ABB Cylon Aspect 3.08.02 (CookieDB) SQL Injection

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The ABB BMS/BAS controller suffers from an SQL injection through the...

ABB Cylon Aspect 3.08.02 (ethernetUpdate.php) Authenticated Path Traversal

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The ABB Cylon controller suffers from an authenticated path traversal...

CVE-2024-13023

Summary (CVE-2024-13023) : The vulnerability affects PHPGurukul Maid Hiring Management System v1.0, in the file /admin/search-maid.php (Search Maid Page). The issue is caused by improper handling of the input parameter searchdata , enabling cross-site scripting (XSS). The attack can be initiated ...

CVE-2024-13015

A vulnerability was found in PHPGurukul Maid Hiring Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/search-booking-request.php. The manipulation of the argument searchdata leads to cross site scripting. The attack may be...

ABB Cylon Aspect 3.08.02 (clearProjectConfigurationAjax.php) File Deletion

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The BMS/BAS controller suffers from an arbitrary file deletion...

Oracle iStore 安全漏洞

Oracle iStore is an e-commerce product from Oracle Corporation USA. A security vulnerability exists in Oracle iStore. An attacker who exploits this vulnerability could gain access to critical data or full access to all Oracle iStore accessible data, as well as unauthorized update, insertion, or...

CVE-2024-53961

CVE-2024-53961 affects Adobe ColdFusion 2023.11, 2021.17 and earlier, due to an improper limitation of a pathname to a restricted directory (path traversal) that can lead to arbitrary file-system reads. Impact per sources: potential disclosure of sensitive files or data outside the intended direc...

CVE-2021-22501

Improper Restriction of XML External Entity Reference vulnerability in OpenText™ Operations Bridge Manager allows Input Data Manipulation. The vulnerability could be exploited to confidential information This issue affects Operations Bridge Manager: 2017.05, 2017.11, 2018.05, 2018.11, 2019.05,...

CVE-2021-22501

Improper Restriction of XML External Entity Reference vulnerability in OpenText™ Operations Bridge Manager allows Input Data Manipulation. The vulnerability could be exploited to confidential information This issue affects Operations Bridge Manager: 2017.05, 2017.11, 2018.05, 2018.11, 2019.05,...

CVE-2021-22501

OpenText Operations Bridge Manager is affected by CVE-2021-22501 due to an Improper Restriction of XML External Entity References. The vulnerability affects OpBridge Manager versions 2017.05 through 2020.10 and can lead to Input Data Manipulation with potential disclosure of confidential informat...

CVE-2021-22501

Improper Restriction of XML External Entity Reference vulnerability in OpenText™ Operations Bridge Manager allows Input Data Manipulation. The vulnerability could be exploited to confidential information This issue affects Operations Bridge Manager: 2017.05, 2017.11, 2018.05, 2018.11, 2019.05,...

CVE-2024-8475 Protection Mechanism Failure in Digital Operation Services' WiFiBurada

Authentication Bypass by Assumed-Immutable Data vulnerability in Digital Operation Services WiFiBurada allows Manipulating User-Controlled Variables. This issue affects WiFiBurada: before 1.0.5...

PT-2024-36624 · Unknown · Etemplates

Name of the Vulnerable Software and Affected Versions: eTemplates versions 0.2.1 and earlier Description: The issue is related to the improper neutralization of special elements used in an SQL command, allowing SQL injection. This problem can be exploited to inject SQL code, potentially leading t...

ABB Cylon Aspect 3.08.02 (editOverride.php) Authentication Bypass MIX Override

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The ABB Cylon Aspect BMS/BAS controller allows users to bypass...

Apache Superset 安全漏洞

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. A security vulnerability exists in Apache Superset versions prior to 4.1.0 that stems from improper authorization, which allows an attacker with SQLLab access to construct specially crafted SQL D...

Vulnerabilities fixed in Siemens products

Siemens has fixed vulnerabilities in several products such as COMOS, RUGGEDCOM, SENTRON, SICAM, SIMATIC and TeamCenter. The vulnerabilities potentially enable a malicious person to carry out attacks that can lead to the following categories of damage: - Denial-of-Service DoS - Cross-Site Scriptin...

Vulnerabilities fixed in SAP products

SAP has fixed vulnerabilities in SAP NetWeaver, ABAP, Web Dispatcher, Business Objects, HCM and Commerce Cloud. A malicious party can exploit the vulnerabilities to launch attacks that can lead to the following categories of damage: - Cross-Site Scripting XSS. - Server-Side Request Forgery SSRF. ...

CVE-2024-54149

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0.476 allow users with access to the CMS templates sections that modify Twig files to bypass the sandbox placed on Twig files and modify resources such...

CVE-2024-54149 Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0.476 allow users with access to the CMS templates sections that modify Twig files to bypass the sandbox placed on Twig files and modify resources such...

CVE-2024-54149

Winter CMS has a sandbox bypass in Twig templates that affects versions prior to 1.2.7, 1.1.11, and 1.0.476. If an attacker has backend access with cms.manage_layouts, cms.manage_pages, or cms.manage_partials, they can modify or delete theme resources and potentially manipulate model data passed ...