SportsNET SQL注入漏洞

SportsNET is a sports event network application from SportsNET, Inc. SportsNET suffers from a SQL injection vulnerability that can be exploited by an attacker to retrieve, update, and delete all information in the database via a specially crafted SQL query...

CVE-2024-45233

An issue was discovered in powermail extension through 12.3.5 for TYPO3. Several actions in the OutputController can directly be called, due to missing or insufficiently implemented access checks, resulting in Broken Access Control. Depending on the configuration of the Powermail Frontend plugins...

ROS-20240828-05

Vulnerability in the Connector/J component of the MySQL Connectors driver of the Oracle database management system MySQL exists due to insufficient input validation. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to read, modify, add or delete data...

CVE-2024-7913

A vulnerability was found in itsourcecode Billing System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /addclient1.php. The manipulation of the argument lname/fname/mi/address/contact/meterReader leads to sql injection. The attack may be initiated...

The vulnerability of the Allocation Rules component in the financial management tool of the Oracle Process Manufacturing Financials system, a part of the Oracle E-Business Suite. This vulnerability allows an intruder to gain unauthorized access to read, modify, or delete data.

The vulnerability of the Allocation Rules component in the financial management tool of the Oracle Process Manufacturing Financials system, part of the Oracle E-Business Suite, is related to insufficient protection of operational data. Exploiting this vulnerability could allow an attacker,...

Vulnerabilities fixed in SAP products

SAP has fixed vulnerabilities in various products such as SAP Business Objects, SAP HANA, Netweaver and Document Builder. A malicious party can exploit the vulnerabilities to launch attacks that can lead to the following categories of damage: - Server Side Request Forgery SSRF. - Cross-Site...

Vulnerabilities fixed in Siemens products

Siemens has fixed vulnerabilities in several products such as COMOS, INTRALOG, LOGO!, NX, SCALANCE, SINEC and Teamcenter. The vulnerabilities potentially enable a malicious person to carry out attacks that could lead to the following categories of damage: - Denial-of-Service DoS - Manipulation of...

CVE-2024-40476

A Cross-Site Request Forgery CSRF vulnerability was found in SourceCodester Best House Rental Management System v1.0. This could lead to an attacker tricking the administrator into adding/modifying/deleting valid tenant data via a crafted HTML page, as demonstrated by a Delete Tenant action at th...

Access Control Bypass

Shopware is vulnerable to Access Control Bypass. The vulnerability is due to improper handling of ManyToManyAssociationField in the Criteria processing via SalesChannelRepository.php, which allows attackers to bypass protections and potentially access or manipulate data through extensions...

Suspicious Minds: Insider Threats in The SaaS World

Everyone loves the double-agent plot twist in a spy movie, but it's a different story when it comes to securing company data. Whether intentional or unintentional, insider threats are a legitimate concern. According to CSA research, 26% of companies who reported a SaaS security incident were stru...

Gorush 安全漏洞

Gorush is a push notification server written in Go by Bo-Yi Wu, an individual developer. A security vulnerability exists in Gorush v1.18.4, which stems from the use of a deprecated version of TLS in the RunHTTPServer function. An attacker can use this vulnerability to intercept and manipulate dat...

CVE-2024-41270

CVE-2024-41270 affects Gorush (RunHTTPServer) in v1.18.4. The issue arises from using a deprecated TLS version, enabling an attacker to intercept and manipulate data. The connected sources (Red Hat, OSV, GHSA, Veracode, NVD, and related catalogs) consistently describe the same root cause and impa...

PYSEC-2024-73

A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as config.json and dsconfigchatbot.json. This issue arises due to improper validation of file paths, enabling...

Exploit for Insufficient Granularity of Access Control in Ibm Storage_Fusion_Hci

CVE-2023-43040 This repository contains a proof-of-concept ex...

NETGEAR ProSAFE Network Management System SQL Injection Vulnerability

NETGEAR ProSAFE Network Management System is a network management system. The NETGEAR ProSAFE Network Management System suffers from a SQL injection vulnerability that can be exploited by an attacker to submit a specially crafted SQL request to manipulate a database, obtain sensitive information,...

CVE-2020-11639

An attacker could exploit the vulnerability by injecting garbage data or specially crafted data. Depending on the data injected each process might be affected differently. The process could crash or cause communication issues on the affected node, effectively causing a denial-of-service attack. T...

K000140405: Multiple OpenJDK vulnerabilities

Security Advisory Description CVE-2024-21147 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1;...

PT-2024-28882 · Microsoft · Asp.Net Mvc

Name of the Vulnerable Software and Affected Versions: Hospital Management System Project in ASP.Net MVC version 1 Description: The issue allows a remote attacker to execute arbitrary code via the btn login b Click function of the Loginpage.aspx. This can potentially lead to unauthorized access a...

The vulnerability of the LOV component in terms of technical maintenance, repairs, and major overhauls of Oracle Complex Maintenance, Repair, and Overhaul systems—a system for automating business operations in Oracle E-Business Suite—allows a perpetrator to gain access to read, modify, add, or delete data.

The vulnerability of the LOV component in terms of technical maintenance, repairs, and major overhauls of Oracle system equipment exists due to insufficient verification of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to read, modify, add, or...

Vulnerabilities fixed in Solarwinds Platform

Vulnerabilities have been fixed in SolarWinds Access Rights Manager. A malicious party can exploit the vulnerabilities to launch attacks that can lead to the following categories of damage: Access to system data Access to sensitive data Manipulation of data Circumvention of security measure Remot...