CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows attackers to obtain sensitive information via the User Name field.
AFFECTED_PRODUCTS:
Sesami Cash Point \& Transport Optimizer
Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.
AFFECTED_PRODUCTS:
Hihonor Magic Os
Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.
AFFECTED_PRODUCTS:
Hihonor Magic Os
Some Honor products are affected by out of bounds read vulnerability, successful exploitation could cause information leak.
AFFECTED_PRODUCTS:
Hihonor Magic Ui
A vulnerability has been found in ShifuML shifu 0.12.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file src/main/java/ml/shifu/shifu/core/DataPurifier.java of the component Java Expression Language Handler. The manipulation of the argument FilterExpr...
AFFECTED_PRODUCTS:
Shifuml Shifu
A vulnerability, which was classified as critical, was found in gopeak MasterLab up to 3.3.10. Affected is the function base64ImageContent of the file app/ctrl/User.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. VDB-249150 is t...
AFFECTED_PRODUCTS:
Masterlab Masterlab
CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sensitive information via the Delivery Name field.
AFFECTED_PRODUCTS:
Sesami Cash Point \& Transport Optimizer
An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows remote attackers to obtain sensitive information and bypass profile restriction via improper access control in the Reader system user's web browser, allowing the journal to be displayed, despite the opti...
AFFECTED_PRODUCTS:
Sesami Cash Point \& Transport Optimizer
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
AFFECTED_PRODUCTS:
Hihonor Lge An00 Firmware
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
AFFECTED_PRODUCTS:
Hihonor Lge An00 Firmware
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions
AFFECTED_PRODUCTS:
Hihonor Lge An00 Firmware
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak
AFFECTED_PRODUCTS:
Hihonor Vmall
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.
AFFECTED_PRODUCTS:
Hihonor Magichome
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.
AFFECTED_PRODUCTS:
Hihonor Magic Os
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.
AFFECTED_PRODUCTS:
Hihonor Magic Os
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.
AFFECTED_PRODUCTS:
Hihonor Magic Os
Some Honor products are affected by file writing vulnerability, successful exploitation could cause information disclosure.
AFFECTED_PRODUCTS:
Hihonor Fri An00 Firmware
Some Honor products are affected by file writing vulnerability, successful exploitation could cause code execution
AFFECTED_PRODUCTS:
Hihonor Nth An00 Firmware
A vulnerability, which was classified as critical, has been found in gopeak MasterLab up to 3.3.10. This issue affects the function sqlInjectDelete of the file app/ctrl/framework/Feature.php of the component HTTP POST Request Handler. The manipulation of the argument phone leads to sql injection. Th...
AFFECTED_PRODUCTS:
Masterlab Masterlab
A vulnerability classified as critical was found in gopeak MasterLab up to 3.3.10. This vulnerability affects the function sqlInject of the file app/ctrl/Framework.php of the component HTTP POST Request Handler. The manipulation of the argument pwd leads to sql injection. The exploit has been disclo...
AFFECTED_PRODUCTS:
Masterlab Masterlab
Stored Cross Site Scripting (XSS) Vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to execute arbitrary code and obtain sensitive information via the Username field of the login form and application log.
AFFECTED_PRODUCTS:
Sesami Cash Point \& Transport Optimizer
Cross Site Scripting (XSS) vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to execute arbitrary code and obtain sensitive information via the User ID field when creating a new system user.
AFFECTED_PRODUCTS:
Sesami Cash Point \& Transport Optimizer
An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows local attackers to obtain sensitive information and bypass authentication via "Back Button Refresh" attack.
AFFECTED_PRODUCTS:
Sesami Cash Point \& Transport Optimizer
Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file
AFFECTED_PRODUCTS:
Hihonor Magic Os
Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file
AFFECTED_PRODUCTS:
Hihonor Magic Os
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
AFFECTED_PRODUCTS:
Hihonor Honorboardapp
Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.
AFFECTED_PRODUCTS:
Hihonor Nth An00 Firmware
Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.
AFFECTED_PRODUCTS:
Hihonor Nth An00 Firmware
Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.
AFFECTED_PRODUCTS:
Hihonor Nth An00 Firmware
A vulnerability classified as critical has been found in gopeak MasterLab up to 3.3.10. This affects the function sqlInject of the file app/ctrl/framework/Feature.php of the component HTTP POST Request Handler. The manipulation of the argument pwd leads to sql injection. The exploit has been disclos...
AFFECTED_PRODUCTS:
Masterlab Masterlab
A vulnerability was found in code-projects Client Details System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/regester.php. The manipulation of the argument fname/lname/email/contact leads to cross site scripting. The attack may be la...
