Southseast

**Name of the Vulnerable Software and Affected Versions** lakernote EasyAdmin up to 20240315 **Description** A critical issue has been found in lakernote EasyAdmin, affecting some unknown processing of the file "/ureport/designer/saveReportFile". The manipulation leads to server-side request forgery. The attack may be initiated remotely. **Recommendations** For lakernote EasyAdmin up to 20240315, consider disabling access to the "/ureport/designer/saveReportFile" file until a patch is available. Restrict access to this file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** 74CMS version 3.28.0 **Description** A critical issue has been found in the function `sendCompanyLogo` of the file `/controller/company/Index.php#sendCompanyLogo` of the component Company Logo Handler. The manipulation of the argument `imgBase64` leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For 74CMS version 3.28.0, as a temporary workaround, consider disabling the `sendCompanyLogo` function until a patch is available. Restrict access to the `/controller/company/Index.php#sendCompanyLogo` endpoint to minimize the risk of exploitation. Avoid using the argument `imgBase64` in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.