1091 matches found
CVE-2024-44430
SQL Injection vulnerability in Best Free Law Office Management Software-v1.0 allows an attacker to execute arbitrary code and obtain sensitive information via a crafted payload to the kortexlite/control/registercase.php interface...
CVE-2024-44430
SQL Injection vulnerability in Best Free Law Office Management Software-v1.0 allows an attacker to execute arbitrary code and obtain sensitive information via a crafted payload to the kortexlite/control/registercase.php interface...
Command Execution Vulnerability in Zhiyuan OA (CNVD-2024-45618)
Zhiyuan OA is a collaborative management software, a digital collaborative operation platform for medium-sized and large group organizations. A command execution vulnerability exists in Zhiyuan OA, which can be exploited by an attacker to gain server privileges...
TVT NVMS-1000 Directory Traversal
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'TVT NVMS-1000 Directory Traversal', 'Description' = %q This module exploits an unauthenticated directory traversal vulnerability which exists in...
CVE-2024-45058
CVE-2024-45058 affects Portabilis Portábilis i-Educar prior to version 2.9. The issue resides in ieducar/intranet/educar_usuario_cad.php where a crafted POST to /intranet/educar_usuario_cad.php can change a user’s type by altering the nivel_usuario_ parameter, because the script does not verify t...
OTRS 安全漏洞
OTRS is a service management solution from OTRS Germany. A security vulnerability exists in OTRS that stems from improper invalidation of inputs made by an attacker with administrator privileges, allowing cross-site scripting attacks against other administrators in the system configuration. The...
Voltronic Power ViewPower elevation of privilege vulnerability (CNVD-2025-21588)
Voltronic Power ViewPower is Voltronic Power's monitoring and management software for solar inverters. An elevation of privilege vulnerability exists in Voltronic Power ViewPower, which can be exploited by an attacker to escalate privileges and execute arbitrary code in the SYSTEM context...
Hitachi Device Manager 安全漏洞
Hitachi Device Manager is a device management software from Hitachi, Ltd Hitachi, Japan. It is designed to help users simplify storage resource management, optimize storage performance, and improve the reliability and availability of storage systems. A security vulnerability exists in Hitachi...
Mercodia Feripro 安全漏洞
Mercodia Feripro is a vacation management software from Mercodia USA. A security vulnerability exists in Mercodia Feripro 2.2.3 and earlier versions, which stems from the presence of a cross-site scripting XSS vulnerability...
The vulnerability of the software for managing and optimizing Cisco Intelligent Node (iNode) networks stems from the use of a hard-crypted cryptographic key. This allows attackers to carry out “man-in-the-middle” attacks.
The vulnerability of Cisco Intelligent Node iNode management and optimization software is related to the use of a rigidly encrypted cryptographic key. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information by...
The vulnerability of the Microprogramming Software of Supermicro BMC controllers, related to the execution of operations outside the buffer in memory, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the Microprogrammed Software of Supermicro controllers involves the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...
The vulnerability of the Telerik Report Server software’s reporting control tool lies in its reliance on external controls for selecting classes. This allows an attacker to execute arbitrary code.
The vulnerability of the Telerik Report Server reporting management software lies in the use of external control for selecting classes when input data is provided. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
IBM Rational ClearQuest Cross-Site Scripting Vulnerability (CNVD-2024-35116)
IBM Rational ClearQuest IBM Rational CQ is a change management software from International Business Machines IBM. It can help increase developer productivity while providing methods, processes, and tools that are best suited for project and team personnel. A cross-site scripting vulnerability...
The vulnerability of the JetBrains YouTrack project management and task management software, related to the absence of an authentication process that allows unauthorized users to elevate their privileges.
The vulnerability of the JetBrains YouTrack project management and task management software is related to the absence of an authentication process. Exploiting this vulnerability could allow a malicious actor to gain increased privileges remotely...
CVE-2024-37148 GLPI allows account takeover via SQL Injection in AJAX scripts
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in some AJAX scripts to alter another user account data and take control of it. Upgrad...
eSkooly Security Vulnerabilities
eSkooly is a free online school management software from eSkooly, Inc. A security vulnerability exists in eSkooly 3.0 and prior versions that stems from a cross-site request forgery vulnerability that allows remote attackers to elevate privileges via the token handling component...
CVE-2024-27713
An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the HTTP Response Header Settings component...
CVE-2024-27715
An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via a crafted request to the Password Change mechanism...