190 matches found
CVE-2026-109171 yshop-crm through 2.1.3 Missing Authorization via /admin-api/crm/contract/check
yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject contracts by calling POST /admin-api/crm/contract/check. Because CrmContractController lacks @PreAuthorize and approver checks are commented out, attackers ca...
CVE-2026-109171
yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject contracts by calling POST /admin-api/crm/contract/check. Because CrmContractController lacks @PreAuthorize and approver checks are commented out, attackers ca...
EUVD-2026-47275
Vulnerability in the PeopleSoft Enterprise SCM Supplier Contract Management product of Oracle PeopleSoft component: Security. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise...
CVE-2026-61063
Vulnerability in the PeopleSoft Enterprise SCM Supplier Contract Management product of Oracle PeopleSoft component: Security. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise...
PT-2026-62952
Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft Enterprise SCM Supplier Contract Management version 9.2 Description A security flaw in the Security component allows a low-privileged attacker with access to the infrastructure where the software executes to compromise the...
CVE-2026-61063: Improper Privilege Management
Vulnerability in the PeopleSoft Enterprise SCM Supplier Contract Management product of Oracle PeopleSoft component: Security. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise...
EUVD-2025-34913
Enterprise Contract Management Portal v.22.4.0 is vulnerable to Stored Cross-Site Scripting XSS in its chat box component. This allows a remote attacker to execute arbitrary code...
CVE-2025-56320
CobbleStone Enterprise Contract Management Portal v.22.4.0 is vulnerable to Stored Cross-Site Scripting XSS in its chat box component. This allows a remote attacker to execute arbitrary code. NOTE: the Supplier reports that this is "Present only in an obsolete, unsupported version no longer in...
PT-2025-42634
Name of the Vulnerable Software and Affected Versions Enterprise Contract Management Portal version 22.4.0 Description The Enterprise Contract Management Portal version 22.4.0 is susceptible to Stored Cross-Site Scripting XSS within the chat box component. This allows a remote attacker to execute...
CVE-2025-56320
CobbleStone Enterprise Contract Management Portal v.22.4.0 is vulnerable to Stored Cross-Site Scripting XSS in its chat box component. This allows a remote attacker to execute arbitrary code. NOTE: the Supplier reports that this is "Present only in an obsolete, unsupported version no longer in...
CVE-2025-56320
Enterprise Contract Management Portal v.22.4.0 is vulnerable to Stored Cross-Site Scripting XSS in its chat box component. This allows a remote attacker to execute arbitrary code. NOTE: the Supplier reports that this is "Present only in an obsolete, unsupported version no longer in circulation."...
Cobblestone Enterprise Contract Management Software has security vulnerabilities
Cobblestone Enterprise Contract Management Software is an enterprise contract management software from Cobblestone Corporation, USA. A security vulnerability exists in Cobblestone Enterprise Contract Management Software version 22.4.0, which originates from the presence of stored cross-site...
CVE-2025-56320: Improper Neutralization of Input During Web Page Generation
CobbleStone Enterprise Contract Management Portal v.22.4.0 is vulnerable to Stored Cross-Site Scripting XSS in its chat box component. This allows a remote attacker to execute arbitrary code. NOTE: the Supplier reports that this is "Present only in an obsolete, unsupported version no longer in...
EUVD-2019-14090
Malware in sbrugna...
EUVD-2019-13915
Malware in sbrugna...
EUVD-2019-14092
Malware in sbrugna...
EUVD-2018-12540
Malware in sbrugna...
EUVD-2015-5059
Malware in sbrugna...
Agiloft security vulnerabilities
Agiloft is a contract management platform from Agiloft Corporation in the United States. A security vulnerability exists in Agiloft that stems from XML external entity injection and could lead to path traversal...
