CVE-2022-44400

Purchase Order Management System v1.0 contains a file upload vulnerability via /purchaseorder/admin/?page=systeminfo...

CVE-2022-44400

Purchase Order Management System v1.0 contains a file upload vulnerability via /purchaseorder/admin/?page=systeminfo...

PT-2022-27211 · Unknown · Purchase Order Management System

Name of the Vulnerable Software and Affected Versions: Purchase Order Management System version 1.0 Description: The issue concerns a file upload vulnerability. It can be exploited via the /purchase order/admin/?page=system info API endpoint. Recommendations: For Purchase Order Management System...

CVE-2022-44400

CVE-2022-44400 affects Purchase Order Management System v1.0. The vulnerability is an unrestricted file upload exposed at /purchase_order/admin/?page=system_info, described as a file upload vulnerability. CVSS v3.1 metrics indicate a CRITICAL impact (C/H, I/H, A/H) with NETWORK attack vector, LOW...

Security Bulletin: IBM Sterling Order Management Jave vulnerability

Summary Java SE related to the 2D component could allow a remote attacker Vulnerability Details CVEID:CVE-2014-0459 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the 2D component could allow a remote attacker to cause a denial of service. CVSS Base score: 4.3 CVSS Tempora...

Security Bulletin: IBM Sterling Order Management Kubernetes vulnerability

Summary Kubernetes could allow a remote authenticated attacker to bypass security restrictions Vulnerability Details CVEID:CVE-2021-25741 DESCRIPTION: Kubernetes could allow a remote authenticated attacker to bypass security restrictions, caused by a symlink exchange flaw in kubelet. By sending a...

Security Bulletin: IBM Sterling Order Management Netty 4.1.34 vulnerablity

Summary Netty could provide various potential exploitable entry points icnluding weaker than expected security, netty-codec is vulnerable to a denial of service, and HTTP request smuggling Vulnerability Details CVEID:CVE-2021-37136 DESCRIPTION: Netty netty-codec is vulnerable to a denial of...

Security Bulletin: IBM Sterling Order Management SnakeYAML 1.24 vulnerability

Summary SnakeYAML could be susceptible to denial of service a Vulnerability Details CVEID:CVE-2017-18640 DESCRIPTION: SnakeYAML is vulnerable to a denial of service, caused by an entity expansion in Alias feature during a load operation. By sending a specially crafted request, a remote attacker...

Security Bulletin: IBM Sterling Order Management Kafka 2.1.0 vulnerablity

Summary Apache Kafka could allow a remote attacker to obtain sensitive information and allow a remote authenticated attacker to bypass security restrictions. Vulnerability Details CVEID:CVE-2021-38153 DESCRIPTION: Apache Kafka could allow a remote attacker to obtain sensitive information, caused ...

Security Bulletin: IBM Sterling Order Management migration strategy to Apache Log4j vulnerability [CVE-2022-23307]

Summary Apache Log4j is used by IBM Sterling Order Management as part of its logging utility and we strongly recommend upgrading to the latest supported version of log4j that was released as part of the latest FixPack CVE-2022-23307. Vulnerability Details CVEID:CVE-2022-23307 DESCRIPTION: Apache...

Security Bulletin: IBM Sterling Order Management migration strategy to Apache Log4j vulnerability (see CVEs below)

Summary Apache Log4j is used by IBM Sterling Order Management as part of its logging utility and we strongly recommend upgrading to the latest supported version of log4j that was released as part of the latest FixPack. Vulnerability Details CVEID:CVE-2020-9488 DESCRIPTION: Apache Log4j is...

CVE-2022-3503

A vulnerability was found in SourceCodester Purchase Order Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the component Supplier Handler. The manipulation of the argument Supplier Name/Address/Contact person/Contact leads to cross site...

Cross site scripting

A vulnerability was found in SourceCodester Purchase Order Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the component Supplier Handler. The manipulation of the argument Supplier Name/Address/Contact person/Contact leads to cross site...

PT-2022-22509 · Sourcecodester · Sourcecodester Purchase Order Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Purchase Order Management System version 1.0 Description: A vulnerability was found in the Supplier Handler component, where the manipulation of the Supplier Name, Address, Contact person, or Contact argument leads to cross-sit...

CVE-2022-3503 SourceCodester Purchase Order Management System Supplier cross site scripting

A vulnerability was found in SourceCodester Purchase Order Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the component Supplier Handler. The manipulation of the argument Supplier Name/Address/Contact person/Contact leads to cross site...

CVE-2022-3503

CVE-2022-3503 affects SourceCodester Purchase Order Management System 1.0, specifically the Supplier Handler component. The vulnerability is a cross-site scripting (XSS) flaw caused by manipulating the arguments Supplier Name/Address/Contact person/Contact, which can be exploited remotely. The ex...

Security Bulletin: Some IBM Sterling Order Management APIs may return database sensitive information (CVE-2013-0578)

Abstract Some IBM Sterling Order Management APIs may return database sensitive information when API tester is deployed in the environment. Content VULNERABILITY DETAILS: DESCRIPTION: Some IBM Sterling Order Management APIs can return database sensitive user information when used in API tester. Al...

Security Bulletin: Cross-site scripting vulnerability found in Sterling Order Management (CVE-2013-6322)

Abstract Sterling Order Management is vulnerable to a reflected cross-site scripting attack which could lead to unauthorized access through the injected scripts. Content VULNERABILITY DETAILS: CVEID: CVE-2013-6322 DESCRIPTION: Sterling Order Management allows the injection of a script which will ...

Security Bulletin: IBM Sterling Order Management Apache Struts upgrade strategy (various CVEs, see below)

Summary Apache Struts is used by IBM Sterling Order Management as part of its web application framework used for creating Java EE web applications . We recommend upgrading to the latest supported version of Struts that was released as part of the latest FixPack 29. Vulnerability Details...

Security Bulletin: Apache Log4j vulnerability

Summary Apache Log4j vulnerability Vulnerability Details CVEID:CVE-2022-23302 DESCRIPTION: Apache Log4j could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization in JMSSink. By sending specially-crafted JNDI requests using...