PT-2022-24679 · U-Office · U-Office

Name of the Vulnerable Software and Affected Versions: U-Office affected versions not specified Description: The U-Office Force Download function contains a path traversal issue. This allows a remote attacker with general user privileges to exploit the issue and download arbitrary system files...

e-Excellence U-Office Force 跨站脚本漏洞

e-Excellence U-Office Force is an e-Office platform from China's First Class Technology e-Excellence. U-Office Force suffers from a cross-site scripting vulnerability that stems from insufficient filtering of special characters in its Forum feature, which allows an unauthenticated, remote attacke...

PT-2022-24680 · U-Office · U-Office

Name of the Vulnerable Software and Affected Versions: U-Office affected versions not specified Description: The issue is related to insufficient filtering for special characters in the Force Bulletin function, allowing an unauthenticated remote attacker to inject JavaScript and perform a Reflect...

PT-2022-24681 · U-Office · U-Office

Name of the Vulnerable Software and Affected Versions: U-Office affected versions not specified Description: The issue is related to insufficient filtering for special characters in the Force PrintMessage function. This allows an unauthenticated remote attacker to inject JavaScript, potentially...

e-Excellence U-Office Force 跨站脚本漏洞

e-Excellence U-Office Force is an e-Office platform from China's First Class Technology e-Excellence. U-Office Force suffers from a cross-site scripting vulnerability that stems from an insufficient filtering of special characters in its PrintMessage feature, which could allow an unauthenticated,...

e-Excellence U-Office Force 跨站脚本漏洞

e-Excellence U-Office Force is an e-Office platform from China's First Class Technology e-Excellence. U-Office Force suffers from a cross-site scripting vulnerability that stems from insufficient filtering of special characters in HTTP header fields on its UserDefault page, which could allow an...

e-Excellence U-Office Force 路径遍历漏洞

e-Excellence U-Office Force is an e-Office platform from China's First Class Technology e-Excellence. U-Office Force suffers from a path traversal vulnerability, which arises from its download feature that allows a remote attacker with common privileges to traverse the path and download arbitrary...

e-Excellence U-Office Force 跨站脚本漏洞

e-Excellence U-Office Force is an e-Office platform from China's First Class Technology e-Excellence. U-Office Force suffers from a cross-site scripting vulnerability that stems from insufficient filtering of special characters in its Buletin feature, which allows an unauthenticated, remote...

e-Excellence U-Office Force 路径遍历漏洞

e-Excellence U-Office Force is an e-Office platform from China's First Class Technology e-Excellence. U-Office Force suffers from a path traversal vulnerability, which arises from its download feature that allows a remote attacker with common privileges to traverse the path and download arbitrary...

PT-2022-24683 · U-Office · U-Office

Name of the Vulnerable Software and Affected Versions: U-Office affected versions not specified Description: The issue concerns insufficient filtering for special characters in the Force Forum function, allowing a remote attacker with general user privileges to inject JavaScript. This enables the...

CVE-2022-39027: Improper Neutralization of Input During Web Page Generation

U-Office Force Forum function has insufficient filtering for special characters. A remote attacker with general user privilege can inject JavaScript and perform XSS Stored Cross-Site Scripting attack...

CVE-2022-39026: Improper Neutralization of Input During Web Page Generation

U-Office Force UserDefault page has insufficient filtering for special characters in the HTTP header fields. A remote attacker with general user privilege can exploit this vulnerability to inject JavaScript and perform XSS Stored Cross-Site Scripting attack...

CVE-2022-39024: Improper Neutralization of Input During Web Page Generation

U-Office Force Bulletin function has insufficient filtering for special characters. An unauthenticated remote attacker can exploit this vulnerability to inject JavaScript and perform XSS Reflected Cross-Site Scripting attack...

CVE-2022-39023: Improper Limitation of a Pathname to a Restricted Directory

U-Office Force Download function has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability to download arbitrary system file...

CVE-2022-39022: Improper Limitation of a Pathname to a Restricted Directory

U-Office Force Download function has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability to download arbitrary system file...

PT-2022-24677 · U-Office · U-Office

Name of the Vulnerable Software and Affected Versions: U-Office affected versions not specified Description: The U-Office Force login function has an issue that allows an unauthenticated remote attacker to redirect users to an arbitrary website. Recommendations: At the moment, there is no...

PT-2022-24682 · U-Office · U-Office

Name of the Vulnerable Software and Affected Versions: U-Office affected versions not specified Description: The issue is related to insufficient filtering for special characters in the HTTP header fields of the UserDefault page. This allows a remote attacker with general user privilege to inject...

golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension

A flaw was found in golang.org. In x/text, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension...

Abode Systems, Inc. iota All-In-One Security Kit web interface util_set_serial_mac OS command injection vulnerability

Talos Vulnerability Report TALOS-2022-1566 Abode Systems, Inc. iota All-In-One Security Kit web interface utilsetserialmac OS command injection vulnerability October 20, 2022 CVE Number CVE-2022-29472 SUMMARY An OS command injection vulnerability exists in the web interface utilsetserialmac...

OESA-2022-1978 uboot-tools security update

This package includes the mkimage program, which allows generation of U-Boot images in various formats, and the fwprintenv and fwsetenv programs to read and modify U-Boot's environment. Security Fixes: nfslookupreply in net/nfs.c in Das U-Boot through 2022.04 and through 2022.07-rc2 has an...