CVE-2022-24581

CVE-2022-24581 affects ACEweb Online Portal 3.5.065. The issue allows unauthenticated users to trigger SMB hash disclosure by providing the UNC path of an external SMB share during file upload, causing the victim server to reveal the username and password hash of the ACEweb Online software user. ...

CVE-2022-24241

ACEweb Online Portal 3.5.065 was discovered to contain an External Controlled File Path and Name vulnerability via the txtFilePath parameter in attachments.awp...

CVE-2022-24241

ACEweb Online Portal 3.5.065 is affected by an External Controlled File Path and Name vulnerability via the txtFilePath parameter in attachments.awp. Root cause is an external file path/name handling issue that could affect confidentiality (per CVSS metrics), with CVSS v3.1 base score 7.5 (HIGH) ...

CVE-2022-24240

ACEweb Online Portal 3.5.065 was discovered to contain a SQL injection vulnerability via the criteria parameter in showschedule.awp...

CVE-2022-24240

CVE-2022-24240 concerns ACEweb Online Portal 3.5.065. Multiple connected sources confirm a SQL injection vulnerability in ACEweb Online Portal, triggered by the criteria parameter in the file showschedule.awp (also spelled showschedule/​showschedule in some records). The underlying issue is unval...

CVE-2022-24239

ACEweb Online Portal 3.5.065 was discovered to contain an unrestricted file upload vulnerability via attachments.awp...

CVE-2022-24239

CVE-2022-24239 affects ACEweb Online Portal 3.5.065, with an unrestricted file upload vulnerability via attachments.awp. The vulnerability is documented across multiple sources (NVD, Red Hat, PRION, CNNVD, CVE list) and is rated with a high/critical impact (CVSS v3.1 base score 9.8, network attac...

CVE-2022-24238

ACEweb Online Portal 3.5.065 was discovered to contain a cross-site scripting XSS vulnerability via the txtNmName1 parameter in person.awp...

CVE-2022-24238

CVE-2022-24238 affects ACEweb Online Portal 3.5.065. The vulnerability is a Cross-Site Scripting (XSS) issue in the txtNmName1 parameter of awp/person.awp, originating from insufficient input/output validation. Impact described in sources: client-side JavaScript execution could be possible. The C...

PT-2022-16734

Name of the Vulnerable Software and Affected Versions ACEweb Online Portal version 3.5.065 Description The issue allows unauthenticated SMB hash capture via UNC. By specifying the UNC file path of an external SMB share when uploading a file, an attacker can induce the victim server to disclose th...

PT-2022-16555

Name of the Vulnerable Software and Affected Versions ACEweb Online Portal version 3.5.065 Description A cross-site scripting XSS issue was found in the ACEweb Online Portal. The issue is related to the txtNmName1 parameter in the "person.awp" endpoint. Recommendations For ACEweb Online Portal...

PT-2022-16559

Name of the Vulnerable Software and Affected Versions ACEweb Online Portal version 3.5.065 Description The issue is related to an External Controlled File Path and Name vulnerability. This vulnerability can be exploited via the txtFilePath parameter in the "attachments.awp" endpoint...

PT-2022-16556

Name of the Vulnerable Software and Affected Versions ACEweb Online Portal version 3.5.065 Description The ACEweb Online Portal contains an issue that allows for unrestricted file upload via the attachments.awp endpoint. Recommendations For ACEweb Online Portal version 3.5.065, consider restricti...

PT-2022-16558

Name of the Vulnerable Software and Affected Versions ACEweb Online Portal version 3.5.065 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the criteria parameter in the showschedule.awp endpoint. Recommendations For ACEweb Online Portal...