CVE-2024-48454

CVE-2024-48454 targets SourceCodester Purchase Order Management System v1.0, allowing remote code execution via the /admin?page=user component. Multiple connected feeds (Red Hat, NVD, CVEs list, CNNVD, PT-Security) corroborate an RCE risk in the admin page, with confirmed affected software/versio...

CVE-2024-48454

An issue in SourceCodester Purchase Order Management System v1.0 allows a remote attacker to execute arbitrary code via the /admin?page=user component...

CVE-2024-48454

An issue in SourceCodester Purchase Order Management System v1.0 allows a remote attacker to execute arbitrary code via the /admin?page=user component...

CVE-2024-7873

Veribase Order (Veribilim Software) is affected by CVE-2024-7873 due to improper neutralization of input during web page generation, leading to stored XSS. Affected versions are prior to 4.010.3. The vulnerability is triggered by unsafe handling of input that is later reflected in web pages and p...

CVE-2024-7873 Stored XSS in Veribilim Software's Veribase Order Management

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting', Improper Encoding or Escaping of Output, CWE - 83 Improper Neutralization of Script in Attributes in a Web Page vulnerability in Veribilim Software Veribase Order allows Stored XSS, Cross-Site Scripting XSS...

CVE-2024-6917

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Veribilim Software Veribase Order Management allows OS Command Injection. This issue affects Veribase Order Management: before v4.010.2...

CVE-2024-6917

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Veribilim Software Veribase Order Management allows OS Command Injection.This issue affects Veribase Order Management: before v4.010.2...

CVE-2024-6917 RCE in Veribilim Software's Veribase Order Management

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Veribilim Software Veribase Order Management allows OS Command Injection. This issue affects Veribase Order Management: before v4.010.2...

CVE-2024-6917 RCE in Veribilim Software's Veribase Order Management

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Veribilim Software Veribase Order Management allows OS Command Injection. This issue affects Veribase Order Management: before v4.010.2...

PT-2024-37956

Name of the Vulnerable Software and Affected Versions Veribase Order Management versions prior to v4.010.2 Description The issue is related to an OS Command Injection vulnerability, which allows unauthorized access due to improper neutralization of special elements used in an OS command. This...

Security Bulletin: IBM Sterling Order Management using IBM WebSphere Application Server Liberty is vulnerable to a denial of service attack.

Summary IBM WebSphere Application Server Liberty is vulnerable to a denial of service attack caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. Vulnerability Details CVEID:CVE-2023-38737 DESCRIPTION: I...

Security Bulletin: Order Management could be subject to an Apache Struts vulnerability that could allow a remote attacker to execute arbitrary code on the system.

Summary Order Management removed parts of legacy code that carried vulnerabilites. The code did contain CVE-2013-2115, CVE-2013-4316, CVE-2014-0112, CVE-2014-0113, CVE-2015-5209, CVE-2016-3082, CVE-2016-4436, CVE-2017-12611, CVE-2019-0230, CVE-2019-0233, CVE-2020-17530, CVE-2021-31805,...

Security Bulletin: Order Management could be subject to Log4j 1.x vulnerability that could be exploited to remotely execute arbitrary code .

Summary Order Management removed parts of legacy code that carried vulnerabilites. The code did contain CVE-2019-17571, CVE-2020-9493, CVE-2021-4104, CVE-2022-23302, CVE-2022-23305, CVE-2022-23307, CVE-2020-9488 however the specific code related to the vulnerability is not in use, therefore the...

Security Bulletin: Order Management is subject to an Apache Batik vulnerability and could allow a remote attacker to obtain sensitive information.

Summary Order Management removed parts of legacy code that carried vulnerabilites. The code did contain CVE-2015-0250, however the specific code related to the vulnerability is not in use, therefore the risk is lower. This bulletin identifies the steps to take to address the vulnerability...

Security Bulletin: Order Management could be subject to multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x.

Summary Order Management removed parts of legacy code that carried vulnerabilites. The code did contain CVE-2012-0838, CVE-2011-1772, CVE-2008-6504, CVE-2010-1870, CVE-2012-0394, however the specific code related to the vulnerability is not in use, therefore the risk is lower. This bulletin...

Security Bulletin: Order Management is subject to vulnerabilities regarding XML service where a remote attacker could exploit this vulnerability.

Summary Order Management removed parts of legacy code that carried vulnerabilites. The code did contain CVE-2009-2625, CVE-2013-4002, CVE-2012-0881, however the specific code related to the vulnerability is not in use, therefore the risk is lower. This bulletin identifies the steps to take to...

Security Bulletin: Struts Vulnerability - Order Management does contain the Struts code and it is vulnerable with lower risk [CVE-2023-50164]

Summary Order Management does contain the Struts code and it is vulnerable CVE-2023-50164, however the specific code related to the vulnerability is not in use, therefore the risk is lower. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details...

CVE-2023-52215

CVE-2023-52215 affects the WordPress plugin “Simple Inventory Management – just scan barcode to manage products and orders. For WooCommerce.” The issue is an unauthenticated SQL injection via the userToken parameter in versions up to 1.5.1 (up to and including 1.5.1). A fix is available in versio...

CVE-2023-22088

Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications component: User Management. Supported versions that are affected are 7.4.0 and 7.4.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP ...

Security Bulletin: Apache Commons vulnerability

Summary Apache Commons vulnerability Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by not limit the number of request parts to be processed in the file upload function. By sending a specially-crafted...