Xxe

A vulnerability classified as problematic was found in Weaver e-cology up to 9.0. Affected by this vulnerability is the function RequestInfoByXml of the component API. The manipulation leads to xml external entity reference. The associated identifier of this vulnerability is VDB-229411. NOTE: The...

CVE-2023-2806 Weaver e-cology API RequestInfoByXml xml external entity reference

A vulnerability classified as problematic was found in Weaver e-cology up to 9.0. Affected by this vulnerability is the function RequestInfoByXml of the component API. The manipulation leads to xml external entity reference. The associated identifier of this vulnerability is VDB-229411. NOTE: The...

CVE-2023-2806

CVE-2023-2806 affects Weaver e-cology up to v9.0, specifically the API component’s function RequestInfoByXml . The issue is an XML External Entity (XXE) reference caused by improper restrictions on XML links to external objects, enabling a malicious XML request to read, modify, or delete data. Mu...

CVE-2023-2806 Weaver e-cology API RequestInfoByXml xml external entity reference

A vulnerability classified as problematic was found in Weaver e-cology up to 9.0. Affected by this vulnerability is the function RequestInfoByXml of the component API. The manipulation leads to xml external entity reference. The associated identifier of this vulnerability is VDB-229411. NOTE: The...

Weaver e-cology 代码问题漏洞

Weaver e-cology is a collaborative management application platform from China's Panmicro Technology Weaver. A code issue vulnerability exists in Weaver e-cology versions prior to 9.0, which stems from a security issue in the function RequestInfoByXml in the component API, resulting in xml externa...

CVE-2023-2765

A vulnerability has been found in Weaver OA up to 9.5 and classified as problematic. This vulnerability affects unknown code of the file /E-mobile/App/System/File/downfile.php. The manipulation of the argument url leads to absolute path traversal. The attack can be initiated remotely. The exploit...

CVE-2023-2766

A vulnerability was found in Weaver OA 9.5 and classified as problematic. This issue affects some unknown processing of the file /building/backmgr/urlpage/mobileurl/configfile/jx2config.ini. The manipulation leads to files or directories accessible. The attack may be initiated remotely. The explo...

CVE-2023-2766

A vulnerability was found in Weaver OA 9.5 and classified as problematic. This issue affects some unknown processing of the file /building/backmgr/urlpage/mobileurl/configfile/jx2config.ini. The manipulation leads to files or directories accessible. The attack may be initiated remotely. The explo...

CVE-2023-2765

A vulnerability has been found in Weaver OA up to 9.5 and classified as problematic. This vulnerability affects unknown code of the file /E-mobile/App/System/File/downfile.php. The manipulation of the argument url leads to absolute path traversal. The attack can be initiated remotely. The exploit...

Design/Logic Flaw

A vulnerability was found in Weaver OA 9.5 and classified as problematic. This issue affects some unknown processing of the file /building/backmgr/urlpage/mobileurl/configfile/jx2config.ini. The manipulation leads to files or directories accessible. The attack may be initiated remotely. The explo...

CVE-2023-2766 Weaver OA jx2_config.ini file access

A vulnerability was found in Weaver OA 9.5 and classified as problematic. This issue affects some unknown processing of the file /building/backmgr/urlpage/mobileurl/configfile/jx2config.ini. The manipulation leads to files or directories accessible. The attack may be initiated remotely. The explo...

CVE-2023-2766

Weaver OA 9.5 is affected by CVE-2023-2766, caused by processing of the file /building/backmgr/urlpage/mobileurl/configfile/jx2_config.ini that can lead to files or directories becoming accessible. The issue is exploitable remotely and has public disclosures noted in multiple sources (e.g., NVD a...

CVE-2023-2765

Summary: CVE-2023-2765 affects Weaver OA up to v9.5. The vulnerability is in /E-mobile/App/System/File/downfile.php where manipulating the url parameter causes absolute path traversal, exploitable remotely. Public exploitation has been disclosed; no official patch/version fix details are provided...

CVE-2023-2765 Weaver OA downfile.php absolute path traversal

A vulnerability has been found in Weaver OA up to 9.5 and classified as problematic. This vulnerability affects unknown code of the file /E-mobile/App/System/File/downfile.php. The manipulation of the argument url leads to absolute path traversal. The attack can be initiated remotely. The exploit...

PT-2023-21283 · Weaver Oa · Weaver Oa

Name of the Vulnerable Software and Affected Versions: Weaver OA versions up to 9.5 Description: A problematic issue has been found in the file /E-mobile/App/System/File/downfile.php, where the manipulation of the url argument leads to absolute path traversal. This can be initiated remotely. The...

PT-2023-21290 · Weaver Oa · Weaver Oa

Name of the Vulnerable Software and Affected Versions: Weaver OA version 9.5 Description: A vulnerability was found in the processing of the file /building/backmgr/urlpage/mobileurl/configfile/jx2 config.ini, which can lead to files or directories being made accessible. The attack may be initiate...

PT-2023-2925

Name of the Vulnerable Software and Affected Versions Weaver e-cology versions up to 9.0 Description A problematic vulnerability was found in the RequestInfoByXml function of the API component, leading to xml external entity reference. This issue is related to incorrect restriction of XML links t...

Weaver E-Office 安全漏洞

Weaver E-Office is a collaborative office system from China's PanWei Technologies Weaver. A security vulnerability exists in Weaver E-Office version 9.5 and earlier versions, which is caused by an incorrect operation of the parameter url that results in absolute path traversal...

Weaver E-Office 安全漏洞

Weaver E-Office is a collaborative office system from China's Panavision Technologies Weaver. A security vulnerability exists in Weaver E-Office version 9.5. An attacker can exploit the vulnerability to access files or directories...

CVE-2023-2648

A vulnerability was found in Weaver E-Office 9.5. It has been classified as critical. This affects an unknown part of the file /inc/jquery/uploadify/uploadify.php. The manipulation of the argument Filedata leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit h...