60 matches found
CVE-2022-27434
CVE-2022-27434 UNIT4 TETA Mobile Edition 29HF13 was discovered to contain a SQL injection vulnerability via the ProfileName parameter in the errorReporting page. The vulnerability exist in the error page generated by the application in this case: while changing password. Adding quotation mark to...
CVE-2022-27434
UNIT4 TETA Mobile Edition ME before 29.5.HF17 was discovered to contain a SQL injection vulnerability via the ProfileName parameter in the errorReporting page...
EUVD-2015-1316
Malware in sbrugna...
EUVD-2015-2192
Malware in sbrugna...
EUVD-2022-31937
Malicious code in bioql PyPI...
EUVD-2022-37034
Malicious code in bioql PyPI...
CVE-2024-28734
Cross Site Scripting vulnerability in Unit4 Financials by Coda prior to 2023Q4 allows a remote attacker to run arbitrary code via a crafted GET request using the cols parameter...
CVE-2024-28735
Unit4 Financials by Coda versions prior to 2023Q4 suffer from an incorrect access control authorization bypass vulnerability which allows an authenticated user to modify the password of any user of the application via a crafted request...
CVE-2022-34001
Unit4 ERP through 7.9 allows XXE via ExecuteServerProcessAsynchronously...
VulnCheck KEV: CVE-2024-28734
Cross Site Scripting vulnerability in Unit4 Financials by Coda prior to 2023Q4 allows a remote attacker to run arbitrary code via a crafted GET request using the cols parameter...
CVE-2024-28735
Unit4 Financials by Coda versions prior to 2023Q4 suffer from an incorrect access control authorization bypass vulnerability which allows an authenticated user to modify the password of any user of the application via a crafted request...
CVE-2024-28735
Unit4 Financials by Coda versions prior to 2023Q4 suffer from an incorrect access control authorization bypass vulnerability which allows an authenticated user to modify the password of any user of the application via a crafted request...
CVE-2024-28735
Unit4 Financials by Coda versions prior to 2023Q4 suffer from an incorrect access control authorization bypass vulnerability which allows an authenticated user to modify the password of any user of the application via a crafted request...
PT-2024-22548
Name of the Vulnerable Software and Affected Versions Unit4 Financials by Coda versions prior to 2023Q4 Description The issue is related to an incorrect access control authorization bypass, allowing an authenticated user to modify the password of any user of the application via a crafted request...
CVE-2024-28735: Improper Authentication
Unit4 Financials by Coda versions prior to 2023Q4 suffer from an incorrect access control authorization bypass vulnerability which allows an authenticated user to modify the password of any user of the application via a crafted request...
CVE-2024-28735
Unit4 Financials by Coda versions prior to 2023Q4 are susceptible to an incorrect access control authorization bypass vulnerability. An authenticated user with a valid account—regardless of their profile—can modify the password of any other user in the application by sending a crafted POST reques...
CVE-2024-28734
Cross Site Scripting vulnerability in Unit4 Financials by Coda prior to 2023Q4 allows a remote attacker to run arbitrary code via a crafted GET request using the cols parameter...
PT-2024-22547 · Unit4 · Unit4 Financials
Name of the Vulnerable Software and Affected Versions: Unit4 Financials by Coda versions prior to 2023Q4 Description: The issue allows a remote attacker to run arbitrary code via a crafted GET request using the cols parameter. This enables the attacker to potentially escalate privileges...
CVE-2024-28734
A Cross-Site Scripting (XSS) vulnerability exists in Unit4 Financials by Coda versions prior to 2023Q4 . A remote attacker can exploit this by sending a crafted GET request using the cols parameter. This flaw allows the execution of arbitrary scripts in a user's browser, which can lead to privile...
CVE-2024-28734: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability in Unit4 Financials by Coda prior to 2023Q4 allows a remote attacker to run arbitrary code via a crafted GET request using the cols parameter...