JVN#26734798: FFRI AMC vulnerable to OS command injection

FFRI AMC provided by FFRI Security, Inc. is a management console for the endpoint security product FFRI yarai and ActSecure χ. FFRI AMC contains an OS command injection vulnerability CWE-78. It is exploitable when the notification program setting is enabled, the executable file path is configured...

JVN#26225832: EC-CUBE plugin (for EC-CUBE 4 series) "EC-CUBE Web API Plugin" vulnerable to stored cross-site scripting

EC-CUBE plugin for EC-CUBE 4 series "EC-CUBE Web API Plugin" provided by EC-CUBE CO.,LTD. contains a stored cross-site scripting vulnerability CWE-79 in OAuth Management feature. Impact When there are multiple users using OAuth Management feature and one of them inputs some crafted value on the...

JVN#84326763: Multiple vulnerabilities in SKYSEA Client View

SKYSEA Client View provided by Sky Co.,LTD. is an Enterprise IT Asset Management Tool. SKYSEA Client View contains multiple vulnerabilities listed below. Improper access control in the specific process CWE-266 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Base Score 7.8 CVE-2024-41139 Origin...

SQL Injection Vulnerability in WisdomWater Business Charge Management System of New Day Technology Co. Ltd (CNVD-2024-36424)

Xintian Technology Co., Ltd. is an enterprise mainly engaged in the instrumentation manufacturing industry. A SQL injection vulnerability exists in the WisdomWater WisdomWater Business Charge Management System of Xintian Technology Co. Ltd. that can be exploited by attackers to obtain sensitive...

CVE-2024-36475

FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. contain an active debug code vulnerability. If a user who knows how to use the debug function logs in to the product, the debug function may be used and an arbitrary OS command may be executed...

CVE-2024-36475

FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. contain an active debug code vulnerability. If a user who knows how to use the debug function logs in to the product, the debug function may be used and an arbitrary OS command may be executed...

CVE-2024-36475

CVE-2024-36475 affects FutureNet NXR/VXR/WXR series by Century Systems. The issue is an active debug code that, if a user who knows how to use the debug function logs in, may be used to execute arbitrary OS commands. Sources consistently describe this as a debug-code vulnerability (CWE-489) with ...

CVE-2024-31070

Initialization of a resource with an insecure default vulnerability in FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. allows a remote unauthenticated attacker to access telnet service unlimitedly...

Command Execution Vulnerability in UFIDA NC Cloud at UFIDA Network Technology Co.

UFIDA NC Cloud is a large-scale enterprise digitalization platform launched by UFIDA Network Technology Co. A command execution vulnerability exists in UFIDA NC Cloud, which can be exploited by an attacker to execute arbitrary commands...

CVE-2024-40535

Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 was discovered to contain a stack overflow via the apnname3g parameter in the config3gpara function...

CVE-2024-40515

An issue in SHENZHEN TENDA TECHNOLOGY CO.,LTD Tenda AX2pro V16.03.29.48cn allows a remote attacker to execute arbitrary code via the Routing functionality...

CVE-2024-40425

File Upload vulnerability in Nanjin Xingyuantu Technology Co Sparkshop Spark Mall B2C Mall v.1.1.6 and before allows a remote attacker to execute arbitrary code via the contorller/common.php component...

KingH5Stream of Beijing Asian Control Technology Development Co. Ltd. suffers from a logic flaw vulnerability (CNVD-2024-35270)

Beijing Asian Control Technology Development Co., Ltd. is a high-tech enterprise founded in 1997 as a software platform for industrial automation and informatization. A logic flaw vulnerability exists in KingH5Stream of Beijing Asian Control Technology Development Co. Ltd, which can be exploited ...

CVE-2024-40425

File Upload vulnerability in Nanjin Xingyuantu Technology Co Sparkshop Spark Mall B2C Mall v.1.1.6 and before allows a remote attacker to execute arbitrary code via the contorller/common.php component...

CVE-2024-40425

The CVE-2024-40425 issue affects Spark Mall B2C Mall (Sparkshop) versions ≤ 1.1.6. The root cause is a file-upload vulnerability in the controller/common.php component that allows remote code execution. Impact is described as remote arbitrary code execution with high severity. While the public do...

CVE-2024-40425

File Upload vulnerability in Nanjin Xingyuantu Technology Co Sparkshop Spark Mall B2C Mall v.1.1.6 and before allows a remote attacker to execute arbitrary code via the contorller/common.php component...

CVE-2024-40516

An issue in H3C Technologies Co., Limited H3C Magic RC3000 RC3000V100R009 allows a remote attacker to execute arbitrary code via the Routing functionality...

SUSE CVE-2023-6917

A vulnerability has been identified in the Performance Co-Pilot PCP package, stemming from the mixed privilege levels utilized by systemd services associated with PCP. While certain services operate within the confines of limited PCP user/group privileges, others are granted full root privileges...

CVE-2024-38532

The NXP Data Co-Processor DCP is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cryptographic engine for encryption/decryption operations. The dcptool reference implementation included in the repository selected the test key, regardless of its -t argument. This...

CVE-2024-38532 TEST_KEY used in example dcp_tool reference implementation

The NXP Data Co-Processor DCP is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cryptographic engine for encryption/decryption operations. The dcptool reference implementation included in the repository selected the test key, regardless of its -t argument. This...