CVE-2023-2738

Tongda OA 11.10 is affected by CVE-2023-2738 via the actionGetdata function in GatewayController.php, enabling unrestricted file upload. The issue can be exploited remotely and the exploit has been publicly disclosed. Connected sources also note that a practical workaround exists: temporarily dis...

CVE-2023-2738 Tongda OA GatewayController.php actionGetdata unrestricted upload

A vulnerability classified as critical has been found in Tongda OA 11.10. This affects the function actionGetdata of the file GatewayController.php. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may ...

PT-2023-21085 · Tongda Oa · Tongda Oa

Name of the Vulnerable Software and Affected Versions: Tongda OA version 11.10 Description: A critical vulnerability has been found in Tongda OA, affecting the actionGetdata function of the GatewayController.php file. This vulnerability leads to unrestricted upload and can be initiated remotely...

CVE-2023-26986

An issue in China Mobile OA Mailbox PC v2.9.23 allows remote attackers to execute arbitrary commands on a victim host via user interaction with a crafted EML file sent to their OA mailbox...

Design/Logic Flaw

An issue in China Mobile OA Mailbox PC v2.9.23 allows remote attackers to execute arbitrary commands on a victim host via user interaction with a crafted EML file sent to their OA mailbox...

CVE-2023-26986

CVE-2023-26986 affects China Mobile OA Mailbox PC v2.9.23. A vulnerability in the mail component allows an attacker to cause arbitrary commands to run on a victim host when a user interacts with a crafted EML file sent to the OA mailbox. The CVSS base metrics in the entry indicate high impact to ...

PT-2023-20889 · China Mobile · China Mobile Oa Mailbox Pc

Name of the Vulnerable Software and Affected Versions: China Mobile OA Mailbox PC version 2.9.23 Description: An issue in China Mobile OA Mailbox PC allows remote attackers to execute arbitrary commands on a victim host via user interaction with a crafted EML file sent to their OA mailbox...

China Mobile OA Mailbox PC 安全漏洞

China Mobile OA Mailbox PC is a mailbox related application from China Mobile China. A security vulnerability exists in China Mobile OA Mailbox PC version v2.9.23, which can be exploited by an attacker to send a crafted EML file to a user's OA mailbox, and when the user clicks on the interaction,...

CVE-2023-26986

An issue in China Mobile OA Mailbox PC v2.9.23 allows remote attackers to execute arbitrary commands on a victim host via user interaction with a crafted EML file sent to their OA mailbox...

Siemens SIMATIC WinCC OA Ultralight Client Parameter Injection Vulnerability

SIMATIC WinCC Open Architecture OA is part of the SIMATIC HMI family. It is designed for applications that require a high degree of customer-specific adaptability, large or complex applications, and projects that require specific system requirements or functionality. A parameter injection...

CVE-2022-44731

A vulnerability has been identified in SIMATIC WinCC OA V3.15 All versions V3.15 P038, SIMATIC WinCC OA V3.16 All versions V3.16 P035, SIMATIC WinCC OA V3.17 All versions V3.17 P024, SIMATIC WinCC OA V3.18 All versions V3.18 P014. The affected component allows to inject custom arguments to the...

Code injection

A vulnerability has been identified in SIMATIC WinCC OA V3.15 All versions V3.15 P038, SIMATIC WinCC OA V3.16 All versions V3.16 P035, SIMATIC WinCC OA V3.17 All versions V3.17 P024, SIMATIC WinCC OA V3.18 All versions V3.18 P014. The affected component allows to inject custom arguments to the...

PT-2022-27287 · Siemens · Simatic Wincc

Name of the Vulnerable Software and Affected Versions: SIMATIC WinCC OA versions prior to V3.15 P038 SIMATIC WinCC OA versions prior to V3.16 P035 SIMATIC WinCC OA versions prior to V3.17 P024 SIMATIC WinCC OA versions prior to V3.18 P014 Description: A vulnerability allows injecting custom...

CVE-2022-44731

A vulnerability has been identified in SIMATIC WinCC OA V3.15 All versions V3.15 P038, SIMATIC WinCC OA V3.16 All versions V3.16 P035, SIMATIC WinCC OA V3.17 All versions V3.17 P024, SIMATIC WinCC OA V3.18 All versions V3.18 P014. The affected component allows to inject custom arguments to the...

CVE-2022-44731

A vulnerability has been identified in SIMATIC WinCC OA V3.15 All versions V3.15 P038, SIMATIC WinCC OA V3.16 All versions V3.16 P035, SIMATIC WinCC OA V3.17 All versions V3.17 P024, SIMATIC WinCC OA V3.18 All versions V3.18 P014. The affected component allows to inject custom arguments to the...

CVE-2022-44731

The CVE-2022-44731 vulnerability affects Siemens SIMATIC WinCC OA Ultralight Client. The Ultralight Client backend can be injected with custom arguments under certain conditions when started via the web interface, enabling an authenticated remote attacker to inject parameters (e.g., open attacker...

Vulnerabilities fixed in Siemens products

Siemens has fixed vulnerabilities in Mendix, among others, Nucleus NET, RUGGEDCOM, SCALANCE, SICAM, SIMATIC, SIPROTEC and SIMATIC WinCC-OA. The vulnerabilities allow a malicious potentially able to launch attacks that result in the following categories of damage: Cross-Site Request Forgery XSRF...

Arbitrary File Download Vulnerability in Huatian Power OA System

Huatian Power OA system is a collaborative office software developed by Dalian Huatian Software Co. The Huatian Power OA system suffers from an arbitrary file download vulnerability, which can be exploited by attackers to obtain sensitive information...

SQL Injection Vulnerability in Huatian Power OA System

Huatian Power OA system is a collaborative office software developed by Dalian Huatian Software Co. The Huatian Power OA system suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...

File Upload Vulnerability in Huatian Power OA System (CNVD-2022-83472)

Huatian Power OA system is a collaborative office software developed by Dalian Huatian Software Co. A file upload vulnerability exists in the Huatian Power OA system, which can be exploited by an attacker to upload arbitrary files...