EUVD-2021-9993

Malicious code in bioql PyPI...

EUVD-2021-9992

Malicious code in bioql PyPI...

CVE-2021-22858

Attackers can access the CGE account management function without privilege for permission elevation and execute arbitrary commands or files after obtaining user permissions...

CVE-2021-22856

The CGE property management system contains SQL Injection vulnerabilities. Remote attackers can inject SQL commands into the parameters in Cookie and obtain data in the database without privilege...

CVE-2021-22857

The CGE page with download function contains a Directory Traversal vulnerability. Attackers can use this loophole to download system files arbitrarily...

CVE-2021-22856

The CGE property management system contains SQL Injection vulnerabilities. Remote attackers can inject SQL commands into the parameters in Cookie and obtain data in the database without privilege...

CVE-2021-22857

The CGE page with download function contains a Directory Traversal vulnerability. Attackers can use this loophole to download system files arbitrarily...

Sql injection

The CGE property management system contains SQL Injection vulnerabilities. Remote attackers can inject SQL commands into the parameters in Cookie and obtain data in the database without privilege...

Directory traversal

The CGE page with download function contains a Directory Traversal vulnerability. Attackers can use this loophole to download system files arbitrarily...

CVE-2021-22858

CVE-2021-22858 relates to ChanGate Enterprise Co., Ltd (CGE) property management system. The connected documents indicate a broken authentication/privilege-elevation flaw in the CGE account management function, enabling attackers to access the function without proper privileges and execute arbitr...

CVE-2021-22857

CVE-2021-22857 describes a Directory Traversal vulnerability in the CGE page download function, allowing attackers to download arbitrary system files. Connected records identify the affected software as ChanGate Enterprise Co., Ltd property management system (per CVE-List). CVSS v3.1 impact: High...

CVE-2021-22856

The CVE-2021-22856 entry is linked to the CGE property management system with SQL injection vulnerabilities. The root cause is unsafely handling parameters in cookies, allowing remote attackers to inject SQL commands and read data from the database without privileges. The connected sources (NVD e...

CVE-2021-22856: Improper Neutralization of Special Elements used in an SQL Command

The CGE property management system contains SQL Injection vulnerabilities. Remote attackers can inject SQL commands into the parameters in Cookie and obtain data in the database without privilege...

PT-2021-15230

Name of the Vulnerable Software and Affected Versions CGE affected versions not specified Description The CGE page with a download function contains a Directory Traversal issue. This allows attackers to download system files arbitrarily. Recommendations At the moment, there is no information abou...

PT-2021-15229

Name of the Vulnerable Software and Affected Versions CGE property management system affected versions not specified Description The issue concerns SQL Injection vulnerabilities in the CGE property management system. Remote attackers can inject SQL commands into the parameters in the Cookie and...

CVE-2021-22857: Improper Limitation of a Pathname to a Restricted Directory

The CGE page with download function contains a Directory Traversal vulnerability. Attackers can use this loophole to download system files arbitrarily...