Vulnerabilities fixed in SugarCRM

Vulnerabilities have been fixed in SugarCRM. A malicious party could exploit the vulnerabilities to launch cross-site scripting or SQL injection attacks, manipulate data or execute code execute code. No CVE IDs have yet been disclosed for the vulnerabilities. SugarCRM has released updates to fix...

MobileShop Master 1.0 SQL Injection

Exploit Title: MobileShop master v1.0 - SQL Injection Vuln. + Date: 2024-13-03 + Exploit Author: "HAZIM ARBAŞ" from EMA Security LTD - Siber Güvenlik ve Bilişim Hizmetleri https://emasecurity.com + Vendor Homepage:...

MobileShop master v1.0 - SQL Injection Vuln.

Exploit Title: MobileShop master v1.0 - SQL Injection Vuln. + Date: 2024-13-03 + Exploit Author: "HAZIM ARBAŞ" from EMA Security LTD - Siber Güvenlik ve Bilişim Hizmetleri https://emasecurity.com + Vendor Homepage:...

CVE-2024-29194 OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation

OneUptime is a solution for monitoring and managing online services. The vulnerability lies in the improper validation of client-side stored data within the web application. Specifically, the ismasteradmin key, stored in the local storage of the browser, can be manipulated by an attacker. By...

Critical SQL Injection Vulnerability Discovered in Atlassian Bamboo

Summary: Atlassian has released patches addressing several security vulnerabilities, including a significant critical issue impacting Bamboo Data Center and Server, identified as CVE-2024-1597. This flaw, leading to a SQL injection, poses a risk of unnecessary data exposure and potential data...

CVE-2024-2453 Advantech WebAccess/SCADA SQL Injection

There is an SQL injection vulnerability in Advantech WebAccess/SCADA software that allows an authenticated attacker to remotely inject SQL code in the database. Successful exploitation of this vulnerability could allow an attacker to read or modify data on the remote database...

CVE-2023-48902

An issue was discovered in tramyardg autoexpress version 1.3.0, allows unauthenticated remote attackers to escalate privileges, update car data, delete vehicles, and upload car images via authentication bypass in uploadCarImages.php...

CVE-2024-2645

CVE-2024-2645 affects Netentsec NS-ASG Application Security Gateway 6.3. The vulnerability is in the file "/vpnweb/resetpwd/resetpwd.php" where the UserId parameter can cause improper neutralization of data within XPath expressions, enabling a remote attack. Public exploitation has been disclosed...

CVE-2023-32260 A potential Misinterpretation of Input vulnerability has been identified in SMAX, AMX, and HCMX products.

Misinterpretation of Input vulnerability in OpenText™ Service Management Automation X SMAX, OpenText™ Asset Management X AMX, and OpenText™ Hybrid Cloud Management X HCMX products. The vulnerability could allow Input data manipulation.This issue affects Service Management Automation X SMAX...

CVE-2023-32260

CVE-2023-32260 describes a Misinterpretation of Input vulnerability affecting OpenText SMAX, AMX, and HCMX. Affected: SMAX versions 2020.05–2023.05; AMX versions 2021.08–2023.05; HCMX versions 2020.05–2023.05. Root cause: misinterpretation of input data leading to input data manipulation. Impact ...

CVE-2023-32260 A potential Misinterpretation of Input vulnerability has been identified in SMAX, AMX, and HCMX products.

Misinterpretation of Input vulnerability in OpenText™ Service Management Automation X SMAX, OpenText™ Asset Management X AMX, and OpenText™ Hybrid Cloud Management X HCMX products. The vulnerability could allow Input data manipulation.This issue affects Service Management Automation X SMAX...

PT-2024-12308

Name of the Vulnerable Software and Affected Versions OpenText Service Management Automation X SMAX versions 2020.05 through 2023.05 OpenText Asset Management X AMX versions 2021.08 through 2023.05 OpenText Hybrid Cloud Management X HCMX versions 2020.05 through 2023.05 Description The issue is...

CVE-2023-32260: Misinterpretation of Input

Misinterpretation of Input vulnerability in OpenText™ Service Management Automation X SMAX, OpenText™ Asset Management X AMX, and OpenText™ Hybrid Cloud Management X HCMX products. The vulnerability could allow Input data manipulation.This issue affects Service Management Automation X SMAX...

CVE-2024-2480 MHA Sistemas arMHAzena Executa Page sql injection

A vulnerability classified as critical was found in MHA Sistemas arMHAzena 9.6.0.0. This vulnerability affects unknown code of the component Executa Page. The manipulation of the argument Companhia/Planta/Agente de/Agente até leads to sql injection. The attack can be initiated remotely. The explo...

Vulnerabilities fixed in Fortinet FortiManager, FortiAnalyzer and FortiClient-EMS

Vulnerabilities have been fixed in Fortinet FortiManager, FortiAnalyzer and FortiClient-EMS. The vulnerabilities allow a malicious party to conduct attacks that result in the following categories of damage: SQL Injection; Manipulation of data; Remote code execution User Rights; Circumvention of...

IBM Aspera SQL Injection Vulnerability

IBM Aspera is a set of fast file transfer and streaming solutions built on the IBM FASP protocol from International Business Machines IBM. An SQL injection vulnerability exists in IBM Aspera Console versions 3.4.0 through 3.4.2, which stems from the application's lack of validation of externally...

Vulnerabilities fixed in Microsoft Windows

Microsoft has fixed vulnerabilities in Windows. A malicious party can exploit the vulnerabilities to launch attacks execute attacks that can lead to the following categories of damage: Denial-of-Service DoS Manipulation of data Circumvention of security measure Remote code execution User rights...

Vulnerabilities fixed in Siemens products

Siemens has fixed vulnerabilities in various products such as. Cerberus, Ruggedcom, SCALANCE, Sentron, SIMATIC, Sinema, Sinteso, Siveillance and Solid Edge. The vulnerabilities allow a malicious party potentially able to launch attacks that could lead to the following categories of damage:...

PT-2024-8432

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a data-race condition in the netrom component of the Linux kernel, which can be exploited to manipulate data. The problem arises because the sysctl value can be...

BIT-DRUPAL-2022-25273

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter...