44 matches found
CVE-2022-24238
ACEweb Online Portal 3.5.065 was discovered to contain a cross-site scripting XSS vulnerability via the txtNmName1 parameter in person.awp...
CVE-2022-24241
ACEweb Online Portal 3.5.065 was discovered to contain an External Controlled File Path and Name vulnerability via the txtFilePath parameter in attachments.awp...
CVE-2022-24239
ACEweb Online Portal 3.5.065 was discovered to contain an unrestricted file upload vulnerability via attachments.awp...
CVE-2022-24240
ACEweb Online Portal 3.5.065 was discovered to contain a SQL injection vulnerability via the criteria parameter in showschedule.awp...
Path traversal
ACEweb Online Portal 3.5.065 was discovered to contain an External Controlled File Path and Name vulnerability via the txtFilePath parameter in attachments.awp...
Unrestricted file upload
ACEweb Online Portal 3.5.065 was discovered to contain an unrestricted file upload vulnerability via attachments.awp...
Sql injection
ACEweb Online Portal 3.5.065 was discovered to contain a SQL injection vulnerability via the criteria parameter in showschedule.awp...
Cross site scripting
ACEweb Online Portal 3.5.065 was discovered to contain a cross-site scripting XSS vulnerability via the txtNmName1 parameter in person.awp...
Design/Logic Flaw
ACEweb Online Portal 3.5.065 allows unauthenticated SMB hash capture via UNC. By specifying the UNC file path of an external SMB share when uploading a file, an attacker can induce the victim server to disclose the username and password hash of the user executing the ACEweb Online software...
ACEware Systems ACEweb Online Portal 代码问题漏洞
ACEware Systems ACEweb Online Portal is a component of the Student Manager solution from ACEware Systems. A security vulnerability exists in ACEware Systems ACEweb Online Portal version 3.5.065. An attacker could use this vulnerability to trick a vulnerable server into disclosing the username and...
ACEware Systems ACEweb Online Portal SQL注入漏洞
ACEware Systems ACEweb Online Portal is a component of the Student Manager solution from ACEware Systems, Inc. A SQL injection vulnerability exists in ACEware Systems ACEweb Online Portal version 3.5.065, which stems from The conditional parameter in showchedule.awp lacks validation for external...
ACEware Systems ACEweb Online Portal 代码问题漏洞
ACEware Systems ACEweb Online Portal is a component of the Student Manager solution from ACEware Systems. A security vulnerability exists in ACEware Systems ACEweb Online Portal version 3.5.065. An attacker has exploited this vulnerability to create an unrestricted file upload vulnerability via...
ACEware Systems ACEweb Online Portal 跨站脚本漏洞
ACEware Systems ACEweb Online Portal is a component of the Student Manager solution from ACEware Systems, Inc. A cross-site scripting vulnerability exists in ACEware Systems ACEweb Online Portal version 3.5.065, which originates in person. The txtNmName1 parameter in awp lacks a validation filter...
ACEware Systems ACEweb Online Portal 安全漏洞
ACEware Systems ACEweb Online Portal is a component of the Student Manager solution from ACEware Systems, Inc. A security vulnerability exists in ACEware Systems ACEweb Online Portal version 3.5.065, which stems from the discovery that ACEweb Online Portal 3.5.065 contains an external controlled...
CVE-2022-24581
CVE-2022-24581 affects ACEweb Online Portal 3.5.065. The issue allows unauthenticated users to trigger SMB hash disclosure by providing the UNC path of an external SMB share during file upload, causing the victim server to reveal the username and password hash of the ACEweb Online software user. ...
CVE-2022-24581
ACEweb Online Portal 3.5.065 allows unauthenticated SMB hash capture via UNC. By specifying the UNC file path of an external SMB share when uploading a file, an attacker can induce the victim server to disclose the username and password hash of the user executing the ACEweb Online software...
CVE-2022-24241
ACEweb Online Portal 3.5.065 was discovered to contain an External Controlled File Path and Name vulnerability via the txtFilePath parameter in attachments.awp...
CVE-2022-24241
ACEweb Online Portal 3.5.065 is affected by an External Controlled File Path and Name vulnerability via the txtFilePath parameter in attachments.awp. Root cause is an external file path/name handling issue that could affect confidentiality (per CVSS metrics), with CVSS v3.1 base score 7.5 (HIGH) ...
CVE-2022-24240
CVE-2022-24240 concerns ACEweb Online Portal 3.5.065. Multiple connected sources confirm a SQL injection vulnerability in ACEweb Online Portal, triggered by the criteria parameter in the file showschedule.awp (also spelled showschedule/showschedule in some records). The underlying issue is unval...