98 matches found
CVE-2018-25094
CVE-2018-25094 affects the Online Accounting System (versions up to 1.4.0). The vulnerability lies in ckeditor/filemanager/browser/default/image.php where manipulating the fid argument (input like ../../../etc/passwd) yields a path traversal (../filedir). The exploit has been disclosed publicly. ...
Online Accounting System Security Vulnerability
Online Accounting System is an online accounting system by 59160781 Individual Developer. A security vulnerability exists in Online Accounting System version 1.4.0 and earlier, which stems from a path traversal caused by the parameter fid in the file ckeditor/filemanager/browser/default/image.php...
Attacker can Grief The Call to depositAsset Making It Impossible For The Victim To Deposit
Lines of code Vulnerability details Impact The attacker can grief the victim , making him unable to deposit asset into the pool. Proof of Concept The attack flow is as follows - Alice decides to deposit assets into the LRTDepositPool.sol , she calls depositPool here At L152 the function makes the...
USAGE OF abi.encodePacked TO ENCODE DATA COULD LEAD TO payload DATA COLLISION IN THE RootBridgeAgent._createSettlementMultiple FUNCTION
Lines of code Vulnerability details Impact The RootBridgeAgent.callOutAndBridgeMultiple function is used to settle multiple assets and perform a remote call to a branch chain. callOutAndBridgeMultiple function calls the RootBridgeAgent.createSettlementMultiple internal function to compute the...
Bhima 安全漏洞
BHIMA is a free, open source accounting and hospital information management system HIMS open source from IMAWorldHealth.org in Congo. A security vulnerability exists in Bhima version 1.27.0 that stems from not properly validating a user's privileges for certain actions that the user can perform...
SQL Injection Vulnerability in UFIDA GRP-U8 Administration and Utilities Internal Control Management Software (New Government Accounting System Special Edition) (CNVD-2022-84009)
Founded in 1988, UFIDA is a leading digital intelligence platform and service provider for enterprises and public organizations in China and around the world. A SQL injection vulnerability exists in UFIDA GRP-U8 Administration and Utilities Internal Control Management Software New Government...
notrinosrp 跨站脚本漏洞
notrinoserp is a web-based ERP by Phương Individual Developer, an accounting system written in PHP and MySql. A cross-site scripting vulnerability exists in versions prior to notrinosrp 0.7, which originates from cross-site scripting XSS...
Ledger CLI Tags Parsing Code Execution Vulnerability
Summary An exploitable buffer overflow vulnerability exists in the tag parsing functionality of Ledger-CLI 3.1.1. A specially crafted journal file can cause a integer underflow resulting in code execution. An attacker can construct a malicious journal file to trigger this vulnerability. Tested...
Lambeth IT Accounting Management System suffers from java deserialization remote command execution vulnerability
Lambeth Technology Accounting Management System is a set of accounting management and external service informatization application system developed by Lambeth Information Technology Co. A Java deserialization remote command execution vulnerability exists in the Lambeth Technologies Accounting...
Lambeth Technologies Accounting Management System suffers from java deserialization vulnerability
Lambeth Information Technology Co., Ltd. is a large-scale high-tech enterprise with information technology and environmental protection technology as its core business direction. Lambeth Technology's accounting management system has a java deserialization vulnerability. Using related tools, an...
FrontAccounting 'attachments.php'任意文件上传漏洞
Bugtraq ID:66217 FrontAccounting FA是一个针对企业ERP供应链的网页会计系统。 FrontAccounting /admin/attachments.php脚本存在安全漏洞，允许攻击者上传使用恶意扩展名的文件，并以WEB权限执行。 0 FrontAccounting 2.x FrontAccounting 2.3.20已经修复该漏洞，建议用户下载更新： http://frontaccounting.com...
webERP <= 4.08.1 Local/Remote File Inclusion Vulnerability
Exploit for php platform in category web applications :::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ posdubatgmail.com 2012-06-27 webERP = 4.08.1 Local/Remote File Inclusion Vulnerability Scrip...
webERP 4.08.1 Local File Inclusion / Remote File Inclusion
:::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ posdubatgmail.com 2012-06-27 webERP = 4.08.1 Local/Remote File Inclusion Vulnerability Script: "Accounting & Best Practice Business Administration...
webERP 4.08.1 - Local/Remote File Inclusion
:::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ posdubatgmail.com 2012-06-27 webERP = 4.08.1 Local/Remote File Inclusion Vulnerability Script: "Accounting & Best Practice Business Administration...
Radius Manager 3.8.0 - Multiple Cross-Site Scripting Vulnerabilities
Radius Manager 3.8.0 - Multiple Cross-Site Scripting Vulnerabilities Check Point Software Technologies - Vulnerability Discovery Team VDT http://www.checkpoint.com/defense/ Radius Manager Multiple Cross Site Scripting Issues CVE-2010-4275 INTRODUCTION Radius Manager is a centralized way for...
Radius Manager Cross Site Scripting
Check Point Software Technologies - Vulnerability Discovery Team VDT http://www.checkpoint.com/defense/ Radius Manager Multiple Cross Site Scripting Issues CVE-2010-4275 INTRODUCTION Radius Manager is a centralized way for administration of Mikrotik, Cisco, Chillispot and StarOS routers and...
Brilliant Accounting System (59) Insecure Library Loading Vulnerability
A vulnerability has been discovered in Brilliant Accounting System 59, which can be exploited by malicious people to compromise a user's system. The vulnerability is caused due to the application loading libraries in an insecure manner. Libraries list called is as follows: • idapi32.dll •...
SQL-Ledger 'admin.pl' Empty Credentials
The remote web server is hosting SQL-Ledger, a web-based double-entry accounting system. The installed version does not require credentials to access the administrator interface. Note that the installed version is potentially affected by several other vulnerabilities, though Nessus has not tested...