931 matches found
PT-2025-34221 · Jsherp · Jsherp
Name of the Vulnerable Software and Affected Versions: jshERP version 3.5 Description: An incorrect access control issue exists in the controllerRoleController.java component of jshERP version 3.5. This allows unauthorized attackers to arbitrarily modify the supplier status under any account...
CVE-2025-55368
Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account...
CVE-2025-42934 CRLF Injection vulnerability in SAP S/4HANA (Supplier invoice)
SAP S/4HANA Supplier invoice is vulnerable to CRLF Injection. An attacker with user-level privileges can bypass the allowlist and insert untrusted sites into the 'Trusted Sites' configuration by injecting line feed LF characters into application inputs. This vulnerability has a low impact on the...
CVE-2025-42934 CRLF Injection vulnerability in SAP S/4HANA (Supplier invoice)
SAP S/4HANA Supplier invoice is vulnerable to CRLF Injection. An attacker with user-level privileges can bypass the allowlist and insert untrusted sites into the 'Trusted Sites' configuration by injecting line feed LF characters into application inputs. This vulnerability has a low impact on the...
PT-2025-32600 · Sap · Sap S/4Hana
Name of the Vulnerable Software and Affected Versions: SAP S/4HANA affected versions not specified Description: SAP S/4HANA Supplier invoice is vulnerable to CRLF Injection. An attacker with user-level privileges can bypass the allowlist and insert untrusted sites into the 'Trusted Sites'...
CVE-2025-45765
ruby-jwt v3.0.0.beta1 was discovered to contain weak encryption. NOTE: the Supplier's perspective is "keysize is not something that is enforced by this library. Currently more recent versions of OpenSSL are enforcing some key sizes and those restrictions apply to the users of this gem also."...
Wear OS Security Bulletin—August 2025Stay organized with collectionsSave and categorize content based on your preferences.
The Wear OS Security Bulletin contains details of security vulnerabilities affecting the Wear OS platform. The full Wear OS update comprises the security patch level of 2025-08-05 or later from the August 2025 Android Security Bulletin in addition to all issues in this bulletin. We encourage all...
Android Automotive OS Update Bulletin—August 2025Stay organized with collectionsSave and categorize content based on your preferences.
The Android Automotive OS AAOS Update Bulletin contains details of security vulnerabilities affecting the Android Automotive OS platform. The full AAOS update comprises the security patch level of 2025-08-05 or later from the August 2025 Android Security Bulletin in addition to all issues in this...
SUSE CVE-2025-45768
pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement...
PYSEC-2025-183
pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement...
UBUNTU-CVE-2025-45768
pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement...
CVE-2025-46059
langchain-ai v0.3.51 was discovered to contain an indirect prompt injection vulnerability in the GmailToolkit component. This vulnerability allows attackers to execute arbitrary code and compromise the application via a crafted email message. NOTE: this is disputed by the Supplier because the...
SUSE CVE-2025-54314
Thor before 1.4.0 can construct an unsafe shell command from library input. NOTE: this is disputed by the Supplier because "the method that was fixed can only be used with arguments that are controlled by Thor, and there is no way an attacker can take control of those arguments."...
CVE-2025-7193
A vulnerability was found in itsourcecode Agri-Trading Online Shopping System up to 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/suppliercontroller.php. The manipulation of the argument supplier leads to sql injection. It is possible to launch the...
itsourcecode Agri-Trading Online Shopping System 注入漏洞
itsourcecode Agri-Trading Online Shopping System is itsourcecode open source an online shopping system . Itsourcecode Agri-Trading Online Shopping System 1.0 and earlier versions have an injection vulnerability, the vulnerability stems from improper manipulation of the parameter supplier in the...
CVE-2024-8344
A vulnerability has been found in Campcodes Supplier Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/editarea.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The...
CVE-2024-7787
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in ITG Computer Technology vSRM Supplier Relationship Management System allows Reflected XSS, Cross-Site Scripting XSS. This issue affects vSRM Supplier Relationship Management System: before...
CVE-2024-22627
Complete Supplier Management System v1.0 is vulnerable to SQL Injection via /SupplyManagementSystem/admin/editdistributor.php?id=...