CVE-2024-25511

The office automation system RuvarOA (versions v6.01 through v12.01 ) is vulnerable to a SQL injection vulnerability. The root cause is a lack of validation for externally entered SQL statements via the id parameter at the /AddressBook/address_public_new.aspx API endpoint. An attacker can exploit...

RuvarOA security vulnerabilities

RuvarOA is an office automation system of Ruvar China. A SQL injection vulnerability exists in RuvarOA v6.01 and v12.01, which originates from the id parameter of the /AddressBook/addresspublicshow.aspx file that lacks validation of externally entered SQL statements. An attacker can exploit this...

CVE-2024-25511

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/addresspublicnew.aspx...

CVE-2024-25511: Improper Neutralization of Special Elements used in an SQL Command

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/addresspublicnew.aspx...

CVE-2024-25510: Improper Neutralization of Special Elements used in an SQL Command

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/addresspublicshow.aspx...

CVE-2024-25510

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/addresspublicshow.aspx...

ape-addressbook (>=0.4.0a1, <=0.5.0a1), ape-alchemy (>=0.1.0b1, <=0.5.4) +54 more potentially affected by unknown CVE via eth-abi (3.0.1)

eth-abi PYPI version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on eth-abi and may be impacted: - ape-addressbook =0.4.0a1, =0.1.0b1, =0.1.22, =0.4.0, =0.4.0a0, =0.1.0a0, =0.4.0a1, =0.1.0a2, =0.4.0, =0.4.0, =0.4.0, =0.4.0a1, =0.4.0, =0.5.5 and...

CVE-2023-35927 Nextcloud system addressbooks can be modified by malicious trusted server

NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until...

CVE-2023-35927

The CVE-2023-35927 issue affects Nextcloud Server and Enterprise Server where two trusted servers exchange share secrets and an attacker could modify or delete VCards in the origin server’s system address book, impacting user search and avatar menus. The initial description lists affected lines f...

CVE-2023-35927 Nextcloud system addressbooks can be modified by malicious trusted server

NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until...

CVE-2023-35927

NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until...

CVE-2023-35927: Improper Access Control

NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until...

System addressbooks can be modified by malicious trusted server

None...

agentopia (>=0.1.0, <=0.1.5), alaya-py (>=0.15.0.0, <=0.15.0.1) +218 more potentially affected by CVE-2022-37454 via pysha3 (>=1.0.0b1, <=1.0.2)

pysha3 PYPI version =1.0.0b1, =0.1.0, =0.15.0.0, =0.4.0a1, =0.1.0b1, =0.1.22, =0.4.0, =0.4.0a0, =0.1.0a0, =0.4.0a1, =0.1.0a2, =0.4.0, =0.4.0, =0.4.0, =0.5.2 - ape-frame 0.5.0a0 and more Source cves: CVE-2022-37454 Source advisory: OSV:GHSA-6W4M-2XHG-2658...

SUSE CVE-2017-0895

Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and addressbook names to other logged-in users. Note that no actual content of the calendar and addressbook has been disclosed...

CVE-2021-31583

Sipwise C5 NGCP WWW Admin version 3.6.7 up to and including platform version NGCP CE 3.0 has multiple authenticated stored and reflected XSS vulnerabilities when input passed via several parameters to several scripts is not properly sanitized before being returned to the user: Stored XSS in...

PT-2021-19431 · Sipwise · Sipwise C5 Ngcp Www Admin

Name of the Vulnerable Software and Affected Versions: Sipwise C5 NGCP WWW Admin version 3.6.7 up to and including platform version NGCP CE 3.0 Description: The issue concerns multiple authenticated stored and reflected XSS vulnerabilities. These occur when input passed via several parameters to...

CVE-2021-31583: Improper Neutralization of Input During Web Page Generation

Sipwise C5 NGCP WWW Admin version 3.6.7 up to and including platform version NGCP CE 3.0 has multiple authenticated stored and reflected XSS vulnerabilities when input passed via several parameters to several scripts is not properly sanitized before being returned to the user: Stored XSS in...

EulerOS 2.0 SP2 : evolution-data-server (EulerOS-SA-2021-1293)

According to the versions of the evolution-data-server packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - evolution-data-server eds through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a 'begin...

openSUSE Security Update : MozillaThunderbird (openSUSE-2020-2133)

This update for MozillaThunderbird fixes the following issues : - Mozilla Thunderbird 78.4.2 MFSA 2020-49 bsc1178611 - CVE-2020-26950 bmo1675905 Write side effects in MCallGetProperty opcode not accounted for - Mozilla Thunderbird 78.4.1 - new: Thunderbird prompts for an address to use when...