports/custom-report/download-csv` endpoint to minimize the risk of exploitation. Avoid using the `exportFile` variable in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** pimcore/pimcore versions 6.7.2 through 6.8.3 **Description** The issue affects the data classification functionality in ClassificationstoreController, allowing for SQL Injection. This can be exploited by sending a specifically-crafted input in the `relationIds` parameter. For example, a request to "/admin/classificationstore/relations" with a manipulated `relationIds` parameter can demonstrate this exploit. **Recommendations** For versions 6.7.2 through 6.8.3, as a temporary workaround, consider restricting access to the ClassificationstoreController or disabling the `relationIds` parameter in the "/admin/classificationstore/relations" endpoint until a patch is available. Avoid using the `relationIds` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Pimcore versions prior to 5.7.1 **Description** An issue allows an attacker with classes permission to exploit the unserialize function by sending a POST request to "/admin/class/bulk-commit" and passing untrusted values in the `data` parameter to `bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php`. **Recommendations** For versions prior to 5.7.1, update to version 5.7.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/admin/class/bulk-commit" endpoint or limiting the ability to pass untrusted values in the `data` parameter until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** CMS Made Simple versions 2.2.8 through 2.2.9 **Description** An issue was discovered that allows unauthenticated blind time-based SQL injection via the `m1 idlist` parameter in the News module. This can be achieved through a crafted URL. The issue is related to SQL injection and has been reportedly exploited in real-world scenarios, with examples provided on platforms like TryHackMe. **Recommendations** For CMS Made Simple versions 2.2.8 through 2.2.9, consider updating to a version newer than 2.2.9 to resolve the issue. As a temporary workaround, consider restricting access to the News module until a patch is available. Avoid using the `m1 idlist` parameter in crafted URLs to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** CMS Made Simple versions prior to 2.2.10 **Description** The issue concerns the `class.showtime2 image.php` file in CMS Made Simple, where it fails to verify that a watermark file has a standard image file extension, such as GIF, JPG, JPEG, or PNG. **Recommendations** For versions prior to 2.2.10, update to version 2.2.10 or later to resolve the issue.