2847 matches found
jshERP SQL Injection Vulnerability
jshERP Huaxia ERP is a homegrown ERP system by the personal developer of Ji Sheng Hua in China. A SQL injection vulnerability exists in jshERP v3.3. An attacker can exploit this vulnerability to build a malicious payload to bypass jshERP's protection mechanism...
Canon Multiple Products Buffer Error Vulnerability
Canon Color imageCLASS is a series of printers from Canon Japan. A security vulnerability exists in several Canon products. The vulnerability can be exploited by an attacker to execute arbitrary code. The following products and versions are affected: Satera LBP670C Series, Satera MF750C Series...
PT-2024-20228 · Jsherp · Jsherp
Name of the Vulnerable Software and Affected Versions: jshERP version 3.3 Description: The issue is related to SQL Injection. The com.jsh.erp.controller.MaterialController, specifically the getListWithStock function, does not properly filter the column and order parameters, allowing an attacker t...
jshERP Security Vulnerabilities
jshERP Huaxia ERP is a homegrown ERP system by the individual developer of China's Ji Sheng Hua. A security vulnerability exists in jshERP v3.3. The vulnerability stems from the fact that the jshERP-boot/systemConfig/upload interface does not check the uploaded file type and can splice biz...
CVE-2024-24160
MRCMS 3.0 contains a Cross-Site Scripting XSS vulnerability via /admin/system/saveinfo.do...
Race Condition
Overview Affected versions of this package are vulnerable to Race Condition in the logging operations when multiple functions write simultaneously. Remediation Upgrade Microsoft.Azure.WebJobs.Logging to version 3.0.0 or higher. References - GitHub Commit - GitHub PR...
Mbed TLS Security Vulnerability
Mbed TLS is an open source, portable, easy-to-use, readable and flexible SSL library. A security vulnerability exists in Mbed TLS version 2.x up to and including version 2.28.7, and version 3.x up to and including version 3.5.2, which could allow sensitive data to be exposed to an attacker in...
Mbed TLS Security Vulnerability
Mbed TLS is an open source, portable, easy-to-use, readable and flexible SSL library. A security vulnerability exists in Mbed TLS versions 2.x through 2.28.7 and 3.x through 3.5.2, which stems from an integer overflow issue. An attacker could exploit this vulnerability to cause a denial of servic...
PT-2024-14064 · Ros2 · Ros2
Name of the Vulnerable Software and Affected Versions: ROS2 Robot Operating System 2 Foxy Fitzroy Description: An issue was discovered in shell command execution in ROS2, allowing an attacker to run arbitrary commands and cause other impacts. The issue is related to the ROS VERSION=2 and ROS PYTH...
PT-2024-14069 · Ros2 · Ros2
Name of the Vulnerable Software and Affected Versions: ROS2 Robot Operating System 2 versions Foxy Fitzroy Description: The issue is an OS command injection vulnerability in command processing or system call components. This allows attackers to run arbitrary commands. The ROS VERSION is 2 and ROS...
PYSEC-2024-24
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'followsymlinks' can be used to determine whether to follow symboli...
PT-2024-14329
Name of the Vulnerable Software and Affected Versions YonBIP version 3 23.05 Description An arbitrary file upload vulnerability in the doAction method of nccloud.web.arcp.taskmonitor.action.ArcpUploadAction allows attackers to execute arbitrary code via uploading a crafted file. Recommendations F...
CVE-2024-20906
Vulnerability in the Integrated Lights Out Manager ILOM product of Oracle Systems component: System Management. Supported versions that are affected are 3, 4 and 5. Easily exploitable vulnerability allows high privileged attacker with network access via ICMP to compromise Integrated Lights Out...
Avo Cross-Site Scripting Vulnerability
Avo is an open source ruby on rails admin panel creation framework. A cross-site scripting vulnerability exists in Avo version 3 pre12, which stems from a cross-site scripting XSS vulnerability in the Avo::BaseAction subclass...
Unsound use of str::from_utf8_unchecked on bytes which are not UTF-8
Affected versions receive a &u8 from the caller through a safe API, and pass it directly to the unsafe str::fromutf8unchecked function. The behavior of ferrissays::say is undefined if the bytes from the caller don't happen to be valid UTF-8. The flaw was corrected in ferris-says21 by using the sa...
PT-2024-19229 · Cozmoslabs · Profile Builder
Name of the Vulnerable Software and Affected Versions: Cozmoslabs Profile Builder Pro versions 3.10.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...
GTKWave buffer overflow vulnerability (CNVD-2024-04846)
GTKWave is a full-featured, GTK+-based waveform viewer from GTKWave. A buffer overflow vulnerability exists in GTKWave version 3.3.115, which can be exploited by an attacker to cause arbitrary code execution via specially crafted .fst files...
PT-2024-14842 · WordPress · Wp Custom Cursors
Name of the Vulnerable Software and Affected Versions: The WP Custom Cursors | WordPress Cursor Plugin versions through 3.2 Description: The issue allows high privilege users, such as admin, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, fo...
OpenVPN Connect Security Breach
OpenVPN Connect is a VPN Virtual Private Network client application from US-based OpenVPN. A security vulnerability exists in OpenVPN Connect versions 3.0 through 3.4.6, which stems from a vulnerability that allows local users to execute code in external third-party libraries using the...
