EUVD-2022-39309

Malicious code in bioql PyPI...

AMSS++ 6.1 SQL Injection

==================================================================================================================================== | Title : AMSS++ V6.1 SQL injection Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 115.0.264-bit | |...

Path traversal

GE Digital Proficy iFIX 2022, GE Digital Proficy iFIX v6.1, and GE Digital Proficy iFIX v6.5 are vulnerable to code injection, which may allow an attacker to insert malicious configuration files in the expected web server execution path and gain full control of the HMI software...

GSD-2023-1001967 btrfs: qgroup: do not warn on record without old_roots populated

btrfs: qgroup: do not warn on record without oldroots populated This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.8 by commit...

GSD-2023-1001685 wifi: mac80211: fix initialization of rx->link and rx->link_sta

wifi: mac80211: fix initialization of rx-link and rx-linksta This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.8 by commit...

GSD-2023-1001683 proc: fix PIE proc-empty-vm, proc-pid-vm tests

proc: fix PIE proc-empty-vm, proc-pid-vm tests This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.8 by commit...

CVE-2022-38808

ywoa v6.1 is vulnerable to SQL Injection via backend/oa/visual/exportExcel.do interface...

Sql injection

ywoa v6.1 is vulnerable to SQL Injection via backend/oa/visual/exportExcel.do interface...

CVE-2022-38808

ywoa v6.1 is affected by a SQL injection in the backend/oa/visual/exportExcel.do endpoint. The vulnerability is documented across NVD/Red Hat and other feeds, indicating an input handling flaw that allows SQL injection. Impact is described as High (C/H, I/H, A/H) with network attack vector, low p...

CVE-2022-38808

ywoa v6.1 is vulnerable to SQL Injection via backend/oa/visual/exportExcel.do interface...

CVE-2022-36606

Ywoa before v6.1 was discovered to contain a SQL injection vulnerability via /oa/setup/checkPool?database...

CVE-2022-36605

Yimioa v6.1 was discovered to contain a SQL injection vulnerability via the orderbyGET parameter...

Sql injection

Yimioa v6.1 was discovered to contain a SQL injection vulnerability via the orderbyGET parameter...

CVE-2022-36606

CVE-2022-36606 affects Ywoa prior to v6.1 and is a SQL injection in the API endpoint /oa/setup/checkPool?database. The root cause is unparameterized input handling in the checkPool endpoint, enabling an attacker to perform unauthenticated remote SQL injection (high impact: C/H, I/H, A/H per NVD)....

CVE-2022-36605

CVE-2022-36605 concerns Yimioa v6.1, where a SQL injection vulnerability is exposed through the orderbyGET parameter. The vulnerability arises in user-controlled input that affects database queries, with the CVSS v3.1 base score of 9.8 (CRITICAL; Network attack vector, no user interaction require...

CVE-2022-36605

Yimioa v6.1 was discovered to contain a SQL injection vulnerability via the orderbyGET parameter...

CVE-2022-29363

Phpok v6.1 was discovered to contain a deserialization vulnerability via the updatef function in logincontrol.php. This vulnerability allows attackers to getshell via writing arbitrary files...

Deserialization of untrusted data

Phpok v6.1 was discovered to contain a deserialization vulnerability via the updatef function in logincontrol.php. This vulnerability allows attackers to getshell via writing arbitrary files...

CVE-2022-29363

CVE-2022-29363 affects Phpok v6.1, where a deserialization vulnerability in login_control.php:update_f() allows an attacker to write arbitrary files, enabling shell access (getshell). The issue is documented with high/critical impact (C/P/I/A = high/partial/high/partial; CVSS 3.1 base score 9.8)....

CVE-2022-29363

Phpok v6.1 was discovered to contain a deserialization vulnerability via the updatef function in logincontrol.php. This vulnerability allows attackers to getshell via writing arbitrary files...