CVE-2023-48645: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in the Archibus app 4.0.3 for iOS. It uses a local database that is synchronized with a Web central server instance every time the application is opened, or when the refresh button is used. There is a SQL injection in the search work request feature in the Maintenance modu...

CVE-2023-48645

An issue was discovered in the Archibus app 4.0.3 for iOS. It uses a local database that is synchronized with a Web central server instance every time the application is opened, or when the refresh button is used. There is a SQL injection in the search work request feature in the Maintenance modu...

PT-2024-13617 · Archibus · Archibus

Name of the Vulnerable Software and Affected Versions: Archibus app version 4.0.3 for iOS Description: An issue was discovered in the Archibus app, which uses a local database synchronized with a Web central server instance. There is a SQL injection in the search work request feature in the...

Website Builder by SeedProd < 6.15.22 - Unauthenticated Plugin Page Content Update

Description The plugin does not have authorisation in its seedprodlitenewlpage function, allowing unauthenticated attackers to update the contents of coming-soon, maintenance pages, login and 404 pages set up with the plugin to a blank state As unauthenticated, open the following URL to put the...

Website Builder by SeedProd < 6.15.22 - Unauthenticated Plugin Page Content Update

Description The plugin does not have authorisation in its seedprodlitenewlpage function, allowing unauthenticated attackers to update the contents of coming-soon, maintenance pages, login and 404 pages set up with the plugin to a blank state PoC As unauthenticated, open the following URL to put t...

GHSA-7452-XQPJ-6RPC moby Access to remapped root allows privilege escalation to real root

Impact When using --userns-remap, if the root user in the remapped namespace has access to the host filesystem they can modify files under /var/lib/docker/ that cause writing files with extended privileges. Patches Versions 20.10.3 and 19.03.15 contain patches that prevent privilege escalation fr...

PT-2024-40942 · Unknown · Conrod Core

Name of the Vulnerable Software and Affected Versions: conrod core affected versions not specified Description: The issue concerns the conrod core crate, which is no longer maintained. As a result, users are advised to consider alternative solutions. The author recommends egui as a potential...

MAL-2024-476 Malicious code in wlwz-2312-3400 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f4dcad97e921bf7007292462c57e3fa3927bbc672a662c5b5d5ea75dfded7fec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the NEXO-OS operating system in the Bosch Nexo cordless nutrunner and Bosch Nexo special cordless nutrunner tools for maintenance work on production lines allows a intruder to trigger a service failure or execute arbitrary code.

The vulnerability of the NEXO-OS operating system for tools used in production line maintenance with the Bosch Nexo cordless nutrunner and Bosch Nexo special cordless nutrunner lies in the overflowing of memory buffer in dynamic memory. Exploiting this vulnerability can allow a malicious actor to...

The vulnerability of the NEXO-OS operating system in the Bosch Nexo cordless nutrunner and Bosch Nexo special cordless nutrunner tools used in production lines allows a intruder to trigger a service failure or execute arbitrary code.

The vulnerability of the NEXO-OS operating system for tools used in production line maintenance with the Bosch Nexo cordless nutrunner and Bosch Nexo special cordless nutrunner is related to buffer overflow in the stack. Exploiting this vulnerability can allow a malicious actor to trigger...

The vulnerability of the NEXO-OS operating system in the Bosch Nexo cordless nutrunner and Bosch Nexo special cordless nutrunner tools used in production lines allows a intruder to trigger a service failure or execute arbitrary code.

The vulnerability of the NEXO-OS operating system for tools used in production line maintenance with the Bosch Nexo cordless nutrunner and Bosch Nexo special cordless nutrunner is related to buffer overflow in the stack. Exploiting this vulnerability could allow a malicious actor to trigger...

Vulnerabilities fixed in Oracle Supply Chain products

Oracle has fixed vulnerabilities in several Supply Chain products. A malicious party could exploit the vulnerabilities to perform attacks that could result in the following categories of damage: Cross-Site Scripting XSS Denial-of-Service DoS. Access to sensitive data The vulnerabilities have been...

WordPress Manutenção < 1.0.7 - IP Spoofing to Maintenance Mode Bypass

Description The plugin is vulnerable to IP Spoofing due to insufficient validation of IP addresses, allowing unauthenticated attackers to bypass the plugin's maintenance mode restriction via the 'X-Forwarded-For' HTTP header...

The vulnerability of Fanuc i Series CNC control systems’ microprogrammed software, related to uncontrolled resource consumption, allows attackers to cause malfunctions during maintenance operations.

The vulnerability of Fanuc i Series CNC control systems’ microprogramming software is related to uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause malfunctions in the system...

CVE-2024-20942

Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle Supply Chain component: LOV. Supported versions that are affected are 11.5, 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

Design/Logic Flaw

Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle Supply Chain component: LOV. Supported versions that are affected are 11.5, 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2024-20942

The CVE-2024-20942 vulnerability affects Oracle Complex Maintenance, Repair, and Overhaul (LOV component) in Oracle Supply Chain. Affected versions: 11.5, 12.1, 12.2. The issue arises from insufficient input validation in LOV, allowing a remote attacker with network access via HTTP to compromise ...

Oracle Supply Chain Products Suite Security Vulnerability

Oracle Supply Chain Products Suite is a set of supply chain solutions from Oracle Oracle. The product provides value chain planning, value chain execution, product lifecycle management and other functions. A security vulnerability exists in Oracle Supply Chain's Oracle Complex Maintenance, Repair...

PT-2024-1234 · Oracle · Oracle Complex Maintenance

Name of the Vulnerable Software and Affected Versions: Oracle Complex Maintenance, Repair, and Overhaul versions 11.5 through 12.2 Description: The issue exists due to insufficient input validation in the LOV component of the Oracle Complex Maintenance, Repair, and Overhaul application. This allo...

CVE-2024-20942: Cross-Site Request Forgery (CSRF)

Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle Supply Chain component: LOV. Supported versions that are affected are 11.5, 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...