CVE-2023-41635

A XML External Entity XXE vulnerability in the VerifichePeriodiche.aspx component of GruppoSCAI RealGimm v1.1.37p38 allows attackers to read any file in the filesystem via supplying a crafted XML file...

CVE-2023-41642

Multiple reflected cross-site scripting XSS vulnerabilities in the ErroreNonGestito.aspx component of GruppoSCAI RealGimm 1.1.37p38 allow attackers to execute arbitrary Javascript in the context of a victim user's browser via a crafted payload injected into the VIEWSTATE parameter...

CVE-2023-41638

CVE-2023-41638 affects GruppoSCAI RealGimm 1.1.37p38, specifically the Gestione Documentale module. The vulnerability is an arbitrary file upload that permits remote code execution via uploading a crafted file. CVSS 3.1 metrics indicate NETWORK attack vector, LOW attack complexity, LOW privileges...

PT-2023-28017 · Grupposcai · Grupposcai Realgimm

Name of the Vulnerable Software and Affected Versions: GruppoSCAI RealGimm version 1.1.37p38 Description: The issue is related to an arbitrary file upload vulnerability in the Gestione Documentale module, which allows attackers to execute arbitrary code by uploading a crafted file. Recommendation...

CVE-2023-41636

CVE-2023-41636 describes a SQL injection in the parameters of GruppoSCAI RealGimm v1.1.37p38, specifically the Data Richiesta dal parameter. The vulnerability allows an attacker to access the database and execute arbitrary commands through a crafted SQL query. Affected software: GruppoSCAI RealGi...

CVE-2023-41640

An improper error handling vulnerability in the component ErroreNonGestito.aspx of GruppoSCAI RealGimm 1.1.37p38 allows attackers to obtain sensitive technical information via a crafted SQL query...

CVE-2023-41635

CVE-2023-41635 is an XXE vulnerability in GruppoSCAI RealGimm v1.1.37p38, affecting the VerifichePeriodiche.aspx component. The flaw allows reading arbitrary filesystem files via a crafted XML payload. Affected software/versions are RealGimm v1.1.37p38; impact is confidentiality breach (C for hig...

CVE-2023-41636

A SQL injection vulnerability in the Data Richiesta dal parameter of GruppoSCAI RealGimm v1.1.37p38 allows attackers to access the database and execute arbitrary commands via a crafted SQL query...

CVE-2023-41642: Improper Neutralization of Input During Web Page Generation

Multiple reflected cross-site scripting XSS vulnerabilities in the ErroreNonGestito.aspx component of GruppoSCAI RealGimm 1.1.37p38 allow attackers to execute arbitrary Javascript in the context of a victim user's browser via a crafted payload injected into the VIEWSTATE parameter...

CVE-2023-41635: Improper Restriction of Recursive Entity References in DTDs

A XML External Entity XXE vulnerability in the VerifichePeriodiche.aspx component of GruppoSCAI RealGimm v1.1.37p38 allows attackers to read any file in the filesystem via supplying a crafted XML file...

CVE-2023-41637: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the Carica immagine function of GruppoSCAI RealGimm 1.1.37p38 allows attackers to execute arbitrary code via uploading a crafted HTML file...

CVE-2023-41638: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the Gestione Documentale module of GruppoSCAI RealGimm 1.1.37p38 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2023-41636

A SQL injection vulnerability in the Data Richiesta dal parameter of GruppoSCAI RealGimm v1.1.37p38 allows attackers to access the database and execute arbitrary commands via a crafted SQL query...

CVE-2023-41642

Multiple reflected cross-site scripting XSS vulnerabilities in the ErroreNonGestito.aspx component of GruppoSCAI RealGimm 1.1.37p38 allow attackers to execute arbitrary Javascript in the context of a victim user's browser via a crafted payload injected into the VIEWSTATE parameter...

CVE-2023-41637

An arbitrary file upload vulnerability in the Carica immagine function of GruppoSCAI RealGimm 1.1.37p38 allows attackers to execute arbitrary code via uploading a crafted HTML file...

CVE-2023-41635

A XML External Entity XXE vulnerability in the VerifichePeriodiche.aspx component of GruppoSCAI RealGimm v1.1.37p38 allows attackers to read any file in the filesystem via supplying a crafted XML file...

PT-2023-28018 · Grupposcai · Realgimm

Name of the Vulnerable Software and Affected Versions: GruppoSCAI RealGimm version 1.1.37p38 Description: An improper error handling issue in the ErroreNonGestito.aspx component allows attackers to obtain sensitive technical information via a crafted SQL query. Recommendations: For GruppoSCAI...

PT-2023-28014 · Grupposcai · Grupposcai Realgimm

Name of the Vulnerable Software and Affected Versions: GruppoSCAI RealGimm version 1.1.37p38 Description: A XML External Entity XXE vulnerability in the VerifichePeriodiche.aspx component allows attackers to read any file in the filesystem via supplying a crafted XML file. Recommendations: For...

CVE-2023-41636: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in the Data Richiesta dal parameter of GruppoSCAI RealGimm v1.1.37p38 allows attackers to access the database and execute arbitrary commands via a crafted SQL query...

CVE-2023-41637

The CVE-2023-41637 entry concerns GruppoSCAI RealGimm 1.1.37p38, where the Carica immagine function is vulnerable to arbitrary file upload via a crafted HTML file, enabling code execution. Supported by multiple sources in the connected set, the root cause is an unvalidated file upload in that ima...