CVE-2024-0300 Byzoro Smart S150 Management Platform HTTP POST Request userattestation.php unrestricted upload

A vulnerability was found in Byzoro Smart S150 Management Platform up to 20240101. It has been rated as critical. Affected by this issue is some unknown functionality of the file /useratte/userattestation.php of the component HTTP POST Request Handler. The manipulation of the argument webimg lead...

CVE-2024-0300

CVE-2024-0300 affects Beijing Baichuo/ Byzoro Smart S150 Management Platform up to version 20240101. The issue lies in the HTTP POST Request Handler, specifically the /useratte/userattestation.php component, where manipulating the web_img (or web img) parameter enables unrestricted file upload. T...

CVE-2024-0300 Byzoro Smart S150 Management Platform HTTP POST Request userattestation.php unrestricted upload

A vulnerability was found in Byzoro Smart S150 Management Platform up to 20240101. It has been rated as critical. Affected by this issue is some unknown functionality of the file /useratte/userattestation.php of the component HTTP POST Request Handler. The manipulation of the argument webimg lead...

CVE-2023-50082

Aoyun Technology pbootcms V3.1.2 is vulnerable to Incorrect Access Control, allows remote attackers to gain sensitive information via session leakage allows a user to avoid logging into the backend management platform...

Improper access control

Aoyun Technology pbootcms V3.1.2 is vulnerable to Incorrect Access Control, allows remote attackers to gain sensitive information via session leakage allows a user to avoid logging into the backend management platform...

CVE-2023-50082

Aoyun Technology pbootcms V3.1.2 is vulnerable to Incorrect Access Control, allows remote attackers to gain sensitive information via session leakage allows a user to avoid logging into the backend management platform...

Client Details System SQL Injection Vulnerability

Client Details System is a management platform. A SQL injection vulnerability exists in Client Details System. No information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor's announcement...

Client Details System SQL Injection Vulnerability

Client Details System is a management platform. A SQL injection vulnerability exists in Client Details System. No information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor's announcement...

Client Details System SQL Injection Vulnerability

Client Details System is a management platform. A SQL injection vulnerability exists in Client Details System. No information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor's announcement...

CVE-2023-48382

The CVE-2023-48382 entry concerns Softnext Mail SQR Expert with a Local File Inclusion (LFI) vulnerability in a mail delivery URL. An unauthenticated attacker can exploit this to execute arbitrary PHP files with a .asp extension in certain system paths and access/modify partial system information...

CVE-2023-48381

CVE-2023-48381 relates to Softnext Mail SQR Expert, an email management platform, with a Local File Inclusion (LFI) flaw exposed via a special URL. The vulnerability lets an unauthenticated attacker cause the execution of arbitrary PHP files with a “.asp” extension under specific system paths, en...

CVE-2023-48379

Softnext Mail SQR Expert is an email management platform, it has inadequate filtering for a specific URL parameter within a specific function. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response...

Server side request forgery (ssrf)

Softnext Mail SQR Expert is an email management platform, it has inadequate filtering for a specific URL parameter within a specific function. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response...

SAP Solution Manager Command Injection Vulnerability

SAP Solution Manager is a set of system monitoring, SAP support desktop, self-service, ASAP implementation and other functions of the German SAP company as one of the system management platform. The platform can help customers establish SAP solution lifecycle management, and provide system...

Fedora: Security Advisory (FEDORA-2023-fbdb7e13df)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-47637 SQL Injection in Admin Grid Filter API in Pimcore

Pimcore is an Open Source Data & Experience Management Platform. In affected versions the /admin/object/grid-proxy endpoint calls getFilterCondition on fields of classes to be filtered for, passing input from the request, and later executes the returned SQL. One implementation of getFilterConditi...

CVE-2023-47637

Pimcore contains a SQL injection in the Admin Grid Filter API. In affected versions, the /admin/object/grid-proxy endpoint calls getFilterCondition() on class fields to build SQL from user input, and Multiselect’s implementation does not normalize/escape/validate that input. This allows any backe...

CVE-2023-5959

A vulnerability, which was classified as problematic, was found in Byzoro Smart S85F Management Platform V31R02B10-01. Affected is an unknown function of the file /login.php. The manipulation of the argument txtnewpwd leads to weak password recovery. The exploit has been disclosed to the public a...

CVE-2023-5959

A vulnerability, which was classified as problematic, was found in Byzoro Smart S85F Management Platform V31R02B10-01. Affected is an unknown function of the file /login.php. The manipulation of the argument txtnewpwd leads to weak password recovery. The exploit has been disclosed to the public a...

CVE-2023-5959

Summary: CVE-2023-5959 affects Byzoro Smart S85F Management Platform v31R02B10-01. The vulnerability is in an unknown function of /login.php where manipulating the txt_newpwd parameter leads to weak password recovery. Public disclosure is noted. The issue is described as a technical weakness rath...