CVE-2024-2827: Server-Side Request Forgery (SSRF)

A vulnerability, which was classified as critical, has been found in lakernote EasyAdmin up to 20240315. This issue affects some unknown processing of the file /ureport/designer/saveReportFile. The manipulation leads to server-side request forgery. The attack may be initiated remotely. The exploi...

CVE-2024-2825: Path Traversal: '../filedir'

A vulnerability classified as critical has been found in lakernote EasyAdmin up to 20240315. This affects an unknown part of the file /ureport/designer/saveReportFile. The manipulation of the argument file leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The...

PT-2023-19463

Name of the Vulnerable Software and Affected Versions ureport version 2.2.9 Description The issue is an XML External Entity XXE vulnerability that allows attackers to execute arbitrary code. This is achieved by uploading a crafted XML file to the "/ureport/designer/saveReportFile" API endpoint...

CVE-2023-24187

An XML External Entity XXE vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to /ureport/designer/saveReportFile...

CVE-2023-24187: Improper Restriction of XML External Entity Reference

An XML External Entity XXE vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to /ureport/designer/saveReportFile...