MicroWorld eScan Management Console SQL注入漏洞

MicroWorld eScan Management Console is a control panel from MicroWorld Japan. It helps system administrators remotely manage all eScan client computers on a network. A security vulnerability exists in MicroWorld eScan Management Console version 14.0.1400.2281, which stems from the presence of SQL...

CVE-2023-31702

SQL injection in the View User Profile in MicroWorld eScan Management Console 14.0.1400.2281 allows remote attacker to dump entire database and gain windows XP command shell to perform code execution on database server via GetUserCurrentPwd?UsrId=1...

CVE-2023-31703

Cross Site Scripting XSS in the edit user form in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker to inject arbitrary code via the from parameter...

PT-2023-23423 · Escan · Escan

Name of the Vulnerable Software and Affected Versions: eScan management console version 14.0.1400.2281 Description: The issue is related to Cross Site Scripting XSS in the edit user form, allowing a remote attacker to inject arbitrary code via the from parameter. This enables the attacker to...

PT-2023-23422 · Microworld · Microworld Escan Management Console

Name of the Vulnerable Software and Affected Versions: MicroWorld eScan Management Console version 14.0.1400.2281 Description: The issue allows a remote attacker to perform SQL injection in the View User Profile feature, enabling them to dump the entire database and gain a Windows XP command shel...

CVE-2022-41610

Improper authorization in IntelR EMA Configuration Tool before version 1.0.4 and IntelR MC before version 2.4 software may allow an authenticated user to potentially enable denial of service via local access...

PT-2023-14141 · Nozomi Networks · Nozomi Networks Guardian +1

Name of the Vulnerable Software and Affected Versions: Nozomi Networks Guardian and CMC affected versions not specified Description: The issue is caused by improper input validation in the Alerts controller, allowing an authenticated attacker to execute arbitrary SQL queries on the DBMS used by t...

Authenticated SQL Injection on Alerts in Guardian/CMC before 22.5.2

Summary A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the Alerts controller, allows an authenticated attacker to execute arbitrary SQL queries on the DBMS used by the web application. Impact Authenticated users can extract arbitrary...

API server of TONE Family vulnerable to authentication bypass using an alternate path

Overview API server of TONE Family provided by DREAM TRAIN INTERNET INC. contains an authentication bypass vulnerability using an alternate path CWE-288. Kodai Karakawa reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnershi...

CVE-2023-24464

Stored-cross-site scripting vulnerability in Buffalo network devices allows an attacker with access to the web management console of the product to execute arbitrary JavaScript on a legitimate user's web browser. The affected products and versions are as follows: BS-GS2008 firmware Ver. 1.0.10.01...

CVE-2023-24464

Stored-cross-site scripting vulnerability in Buffalo network devices allows an attacker with access to the web management console of the product to execute arbitrary JavaScript on a legitimate user's web browser. The affected products and versions are as follows: BS-GS2008 firmware Ver. 1.0.10.01...

CVE-2023-24464

CVE-2023-24464 is a stored cross-site scripting vulnerability in Buffalo network devices (BS-GS2008/2016/2024/2048 and their “P” variants; firmware 1.0.10.01 and earlier). The underlying issue is a stored XSS in the web management console that allows an attacker with access to the management UI t...

PT-2023-19622 · Unknown +4 · Bs-Gs2024P +5

Name of the Vulnerable Software and Affected Versions: BS-GS2008 firmware versions 1.0.10.01 and earlier BS-GS2016 firmware versions 1.0.10.01 and earlier BS-GS2024 firmware versions 1.0.10.01 and earlier BS-GS2048 firmware versions 1.0.10.01 and earlier BS-GS2008P firmware versions 1.0.10.01 and...

IBM WebSphere Application Server 跨站脚本漏洞

IBM WebSphere Application Server WAS is an application server product from International Business Machines IBM. The product is a platform for JavaEE and Web services applications and is the foundation of the IBM WebSphere software platform. A cross-site scripting vulnerability exists in IBM...

The vulnerability of the Central Management Console (CMC) of the SAP Business Objects Business Intelligence Platform allows a perpetrator to execute arbitrary code and gain unauthorized access to protected information.

The vulnerability of the Adaptive Job Server server of the SAP Business Objects Business Intelligence Platform is related to incorrect elimination of certain elements in the output data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using the BI LaunchPad...

The vulnerability of the Central Management Console (CMC) of the SAP Business Objects Business Intelligence Platform allows a perpetrator to execute arbitrary code and gain unauthorized access to protected information.

The vulnerability of the Central Management Console CMC of the SAP Business Objects Business Intelligence Platform relates to incorrect elimination of special elements in output data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code and gain unauthorized access to...

GHSA-XXHH-59GH-6FFX SAP Cloud SDK for AI Python has OS Command Injection when Program Objects Execution is Enabled

SAP Business Object Adaptive Job Server - versions 420, 430, allows remote execution of arbitrary commands on Unix, when program objects execution is enabled, to authenticated users with scheduling rights, using the BI Launchpad, Central Management Console or a custom application based on the...

CVE-2023-25617

SAP Business Object Adaptive Job Server - versions 420, 430, allows remote execution of arbitrary commands on Unix, when program objects execution is enabled, to authenticated users with scheduling rights, using the BI Launchpad, Central Management Console or a custom application based on the...

CVE-2023-25617

SAP Business Object Adaptive Job Server - versions 420, 430, allows remote execution of arbitrary commands on Unix, when program objects execution is enabled, to authenticated users with scheduling rights, using the BI Launchpad, Central Management Console or a custom application based on the...

PYSEC-2023-315

SAP Business Object Adaptive Job Server - versions 420, 430, allows remote execution of arbitrary commands on Unix, when program objects execution is enabled, to authenticated users with scheduling rights, using the BI Launchpad, Central Management Console or a custom application based on the...