1756 matches found
CVE-2024-27113 Insecure Direct Object Reference to export Database in SOPlanning before 1.52.02
An unauthenticated Insecure Direct Object Reference IDOR to the database has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use this vulnerability to gain access to the underlying database by exporting it as a CSV file. The vulnerability...
CVE-2024-27115 Remote Code Execution through File Upload in SOPlanning before 1.52.02
A unauthenticated Remote Code Execution RCE vulnerability is found in the SO Planning online planning tool. With this vulnerability, an attacker can upload executable files that are moved to a publicly accessible folder before verifying any requirements. This leads to the possibility of execution...
CVE-2024-27115 Remote Code Execution through File Upload in SOPlanning before 1.52.02
A unauthenticated Remote Code Execution RCE vulnerability is found in the SO Planning online planning tool. With this vulnerability, an attacker can upload executable files that are moved to a publicly accessible folder before verifying any requirements. This leads to the possibility of execution...
CVE-2024-27115
CVE-2024-27115 corresponds to an authenticated RCE in SOPlanning via PHP file upload. The nuclei template specifies exploitation of SOPlanning 1.52.01 through authenticated file upload, enabling an attacker to upload and execute PHP code. Remediation is to upgrade to a version newer than 1.52.01,...
CVE-2024-27114
SO Planning is vulnerable to an unauthenticated remote code execution via the PHP file upload feature when the public view setting is enabled. Affected versions are prior to 1.52.02; an attacker can upload a PHP file, which is briefly executable before removal, enabling code execution on the unde...
CVE-2024-27114 Remote Code Execution through File Upload in SOPlanning before 1.52.02
A unauthenticated Remote Code Execution RCE vulnerability is found in the SO Planning online planning tool. If the public view setting is enabled, a attacker can upload a PHP-file that will be available for execution for a few milliseconds before it is removed, leading to execution of code on the...
CVE-2024-27112
CVE-2024-27112 describes an unauthenticated SQL Injection in the SOPlanning (SO Planning tool) when the public view setting is enabled. The vulnerability could allow an attacker to access the underlying database. It has been remediated in version 1.52.02. Connected sources confirm this CVE affect...
CVE-2024-27113
CVE-2024-27113 affects the SOPlanning tool (SOPlanning) where an unauthenticated Insecure Direct Object Reference (IDOR) can occur when the public view is enabled, allowing exporting the underlying database via CSV. Root cause: IDOR exposure enabling access to the database export functionality. I...
The vulnerability of the Apache OFBiz resource planning software lies in security mechanism failures, which allow attackers to gain unauthorized access to protected information or cause other adverse effects.
The vulnerability of Apache OFBiz’s enterprise resource planning software relates to security mechanism errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information or cause other adverse effects...
The vulnerability of the Apache OFBiz resource planning software lies in the insufficient validation of incoming requests, allowing a hacker to execute an SSRF attack.
The vulnerability of Apache OFBiz’s resource planning software lies in the insufficient verification of incoming requests. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack remotely...
CVE-2023-49233
Insufficient access checks in Visual Planning Admin Center 8 before v.1 Build 240207 allow attackers in possession of a non-administrative Visual Planning account to utilize functions normally reserved for administrators. The affected functions allow attackers to obtain different types of...
CVE-2023-49233
Insufficient access checks in Visual Planning Admin Center 8 before v.1 Build 240207 allow attackers in possession of a non-administrative Visual Planning account to utilize functions normally reserved for administrators. The affected functions allow attackers to obtain different types of...
Visual Planning Admin Center 安全漏洞
Visual Planning Admin Center is a cloud-based resource management and scheduling software from Visual Planning. A security vulnerability exists in versions prior to Visual Planning Admin Center 8 Build 240207 that stems from insufficient access checking. An attacker could exploit the vulnerabilit...
CVE-2023-49233
Insufficient access checks in Visual Planning Admin Center 8 before v.1 Build 240207 allow attackers in possession of a non-administrative Visual Planning account to utilize functions normally reserved for administrators. The affected functions allow attackers to obtain different types of...
CVE-2023-49233
Visual Planning Admin Center 8 (pre-build 240207) is affected by insufficient access checks. By exploiting this, a non-administrative Visual Planning account can access functions normally reserved for administrators, potentially obtaining various configured credentials and elevating privileges to...
PT-2024-13702 · Unknown · Visual Planning Admin Center
Name of the Vulnerable Software and Affected Versions: Visual Planning Admin Center 8 versions prior to v.1 Build 240207 Description: The issue is related to insufficient access checks, allowing attackers with non-administrative accounts to utilize functions normally reserved for administrators...
Security Bulletin: IBM Planning Analytics Workspace is affected by vulnerabilities in multiple Open Source Software (OSS) components
Summary There are vulnerabilities in multiple Open Source Software OSS components consumed by IBM Planning Analytics Workspace. These issues have been addressed by upgrading or removing the vulnerable libraries. Please refer to the table in the Related Information section for vulnerability impact...
[SECURITY] Fedora 40 Update: zabbix-6.0.33-1.fc40
Zabbix is software that monitors numerous parameters of a network and the health and integrity of servers. Zabbix uses a flexible notification mechanism that allows users to configure e-mail based alerts for virtually any event. This allows a fast reaction to server problems. Zabbix offers...
GO-2022-0939 Improper Neutralization of Special Elements used in an LDAP Query in stevenweathers/thunderdome-planning-poker in github.com/StevenWeathers/thunderdome-planning-poker
Improper Neutralization of Special Elements used in an LDAP Query in stevenweathers/thunderdome-planning-poker in github.com/StevenWeathers/thunderdome-planning-poker...