Atlassian Addresses Issues in Crowd and Bitbucket Products

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Atlassian has two security holes that can be abused to allow arbitrary code execution. CVE-2022-43782 allows an intruder connecting from an IP address on the allow list to authenticate as the crow...

Sanitization Management System SQL注入漏洞

Sanitization Management System is a sanitization management system by Carlo Montero, a personal developer. A SQL injection vulnerability exists in Sanitization Management System v1.0, which can be exploited to conduct a SQL injection attack via /php-sms/admin/?page=user/manageuser&id=...

Online Leave Management System SQL Injection Vulnerability (CNVD-2022-80690)

Online Leave Management System is an online leave management system. version v1.0 of Online Leave Management System has a security vulnerability that originated through the component /admin/?page=user/manageuser&id= found to contain a SQL injection vulnerability. No detailed vulnerability details...

Sql injection

Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /admin/?page=user/manageuser&id=...

CVE-2022-43782

Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call privileged endpoints in Crowd's REST API under the usermanagement path. This vulnerability can only be exploited by IPs specified under the...

CVE-2022-43179

Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /admin/?page=user/manageuser&id=...

Vulnerability fixed in Atlassian Crowd

A vulnerability has been fixed in Atlassian Crowd. This vulnerability allows a malicious person to, through a configuration error to authenticate itself and thereby interact with the user management REST API. In doing so, the IP of the attacker must be on the allow list, which is not the default...

Automotive Shop Management System SQL注入漏洞

Automotive Shop Management System is an automotive shop management system by the individual developer Carlo Montero. Automotive Shop Management System v1.0 suffers from a SQL injection vulnerability that originates from /asms/admin/?page=user/manageuser&id=Lack of validation of externally entered...

PT-2022-5601 · Atlassian · Crowd

Name of the Vulnerable Software and Affected Versions: Atlassian Crowd versions 3.x.x through 5.x.x before 5.0.3 Atlassian Crowd versions 4.x.x before 4.4.4 Description: The issue is related to errors during the authentication procedure in the Atlassian Crowd data processing product's REST API...

ZOHO ManageEngine Mobile Device Manager Plus 安全漏洞

ZOHO ManageEngine Mobile Device Manager Plus is an enterprise mobile device management MDM software from ZOHO, Inc. It can be used to manage and protect Apple, Android, Windows and Chrome OS devices. A security vulnerability exists in ZOHO ManageEngine Mobile Device Manager Plus versions prior to...

Ibexa DXP users with the Company admin role can assign any role to any user

Critical severity. Users with the Company admin role introduced by the company account feature in v4 can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect. The role / assign policy is...

GHSA-394J-X37R-2Q27 Ibexa DXP users with the Company admin role can assign any role to any user

Critical severity. Users with the Company admin role introduced by the company account feature in v4 can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect. The role / assign policy is...

CVE-2022-39234 user session persists even after permanently deleting account in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Deleted/deactivated user could continue to use their account as long as its cookie is valid. This iss...

CVE-2022-3825

A vulnerability was found in Huaxia ERP 2.3 and classified as critical. Affected by this issue is some unknown functionality of the component User Management. The manipulation of the argument login leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the...

Huaxia ERP 安全漏洞

Huaxia ERP is an ERP software from Huaxia, China. A security vulnerability exists in Huaxia ERP that stems from an unknown method in the User Management component, where manipulation of the login parameter can result in an SQL injection...

PT-2022-24312 · Unknown · Huaxia Erp

Name of the Vulnerable Software and Affected Versions: Huaxia ERP version 2.3 Description: A critical issue was found in the User Management component, where the manipulation of the login argument leads to SQL injection. This issue can be exploited remotely. Recommendations: For Huaxia ERP versio...

CVE-2022-3825 Huaxia ERP User Management sql injection

A vulnerability was found in Huaxia ERP 2.3 and classified as critical. Affected by this issue is some unknown functionality of the component User Management. The manipulation of the argument login leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the...

CVE-2022-3825 Huaxia ERP User Management sql injection

A vulnerability was found in Huaxia ERP 2.3 and classified as critical. Affected by this issue is some unknown functionality of the component User Management. The manipulation of the argument login leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the...

CVE-2022-3825 Huaxia ERP User Management sql injection

A vulnerability was found in Huaxia ERP 2.3 and classified as critical. Affected by this issue is some unknown functionality of the component User Management. The manipulation of the argument login leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the...

CVE-2022-3825

CVE-2022-3825 affects Huaxia ERP 2.3, specifically the User Management component. The issue is an SQL injection triggered by manipulating the login argument, with remote attack potential and publicly disclosed exploits. Several sources confirm the vulnerability, its critical classification, and t...