AFFECTED_PRODUCTS:
Code-Projects Client Details System
A vulnerability was found in code-projects Client Details System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/clientview.php. The manipulation of the argument ID leads to sql injection. The exploit has been disclosed to the p...
AFFECTED_PRODUCTS:
Code-Projects Client Details System
A vulnerability was found in code-projects Client Details System 1.0. It has been classified as problematic. Affected is an unknown function of the file /admin/update-clients.php. The manipulation of the argument uid leads to sql injection. The exploit has been disclosed to the public and may be use...
AFFECTED_PRODUCTS:
Code-Projects Client Details System
Winter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local Fi...
AFFECTED_PRODUCTS:
Wintercms Winter
ZZCMS 2023 has a file upload vulnerability in 3/E_bak5.1/upload/index.php, allowing attackers to exploit this loophole to gain server privileges and execute arbitrary code.
AFFECTED_PRODUCTS:
Zzcms Zzcms
A vulnerability was found in code-projects Client Details System 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/manage-users.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used...
AFFECTED_PRODUCTS:
Code-Projects Client Details System
A vulnerability has been found in code-projects Client Details System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/regester.php of the component HTTP POST Request Handler. The manipulation of the argument fname/lname/email/contact leads to sql injecti...
AFFECTED_PRODUCTS:
Code-Projects Client Details System
mupnp/net/uri.c in mUPnP for C through 3.0.2 has an out-of-bounds read and application crash because it lacks a certain host length recalculation.
AFFECTED_PRODUCTS:
Cybergarage Mupnp For C
Winter is a free, open-source content management system. Prior to 1.2.4, Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be rendered unescaped in the backend form, potentially allowing for a stored XSS attack. This issue has been patched i...
AFFECTED_PRODUCTS:
Wintercms Winter
Winter is a free, open-source content management system. Prior to 1.2.4, users with the `media.manage_media` permission can upload files to the Media Manager and rename them after uploading. Previously, media manager files were only sanitized on upload, not on renaming, which could have allowed a s...
AFFECTED_PRODUCTS:
Wintercms Winter
In ActiveAdmin (aka Active Admin) before 2.12.0, a concurrency issue allows a malicious actor to access potentially private data (that belongs to another user) by making CSV export requests at certain specific times.
AFFECTED_PRODUCTS:
Activeadmin Activeadmin
A vulnerability, which was classified as critical, was found in code-projects Client Details System 1.0. This affects an unknown part of the file /admin of the component HTTP POST Request Handler. The manipulation of the argument username leads to sql injection. The exploit has been disclosed to the...
AFFECTED_PRODUCTS:
Code-Projects Client Details System
A vulnerability, which was classified as critical, has been found in code-projects Client Details System 1.0. Affected by this issue is some unknown functionality of the component HTTP POST Request Handler. The manipulation of the argument uemail leads to sql injection. The exploit has been disclose...
AFFECTED_PRODUCTS:
Code-Projects Client Details System
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BoxyStudio Booked - Appointment Booking for WordPress | Calendars.This issue affects Booked - Appointment Booking for WordPress | Calendars: from n/a before 2.4.4.
AFFECTED_PRODUCTS:
Boxystudio Booked
A vulnerability classified as problematic was found in code-projects Record Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /main/doctype.php of the component Document Type Handler. The manipulation of the argument docname with the input "><script src="h...
AFFECTED_PRODUCTS:
Code-Projects Record Management System
A vulnerability classified as problematic has been found in code-projects Record Management System 1.0. Affected is an unknown function of the file /main/offices.php of the component Offices Handler. The manipulation of the argument officename with the input "><script src="https://js.rip/b23tmbxf49"...
AFFECTED_PRODUCTS:
Code-Projects Record Management System
A vulnerability was found in SourceCodester Medicine Tracking System 1.0. It has been rated as critical. This issue affects some unknown processing. The manipulation of the argument page leads to path traversal: '../filedir'. The attack may be initiated remotely. The exploit has been disclosed to th...
AFFECTED_PRODUCTS:
Oretnom23 Medicine Tracker System
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.8.1.
AFFECTED_PRODUCTS:
Wiselyhub Js Help Desk
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Basix NEX-Forms – Ultimate Form Builder – Contact forms and much more.This issue affects NEX-Forms – Ultimate Form Builder – Contact forms and much more: from n/a through 8.5.5.
AFFECTED_PRODUCTS:
Basixonline Nex Forms
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Collne Inc. Welcart e-Commerce.This issue affects Welcart e-Commerce: from n/a through 2.9.3.
AFFECTED_PRODUCTS:
Welcart Welcart E Commerce