PT-2023-13979 · Sage · Sage 300

Name of the Vulnerable Software and Affected Versions: Sage 300 versions through 2022 Description: The optional Web Screens feature uses a hard-coded 40-byte blowfish key PASS KEY to encrypt and decrypt the database connection string for the PORTAL database found in the "dbconfig.xml". This issue...

CVE-2022-41400

Sage 300 through 2022 uses a hard-coded 40-byte blowfish key to encrypt and decrypt user passwords and SQL connection strings stored in ISAM database files in the shared data directory. This issue could allow attackers to decrypt user passwords and SQL connection strings...

CVE-2022-41398

The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr instance. This issue could allow attackers to login to the Solr dashboard with admin privileges and access sensitive information...

CVE-2022-41397

The optional Web Screens and Global Search features for Sage 300 through version 2022 use a hard-coded 40-byte blowfish key "LandlordPassKey" to encrypt and decrypt secrets stored in configuration files and in database tables...

CVE-2022-41398

CVE-2022-41398 affects Sage 300 (through 2022) where the optional Global Search feature configures Apache Solr with hard-coded admin credentials. This enables login to the Solr dashboard with admin privileges and potential exposure of sensitive data. The Red Hat/Red flags and other records corrob...

DEBIAN-CVE-2023-29465

SageMath FlintQS 1.0 relies on pathnames under TMPDIR typically world-writable, which for example allows a local user to overwrite files with the privileges of a different user who is running FlintQS...

PT-2023-22268 · Sagemath +1 · Sagemath Flintqs +1

Name of the Vulnerable Software and Affected Versions: SageMath FlintQS version 1.0 Description: The issue allows a local user to overwrite files with the privileges of a different user who is running SageMath FlintQS, due to its reliance on pathnames under TMPDIR, which is typically...

SageMath Sage Cell Server 安全漏洞

SageMath Sage Cell Server is a Cell server that provides a way to embed Sage calculations into web pages. A security vulnerability exists in SageMath Sage Cell Server version 1.0 that stems from allowing a local user to overwrite a file with the privileges of a different user...

PT-2023-3640 · Sage · Sage X3

Name of the Vulnerable Software and Affected Versions: Sage X3 version 12.14.0.50-0 Description: The issue is related to Cross Site Scripting XSS in the Sage X3 Web application. Some parts of the application are dynamically built using user inputs, but these inputs are not verified or filtered,...

CVE-2019-25053

A path traversal vulnerability exists in Sage FRP 1000 before November 2019. This allows remote unauthenticated attackers to access files outside of the web tree via a crafted URL...

CVE-2019-25053

A path traversal vulnerability exists in Sage FRP 1000 before November 2019. This allows remote unauthenticated attackers to access files outside of the web tree via a crafted URL...

Path traversal

A path traversal vulnerability exists in Sage FRP 1000 before November 2019. This allows remote unauthenticated attackers to access files outside of the web tree via a crafted URL...

Sage FRP 1000 路径遍历漏洞

Sage FRP 1000 is a scalable and customizable financial suite from Sage A security vulnerability exists in Sage FRP 1000 versions prior to 2019.11. An attacker exploited the vulnerability to access files outside the web via a specially crafted URL...

CVE-2019-25053

A path traversal vulnerability exists in Sage FRP 1000 before November 2019. This allows remote unauthenticated attackers to access files outside of the web tree via a crafted URL...

CVE-2019-25053

A path traversal vulnerability exists in Sage FRP 1000 before November 2019. This allows remote unauthenticated attackers to access files outside of the web tree via a crafted URL...

CVE-2019-25053

Sage FRP 1000 is affected by a path traversal vulnerability reported for versions before November 2019. An attacker can exploit a crafted URL to access files outside the web root without authentication. The provided documents do not specify the exact root cause details beyond path traversal, nor ...

CVE-2022-34323

Multiple XSS issues were discovered in Sage XRT Business Exchange 12.4.302 that allow an attacker to execute JavaScript code in the context of other users' browsers. The attacker needs to be authenticated to reach the vulnerable features. An issue is present in the Filters and Display model...

CVE-2022-34323

Multiple XSS issues were discovered in Sage XRT Business Exchange 12.4.302 that allow an attacker to execute JavaScript code in the context of other users' browsers. The attacker needs to be authenticated to reach the vulnerable features. An issue is present in the Filters and Display model...

CVE-2022-34324

Multiple SQL injections in Sage XRT Business Exchange 12.4.302 allow an authenticated attacker to inject malicious data in SQL queries: Add Currencies, Payment Order, and Transfer History...

CVE-2022-34322

Multiple XSS issues were discovered in Sage Enterprise Intelligence 2021 R1.1 that allow an attacker to execute JavaScript code in the context of users' browsers. The attacker needs to be authenticated to reach the vulnerable features. An issue is present in the Notify Users About Modification me...