PT-2024-17634 · Tongda Oa · Tongda Oa

Name of the Vulnerable Software and Affected Versions: Tongda OA 2017 versions up to 11.10 Description: A critical vulnerability has been found in Tongda OA. The issue affects an unknown function of the file /general/email/outbox/delete.php. The manipulation of the DELETE STR argument leads to SQ...

PT-2024-17638 · Unknown · Tongda Oa 2017

Name of the Vulnerable Software and Affected Versions: Tongda OA 2017 versions up to 11.9 Description: A critical vulnerability was found in Tongda OA 2017. The issue affects an unknown functionality of the file /general/attendance/manage/ask duty/delete.php. The manipulation of the ASK DUTY ID...

CVE-2017-18639

creationtimestamp| type| source ---|---|--- 2024-02-05 09:41:37+00:00| seen| https://t.me/ctinow/179077...

Security Bulletin: App Connect Enterprise Certified Container UBI updates

Summary IBM App Connect Enterprise Certified Container ACEcc is built on the Red Hat Universal Base Images. ACEcc operator versions 5.0.14 LTS and 11.2.0 contain fixes to the listed CVEs found in the base images. This bulletin provides patch information to address the reported vulnerabilities...

Imperva uncovers new Indicators of Compromise for FBI and CISA-flagged AndroxGh0st botnet

On January 16, a joint alert from FBI and CISA warned about a concerning development: the emergence of a botnet driven by AndroxGh0st malware targeting vulnerable applications and web servers. AndroxGh0st is a Python-based malware, first seen in late 2022, designed to target Laravel .env files an...

CVE-2017-7152

creationtimestamp| type| source ---|---|--- 2024-01-31 08:41:48+00:00| seen| https://t.me/ctinow/176551 2024-01-31 11:07:09+00:00| seen| https://t.me/ctinow/176649 2024-01-31 13:37:05+00:00| seen| https://t.me/ctinow/176737...

Multiple Devices Information Disclosure / Path Traversal Vulnerabilities - Active Check

Multiple devices are prone to information disclosure and / or path traversal vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only i...

CVE-2017-15725

creationtimestamp| type| source ---|---|--- 2024-01-29 11:41:09+00:00| seen| https://t.me/ctinow/175176...

CVE-2024-0938

A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.9. This affects an unknown part of the file /general/email/inbox/deletewebmail.php. The manipulation of the argument WEBBODYIDSTR leads to sql injection. The exploit has been disclosed to the public and may be...

CVE-2024-0938

A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.9. This affects an unknown part of the file /general/email/inbox/deletewebmail.php. The manipulation of the argument WEBBODYIDSTR leads to sql injection. The exploit has been disclosed to the public and may be...

Sql injection

A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.9. This affects an unknown part of the file /general/email/inbox/deletewebmail.php. The manipulation of the argument WEBBODYIDSTR leads to sql injection. The exploit has been disclosed to the public and may be...

CVE-2024-0938 Tongda OA 2017 delete_webmail.php sql injection

A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.9. This affects an unknown part of the file /general/email/inbox/deletewebmail.php. The manipulation of the argument WEBBODYIDSTR leads to sql injection. The exploit has been disclosed to the public and may be...

CVE-2024-0938 Tongda OA 2017 delete_webmail.php sql injection

A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.9. This affects an unknown part of the file /general/email/inbox/deletewebmail.php. The manipulation of the argument WEBBODYIDSTR leads to sql injection. The exploit has been disclosed to the public and may be...

TONGDA Office Anywhere SQL Injection Vulnerability

TONGDA Office Anywhere is a collaborative office OA system. A SQL injection vulnerability exists in TONGDA Office Anywhere 2017 version 11.9 and earlier versions, which stems from an incorrect operation of the parameter WEBBODYIDSTR that can lead to SQL injection...

rpm: checks for unsafe symlinks are not performed for intermediary directories

It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threa...

rpm: checks for unsafe symlinks are not performed for intermediary directories

It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threa...

rpm: checks for unsafe symlinks are not performed for intermediary directories

It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threa...

Security Bulletin: IBM Maximo Application Suite uses Remote Integer Buffer Overflow Vulnerability which is vulnerable to CVE-2017-7529

Summary IBM Maximo Application Suite uses Remote Integer Buffer Overflow Vulnerability which is vulnerable to CVE-2017-7529. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2017-7529 DESCRIPTION: Nginx could allow a remote attacker t...

Axis Communications P3225 and M3005 Network Cameras Improper Privilege Management (CVE-2017-20049)

A vulnerability, was found in legacy Axis devices such as P3225 and M3005. This affects an unknown part of the component CGI Script. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely. This plugin only works with Tenable.ot. Please visit...

CVE-2017-20189

creationtimestamp| type| source ---|---|--- 2024-01-22 07:31:58+00:00| seen| https://t.me/ctinow/171006 2024-01-31 03:16:25+00:00| seen| https://t.me/ctinow/176438 2024-02-16 08:46:07+00:00| seen| https://t.me/ctinow/186181...