236 matches found
CVE-2024-25518
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the templateid parameter at /WorkFlow/wfgetfieldsapprove.aspx...
CVE-2024-25522
CVE-2024-25522 affects RuvarOA v6.01 and v12.01, where the office_missive_id parameter in /WorkFlow/wf_work_form_save.aspx is vulnerable to SQL injection. Multiple connected sources describe an inability to validate external SQL input, enabling attackers to execute arbitrary SQL and exfiltrate da...
CVE-2024-25527
RuvarOA v6.01 and v12.01 contain a SQL injection vulnerability in the id parameter of /PersonalAffair/worklog_template_show.aspx due to lack of validation of externally entered SQL statements. This could allow an attacker to execute arbitrary SQL commands to access or exfiltrate data, as describe...
CVE-2024-25525
CVE-2024-25525 affects RuvarOA versions 6.01 and 12.01. A SQL injection vulnerability arises from lack of validation of the filename parameter in the /WorkFlow/OfficeFileDownload.aspx endpoint. Impact is described as high (CVE metrics show CRITICAL with Confidentiality, Integrity, and Availabilit...
PT-2024-20985 · Ruvaroa · Ruvaroa
Name of the Vulnerable Software and Affected Versions: RuvarOA versions 6.01 through 12.01 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the sys file storage id parameter at the "/WorkPlan/WorkPlanAttachDownLoad.aspx" API endpoint...
CVE-2024-25520
CVE-2024-25520 affects RuvarOA v6.01 and v12.01. A SQL injection exists via the id parameter to /SysManage/sys_blogtemplate_new.aspx, stemming from a lack of input validation. Attackers could execute arbitrary SQL commands, with potential exposure or manipulation of database data (per CNVD/Red Ha...
CVE-2024-25517
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the tbTable argument at /WebUtility/MF.aspx...
CVE-2024-25524
CVE-2024-25524 affects RuvarOA v6.01 and v12.01, where a SQL injection is exploitable via the sys_file_storage_id parameter in /WorkPlan/WorkPlanAttachDownLoad.aspx. The root cause is lack of input validation in that parameter, enabling arbitrary SQL execution and potential data disclosure/altera...
CVE-2024-25533
CVE-2024-25533 affects RuvarOA v6.01–v12.01. Error messages disclose the server path at /WorkFlow/OfficeFileUpdate.aspx and, per multiple sources, allow writing files or executing arbitrary SQL via crafted statements due to insufficient input validation. Affected versions: 6.01–12.01. Root cause ...
CVE-2024-25524
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sysfilestorageid parameter at /WorkPlan/WorkPlanAttachDownLoad.aspx...
CVE-2024-25519
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the idlist parameter at /WorkFlow/wfworkprint.aspx...
CVE-2024-25532
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the btid parameter at /include/getdict.aspx...
CVE-2024-25525
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the filename parameter at /WorkFlow/OfficeFileDownload.aspx...
CVE-2024-25527
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklogtemplateshow.aspx...
CVE-2024-25514
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the templateid parameter at /SysManage/wftemplatechildfieldlist.aspx...
CVE-2024-25509
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sysfilestorageid parameter at /WorkFlow/wffiledownload.aspx...
CVE-2024-25510
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/addresspublicshow.aspx...
CVE-2024-25514
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the templateid parameter at /SysManage/wftemplatechildfieldlist.aspx...