88 matches found
CVE-2024-41367
RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution RCE vulnerability via htdocs\api\playlist\appendFileToPlaylist.php...
CVE-2024-41364
RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution RCE vulnerability via htdocs\trackEdit.php...
CVE-2024-36542
Insecure permissions in kuma v2.7.0 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...
CVE-2024-36542
Kuma CVE-2024-36542 affects Kuma v2.7.0 (and prior per sources) with insecure permissions causing exposure of the service account token, enabling attackers to access sensitive data and escalate privileges. Root cause: improper access control granting token access. CVSSv3.1 base score 8.8 (HIGH), ...
CVE-2024-36542
Insecure permissions in kuma v2.7.0 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...
CVE-2024-36542
Insecure permissions in kuma v2.7.0 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...
CVE-2024-41122
Woodpecker CI/CD engine vulnerability CVE-2024-41122 allows an attacker with user access to trigger malicious workflows that can either take over the host running the agent or exfiltrate secrets by overwriting plugin entry points. The issue is addressed in release version 2.7.0; upgrade is advise...
J2EEFAST BpmTaskFromMapper.xml File SQL Injection Vulnerability
J2eeFAST is a Java EE enterprise-class rapid development platform , is committed to building the best small and medium-sized open source free back-end framework platform . J2EEFAST v2.7.0 version of the SQL injection vulnerability , the vulnerability stems from the BpmTaskFromMapper.xml findPage...
CVE-2024-35090
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysUreportFileMapper.xml...
CVE-2024-35084
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysMsgPushMapper.xml...
CVE-2024-35082
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysOperLogMapper.xml...
CVE-2024-35085
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in ProcessDefinitionMapper.xml...
CVE-2024-35086
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in BpmTaskFromMapper.xml...
CVE-2024-35091
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysTenantMapper.xml...
CVE-2024-35091
CVE-2024-35091 affects J2EEFAST v2.7.0 via SysTenantMapper.xml findPage, where missing input-validation enables SQL injection. Root cause: lack of external-input SQL validation in the findPage function. Impact: potential exposure of sensitive database data; CVSS v3.1 base score 9.8 (NETWORK, HIGH...
CVE-2024-35084
CVE-2024-35084 affects J2EEFAST v2.7.0. The vulnerability is a SQL injection in SysMsgPushMapper.xml’s findPage function caused by lack of validation for external input SQL statements. Reported impact indicates high confidentiality, integrity, and availability risk (base score 9.8, CVSS3.1: AV:N/...
CVE-2024-35084
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysMsgPushMapper.xml...
CVE-2024-35090
Affected software: J2EEFAST v2.7.0. Vulnerability: SQL injection via the SysUreportFileMapper.xml findPage function. Root cause: lack of validation of external input SQL statements. Impact (as stated): Attacker could execute arbitrary SQL to steal sensitive database data. References in docs: Mult...
J2EEFAST list function SQL injection vulnerability
J2eeFAST is a Java EE enterprise-class rapid development platform , is committed to building the best small and medium-sized open source free back-end framework platform . J2EEFAST v2.7.0 version of the SQL injection vulnerability , the vulnerability stems from the list function of the sqlfilter...