CVE-2024-1263

Juanpao JPShop API PosterController.php actionUpdate unrestricted upload

A vulnerability, which was classified as critical, was found in Juanpao JPShop up to 1.5.02. Affected is the function actionUpdate of the file /api/controllers/merchant/shop/PosterController.php of the component API. The manipulation of the argument pic_url leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-253002 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Juanpao

Products

Jpshop

CVE-2024-1262

Juanpao JPShop API MaterialController.php actionUpdate unrestricted upload

A vulnerability, which was classified as critical, has been found in Juanpao JPShop up to 1.5.02. This issue affects the function actionUpdate of the file /api/controllers/merchant/design/MaterialController.php of the component API. The manipulation of the argument pic_url leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-253001 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Juanpao

Products

Jpshop

CVE-2024-1258

Juanpao JPShop API params.php hard-coded key

A vulnerability was found in Juanpao JPShop up to 1.5.02. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file api/config/params.php of the component API. The manipulation of the argument JWT_KEY_ADMIN leads to use of hard-coded cryptographic key . The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-252997 was assigned to this vulnerability.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Juanpao

Products

Jpshop

CVE-2024-1256

Jspxcms filter_text.do cross site scripting

A vulnerability was found in Jspxcms 10.2.0 and classified as problematic. This issue affects some unknown processing of the file /ext/collect/filter_text.do. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252995.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Ujcms

Products

Jspxcms

CVE-2024-1255

sepidz SepidzDigitalMenu Waiters information disclosure

A vulnerability has been found in sepidz SepidzDigitalMenu up to 7.1.0728.1 and classified as problematic. This vulnerability affects unknown code of the file /Waiters. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-252994 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sepidz

Products

Sepidzdigitalmenu

CVE-2024-1254

Byzoro Smart S20 Management Platform sysmanageajax.php sql injection

A vulnerability, which was classified as critical, was found in Byzoro Smart S20 Management Platform up to 20231120. This affects an unknown part of the file /sysmanage/sysmanageajax.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252993 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 4.7 Medium EPSS 4.6% KEV · Not listed

Vendors

Byzoro

Products

Smart S20 Smart S20 Firmware

CVE-2024-1247

Concrete CMS version 9 before 9.2.5 vulnerable to stored XSS via the Role Name field

Concrete CMS version 9 before 9.2.5 is vulnerable to  stored XSS via the Role Name field since there is insufficient validation of administrator provided data for that field. A rogue administrator could inject malicious code into the Role Name field which might be executed when users visit the affected page. The Concrete CMS Security team scored this 2 with CVSS v3 vector AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator . Concrete versions below 9 do not include group types so they are not affected by this vulnerability.

CVSS 3.1 · 2 Low EPSS 1.2% KEV · Not listed

Vendors

Concretecms

Products

Concrete Cms

CVE-2024-1245

Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS in file tags and description attributes

Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS in file tags and description attributes since administrator entered file attributes are not sufficiently sanitized in the Edit Attributes page. A rogue administrator could put malicious code into the file tags or description attributes and, when another administrator opens the same file for editing, the malicious code could execute. The Concrete CMS Security team scored this 2.4 with CVSS v3 vector AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Concretecms

Products

Concrete Cms

CVE-2024-1200

Jspxcms information disclosure

A vulnerability was found in Jspxcms 10.2.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /template/1/default/. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252698 is the identifier assigned to this vulnerability.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jspxcms

Products

Jspxcms

CVE-2024-1199

CodeAstro Employee Task Management System attendance-info.php denial of service

A vulnerability has been found in CodeAstro Employee Task Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file \employee-tasks-php\attendance-info.php. The manipulation of the argument aten_id leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252697 was assigned to this vulnerability.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Employee Task Management System Project

Products

Employee Task Management System

CVE-2024-1196

SourceCodester Testimonial Page Manager HTTP POST Request add-testimonial.php cross site scripting

A vulnerability classified as problematic was found in SourceCodester Testimonial Page Manager 1.0. This vulnerability affects unknown code of the file add-testimonial.php of the component HTTP POST Request Handler. The manipulation of the argument name/description/testimony leads to cross site scripting. The attack can be initiated remotely. VDB-252694 is the identifier assigned to this vulnerability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Remyandrade

Products

Testimonial Page Manager

CVE-2024-1195

iTop VPN IOCTL ITopVpnCallbackProcess.sys denial of service

A vulnerability classified as critical was found in iTop VPN up to 4.0.0.1. Affected by this vulnerability is an unknown functionality in the library ITopVpnCallbackProcess.sys of the component IOCTL Handler. The manipulation leads to denial of service. The attack needs to be approached locally. The identifier VDB-252685 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Iobit

Products

Itop Vpn

CVE-2024-1194

Armcode AlienIP Locate Host denial of service

A vulnerability classified as problematic has been found in Armcode AlienIP 2.41. Affected is an unknown function of the component Locate Host Handler. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252684. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Armcode

Products

Alienip

CVE-2024-1193

Navicat MySQL Conecction denial of service

A vulnerability was found in Navicat 12.0.29. It has been rated as problematic. This issue affects some unknown processing of the component MySQL Conecction Handler. The manipulation leads to denial of service. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252683. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Navicat

Products

Navicat

CVE-2024-1188

Rizone Soft Notepad3 Encryption Passphrase denial of service

A vulnerability, which was classified as problematic, was found in Rizone Soft Notepad3 1.0.2.350. Affected is an unknown function of the component Encryption Passphrase Handler. The manipulation leads to denial of service. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. VDB-252678 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Rizonesoft

Products

Notepad3

CVE-2024-1185

Nsasoft NBMonitor Network Bandwidth Monitor Registration denial of service

A vulnerability classified as problematic has been found in Nsasoft NBMonitor Network Bandwidth Monitor 1.6.5.0. This affects an unknown part of the component Registration Handler. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252675. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Nsasoft

Products

Network Bandwidth Monitor

CVE-2024-1184

Nsasoft Network Sleuth Registration denial of service

A vulnerability was found in Nsasoft Network Sleuth 3.0.0.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Registration Handler. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. VDB-252674 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Nsasoft

Products

Network Sleuth

CVE-2024-1150

Improper validation of update packages

Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on Unix allows File Manipulation through Snow Update Packages.This issue affects Inventory Agent: through 7.3.1.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Opengroup Snowsoftware

Products

Unix Snow Inventory Agent

CVE-2024-1116

openBI Upload.php index unrestricted upload

A vulnerability was found in openBI up to 1.0.8. It has been classified as critical. Affected is the function index of the file /application/plugins/controller/Upload.php. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-252474 is the identifier assigned to this vulnerability.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Openbi

Products

Openbi

CVE-2024-1114

openBI Screen.php dlfile access control

A vulnerability has been found in openBI up to 1.0.8 and classified as critical. This vulnerability affects the function dlfile of the file /application/index/controller/Screen.php. The manipulation of the argument fileUrl leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252472.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Openbi

Products

Openbi