CVE-2023-51927

YonBIP v323.05 was discovered to contain a SQL injection vulnerability via the com.yonyou.hrcloud.attend.web.AttendScriptController.runScript method...

CVE-2023-51927

YonBIP v323.05 was discovered to contain a SQL injection vulnerability via the com.yonyou.hrcloud.attend.web.AttendScriptController.runScript method...

PT-2024-14328

Name of the Vulnerable Software and Affected Versions YonBIP version 3 23.05 Description A SQL injection issue was discovered in YonBIP via the runScript method of the com.yonyou.hrcloud.attend.web.AttendScriptController class. This allows for potential exploitation. Recommendations For YonBIP...

VulnCheck KEV: CVE-2023-33831

A remote command execution RCE vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request...

CVE-2023-33831

A remote command execution RCE vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request...

CVE-2023-33831

A remote command execution RCE vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request...

CVE-2023-33831

CVE-2023-33831 affects FUXA 1.1.13 via the unauthenticated /api/runscript endpoint, enabling remote code execution through a crafted POST request. The underlying issue allows attackers to execute arbitrary commands, potentially compromising the SCADA/HMI system. Affected component: runscript API ...

FUXA Command Injection Vulnerability

FUXA is an open source web-based process visualization SCADA/HMI/Dashboard software. A security vulnerability exists in FUXA version 1.1.13, which stems from a Remote Command Execution RCE vulnerability in the /api/runscript endpoint. An attacker can exploit the vulnerability to execute arbitrary...

CVE-2023-33831

A remote command execution RCE vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request...

CVE-2023-33831

A remote command execution RCE vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request...

CVE-2023-33831: Improper Neutralization of Special Elements used in a Command

A remote command execution RCE vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request...

CVE-2023-33831

A remote command execution RCE vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request...

PT-2023-4830

Name of the Vulnerable Software and Affected Versions FUXA version 1.1.13 Description A remote command execution vulnerability in the "/api/runscript" endpoint allows attackers to execute arbitrary commands via a crafted POST request. This issue is related to the lack of input data sanitization,...

H2 Code Execution

The vulnerability of the H2 database management system is related to incorrect code generation management. Exploiting this vulnerability allows an attacker to execute arbitrary code using the jdbc:h2:mem function. The settings contained in this function are as follows: IGNOREUNKNOWNSETTINGS=TRUE;...

DEBIAN-CVE-2022-23221

H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNOREUNKNOWNSETTINGS=TRUE;FORBIDCREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392...

CVE-2022-23221: Improper Neutralization of Argument Delimiters in a Command

H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNOREUNKNOWNSETTINGS=TRUE;FORBIDCREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392...

PT-2022-2140

Name of the Vulnerable Software and Affected Versions H2 Console versions prior to 2.1.210 H2 Database Console affected versions not specified Description The issue is related to incorrect code generation management in the H2 database management system. It can be exploited by a remote attacker to...

CVE-2018-7764

The vulnerability exists within runscript.php applet in Schneider Electric U.motion Builder software versions prior to v1.3.4. There is a directory traversal vulnerability in the processing of the 's' parameter of the applet...

Schneider Electric U.motion Builder runscript directory traversal vulnerability

U.motion Builder is a builder product from Schneider Electric France. A directory traversal vulnerability exists in the Schneider Electric U.motion Builder runscript. When handling the 's' parameter of a small application. An attacker could exploit the vulnerability to expose files from the syste...

MUNGE: Privilege escalation

Background An authentication service for creating and validating credentials. Description It was discovered that Gentoo’s default MUNGE installation suffered from a privilege escalation vulnerability munge user to root due to improper permissions and a runscript which called chown on a user...