CVE-2024-25529

The office automation system RuvarOA versions v6.01 and v12.01 is vulnerable to a SQL injection vulnerability. This issue stems from a lack of validation for externally entered SQL statements within the id parameter of the /WorkFlow/wf_office_file_history_show.aspx API endpoint. An attacker can e...

CVE-2024-25527

The RuvarOA office automation system, specifically versions v6.01 and v12.01 , is susceptible to a SQL injection vulnerability. The flaw exists in the /PersonalAffair/worklog_template_show.aspx file because the id parameter fails to properly validate externally entered SQL statements. An unauthen...

CVE-2024-25520

RuvarOA, an office automation system, versions 6.01 and 12.01 are susceptible to a SQL injection vulnerability. The root cause is the lack of validation for externally entered SQL statements via the id parameter at the /SysManage/sys_blogtemplate_new.aspx endpoint. An attacker can exploit this to...

CVE-2024-25527

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklogtemplateshow.aspx...

PT-2024-20989 · Ruvaroa · Ruvaroa

Name of the Vulnerable Software and Affected Versions: RuvarOA versions 6.01 through 12.01 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/PersonalAffair/worklog template show.aspx" API endpoint. Recommendations...

CVE-2024-25529: Improper Neutralization of Special Elements used in an SQL Command

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /WorkFlow/wfofficefilehistoryshow.aspx...

CVE-2024-25520: Improper Neutralization of Special Elements used in an SQL Command

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /SysManage/sysblogtemplatenew.aspx...

CVE-2024-25527: Improper Neutralization of Special Elements used in an SQL Command

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklogtemplateshow.aspx...

RuvarOA security vulnerabilities

RuvarOA is an office automation system of Ruvar China. A SQL injection vulnerability exists in RuvarOA v6.01 and v12.01, which originates from the id parameter of the /SysManage/sysblogtemplatenew.aspx file that lacks validation of externally entered SQL statements. An attacker can exploit this...

CVE-2024-25528: Improper Neutralization of Special Elements used in an SQL Command

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklogtemplateshow.aspx...

PT-2024-20981 · Ruvaroa · Ruvaroa

Name of the Vulnerable Software and Affected Versions: RuvarOA versions 6.01 through 12.01 Description: The issue is related to a SQL injection vulnerability. It can be exploited via the id parameter at the "/SysManage/sys blogtemplate new.aspx" API endpoint. Recommendations: For RuvarOA versions...

CVE-2024-25511

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/addresspublicnew.aspx...

CVE-2024-25508

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /bulletin/bulletintemplateshow.aspx...

CVE-2024-25508

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /bulletin/bulletintemplateshow.aspx...

CVE-2024-32370

An issue in HSC Cybersecurity HC Mailinspector 5.2.17-3 through 5.2.18 allows a remote attacker to obtain sensitive information via a crafted payload to the id parameter in the mliSystemUsers.php component...

CVE-2024-25508

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /bulletin/bulletintemplateshow.aspx...

CVE-2024-25508

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /bulletin/bulletintemplateshow.aspx...

PT-2024-24539 · Hsc Cybersecurity · Hc Mailinspector

Name of the Vulnerable Software and Affected Versions: HSC Cybersecurity HC Mailinspector versions 5.2.17-3 through 5.2.18 Description: An issue in HSC Cybersecurity HC Mailinspector allows a remote attacker to obtain sensitive information via a crafted payload to the id parameter in the...

PT-2024-20975 · Ruvaroa · Ruvaroa

Name of the Vulnerable Software and Affected Versions: RuvarOA versions 6.01 through 12.01 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the file id parameter at the "/CorporateCulture/kaizen download.aspx" API endpoint. Recommendation...

PT-2024-20971 · Ruvaroa · Ruvaroa

Name of the Vulnerable Software and Affected Versions: RuvarOA versions 6.01 through 12.01 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the sys file storage id parameter at the "/WorkFlow/wf file download.aspx" API endpoint...