CVE-2023-0995 Cross-site Scripting (XSS) - Stored in unilogies/bumsys

Cross-site Scripting XSS - Stored in GitHub repository unilogies/bumsys prior to v2.0.1...

WS-2023-0057

Local File Inclusion LFI vulnerability was discovered in unilogies/bumsys prior to 2.0.2. The parameter page and invoiceType is not properly sanitize leads to Local file inclusion...

CVE-2023-0455 Unrestricted Upload of File with Dangerous Type in unilogies/bumsys

Unrestricted Upload of File with Dangerous Type in GitHub repository unilogies/bumsys prior to v1.0.3-beta...

CVE-2023-0455 Unrestricted Upload of File with Dangerous Type in unilogies/bumsys

Unrestricted Upload of File with Dangerous Type in GitHub repository unilogies/bumsys prior to v1.0.3-beta...

PT-2023-16284 · Unilogies · Bumsys

Name of the Vulnerable Software and Affected Versions: unilogies/bumsys versions prior to 1.0.3-beta Description: The issue concerns an unrestricted upload of a file with a dangerous type. Recommendations: For versions prior to 1.0.3-beta, update to version 1.0.3-beta or later to resolve the issu...

CVE-2023-0455

Unrestricted Upload of File with Dangerous Type in GitHub repository unilogies/bumsys prior to v1.0.3-beta...

CVE-2023-0455: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type in GitHub repository unilogies/bumsys prior to v1.0.3-beta...

CVE-2023-0455

CVE-2023-0455 affects unilogies/bumsys prior to v1.0.3-beta. Affected: the upload mechanism for shop logos (settings/shop-list) that accepts a file named profile picture.php with PHP code, indicating unrestricted upload of a dangerous file type. Root cause: insufficient validation of file type/ex...

WS-2023-0038

An Improper Privilege Management vulnerability exists in unilogies/bumsys up to 2.0.0. No permission user can increase his role to administrator. As a result, a zero permission user can increase his role to SuperAdmin...

WS-2023-0040

Cookie without “Secure “ and “ HttpOnly ” flag attribute exists in unilogies/bumsys. The " Secure flag "ensures that the cookie is only sent over a secure HTTPS connection, while the "Httponly flag" prevents the cookie from being accessed by JavaScript, which helps to protect against XSS attacks...

WS-2023-0036

A Reflected XSS was discovered on msg Parameter in unilogies/bumsys due to lack of sanitization for the user input in msg parameter on the print.php file...