Linwz

EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

Efence developed by Thinking Software Technology has a SQL Injection vulnerability. Unauthenticated remote attackers can access file upload functionality and read database contents.

**Nome do Software Vulnerável e Versões Afetadas** EFence (versões afetadas não especificadas) **Descrição** Uma falha de upload arbitrário de arquivos permite que atacantes remotos não autenticados façam o upload e executem backdoors de web shell, o que pode levar à execução de código arbitrário no servidor. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha a correção para esta vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** IDExpert Windows Logon Agent (affected versions not specified) **Description** IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution issue. Unauthenticated remote attackers can force the system to download arbitrary executable files from a remote source and execute them. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Nome do Software Vulnerável e Versões Afetadas** IDExpert Windows Logon Agent (versões afetadas não especificadas) **Descrição** O IDExpert Windows Logon Agent, desenvolvido pela Changing, apresenta uma vulnerabilidade de Execução Remota de Código. Atacantes remotos não autenticados podem forçar o sistema a baixar arquivos DLL arbitrários de uma fonte remota e executá-los. A falha permite que atacantes executem código no sistema alvo sem necessidade de autenticação. **Recomendações** Até o momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** C&Cm@il versions (affected versions not specified) **Description** C&Cm@il, developed by HGiga, contains a SQL Injection flaw. This allows attackers who do not need to be logged in to inject arbitrary SQL commands, potentially allowing them to read the contents of the database. The vulnerability affects the application's handling of SQL queries, enabling malicious input to manipulate database operations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** C&Cm@il (affected versions not specified) **Description** C&Cm@il developed by HGiga has a Missing Authentication issue. This allows unauthenticated remote attackers to read and modify any user's mail content. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** C&Cm@il versions (affected versions not specified) **Description** C&Cm@il, developed by HGiga, contains a SQL Injection flaw. Authenticated remote attackers can exploit this to inject arbitrary SQL commands, potentially leading to unauthorized database content access. The vulnerability allows for the execution of SQL commands, enabling attackers to read data from the database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Gotac Statistics Database System (affected versions not specified) **Description** The Statistics Database System developed by Gotac has a missing authentication issue. This allows unauthenticated remote attackers to directly exploit a specific functionality to query database contents. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Gotac Statistics Database System (affected versions not specified) **Description** The Statistics Database System developed by Gotac has an Arbitrary File Read issue. Unauthenticated remote attackers can exploit Relative Path Traversal to download arbitrary system files. The issue allows attackers to access files on the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Gotac Police Statistics Database System (affected versions not specified) **Description** The Police Statistics Database System developed by Gotac is subject to an arbitrary file upload issue. A remote, unauthenticated attacker can exploit this to upload and execute web shell backdoors, leading to arbitrary code execution on the server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Gotac Police Statistics Database System (affected versions not specified) **Description** The Police Statistics Database System developed by Gotac contains an Absolute Path Traversal issue. This allows unauthenticated remote attackers to enumerate the system file directory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Gotac Police Statistics Database System (affected versions not specified) **Description** The Police Statistics Database System developed by Gotac suffers from a missing authentication issue. This allows remote attackers to read, modify, and delete database contents without authentication by utilizing a specific functionality. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Gotac Police Statistics Database System (affected versions not specified) **Description** The Police Statistics Database System developed by Gotac contains a flaw that allows a remote, unauthenticated attacker to read arbitrary system files through an Absolute Path Traversal technique. This vulnerability enables the attacker to download files from the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Nome do Software Vulnerável e Versões Afetadas** N-Reporter (versões afetadas não especificadas) N-Cloud (versões afetadas não especificadas) N-Probe (versões afetadas não especificadas) **Descrição** O N-Reporter, o N-Cloud e o N-Probe, desenvolvidos pela N-Partner, estão suscetíveis a um problema de Injeção de Comandos no Sistema Operacional. Atacantes remotos autenticados podem injetar comandos arbitrários do sistema operacional e executá-los no servidor. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** O'View MapServer (affected versions not specified) **Description** O'View MapServer developed by PilotGaea Technologies contains a Server-Side Request Forgery vulnerability. This allows unauthenticated remote attackers to probe internal networks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Nome do Software Vulnerável e Versões Afetadas** Sunnet eHRD (versões afetadas não especificadas) **Descrição** A plataforma eHRD contém uma vulnerabilidade de cross-site scripting refletido. Isso permite que atacantes remotos não autenticados executem código JavaScript arbitrário no navegador de um usuário por meio de ataques de phishing. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

The eHRD developed by Sunnet has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.

**Name of the Vulnerable Software and Affected Versions** Sunnet eHRD (affected versions not specified) **Description** The eHRD platform developed by Sunnet is susceptible to a Reflected Cross-site Scripting issue. This allows unauthenticated remote attackers to execute arbitrary JavaScript code in a user's browser through phishing attacks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: WebITR versions (affected versions not specified) Description: WebITR developed by Uniong is susceptible to an arbitrary file reading issue. This allows remote attackers with regular privileges to exploit an Absolute Path Traversal flaw to download arbitrary system files. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.