Nu11

A security flaw exists in the Streamax Crocus software. The issue involves unrestricted file upload through manipulation of the `File` argument in the `uploadFile` function, accessible via the `/FileDir.do?Action=Upload` endpoint. This allows for remote exploitation. The exploit has been publicly released. The vendor was contacted but did not respond.

A flaw exists in the `queryLast` function within the `/RepairRecord.do?Action=QueryLast` file. Manipulation of the `orderField` argument can lead to SQL injection. This issue is exploitable remotely and has been publicly disclosed. The vendor was notified but did not respond.

A security issue exists in Shenzhen Ruiming Technology Streamax Crocus version 1.3.40. The `Query` function within the `/MemoryState.do?Action=Query` file is susceptible to SQL injection due to manipulation of the `orderField` argument. This allows for remote exploitation. The exploit has been publicly disclosed.

A flaw exists in the Query function of the `/DeviceFault.do?Action=Query` file that allows for SQL injection through manipulation of the `sortField` argument. This issue is remotely exploitable. The exploit is publicly available. The vendor was notified but did not respond.

A flaw exists in the Streamax Crocus software that allows for SQL injection. The issue is located in the `Query` function of the `/DeviceState.do?Action=Query` file. Manipulating the `orderField` argument can trigger the injection. This manipulation can be initiated remotely. The exploit has been published.

A path traversal issue exists due to manipulation of the `Path` argument in the `Download` function via the `/Service.do?Action=Download` endpoint. This allows for remote exploitation. The exploit has been publicly disclosed.

A path traversal issue exists in the Download function of the `/DeviceFileReport.do?Action=Download` file. Manipulation of the `FilePath` argument can lead to unauthorized access. The exploit has been publicly disclosed.

A security flaw exists in Tipray Data Leakage Prevention System. The issue involves unrestricted file upload due to manipulation of the `File` argument in the `uploadWxFile.do` endpoint. This can be exploited remotely. The exploit has been publicly released, and the vendor was notified but did not respond.

A flaw exists in Tipray Data Leakage Prevention System that allows for remote SQL injection. The issue is located in the `findModulePage.do` file, specifically within the `findModulePage` function. Manipulation of the `sort` argument can trigger the injection. The exploit is publicly available. The vendor was notified but did not respond.

A flaw exists in Tipray Data Leakage Prevention System that allows for SQL injection. The issue is located in the `findRolePage.do` file and specifically affects the `findRolePage` function. Manipulation of the `sort` argument can trigger the SQL injection. This attack can be initiated remotely. The exploit has been published. The vendor was contacted but did not respond.

A flaw exists in the software that allows for remote code execution through SQL injection. The issue is located in the `findRolePage` function within the `findSingConfigPage.do` file. Manipulation of the `sort` argument can trigger the injection. The exploit for this issue has been publicly disclosed. The vendor was informed of the issue but did not respond.

A flaw exists in the software that allows for SQL injection. This occurs due to manipulation of the `sort` argument within the `findUserPage` function of the `findUserPage.do` file. Remote exploitation is possible. The exploit has been publicly released. The vendor was notified but did not respond.

A flaw exists in the software that allows for remote execution of SQL injection attacks. The issue is related to the `findCategoryPage` function within the `findCategoryPage.do` file. Manipulation of the `tenantId` argument can trigger the flaw. The exploit for this issue has been publicly disclosed, and the vendor was notified but did not respond.

A security issue exists in the Tipray Data Leakage Prevention System. The `findRolePage` function within the `findSingConfigPage.do` file is susceptible to SQL injection due to manipulation of the `sort` argument. This allows for remote exploitation. An exploit for this issue is publicly available. The vendor was notified but did not respond.

A security issue exists in the `findTenantPage` function of the `findTenantPage.do` file. Manipulation of the `sort` argument can lead to SQL injection. This attack can be initiated remotely. The exploit has been publicly disclosed. The vendor was informed of this disclosure but did not respond.

A security flaw exists in the `doFilter` function of the `findDeptPage.do` file. Manipulation of the `sort` argument can lead to SQL injection. This issue can be exploited remotely. The exploit is publicly available. The vendor was notified but did not respond.

A flaw exists in Tipray Data Leakage Prevention System. Specifically, manipulation of the `sort` argument within the `findFileServerPage` function, accessible through the `findFileServerPage.do` file, can result in SQL injection. This issue is remotely exploitable. The exploit has been publicly released. The vendor was notified but did not respond.

A path traversal issue exists in Bjskzy Zhiyou ERP. The `uploadStudioFile` function within the `com.artery.form.services.FormStudioUpdater` component is affected. Manipulation of the `filepath` argument can lead to path traversal. Remote exploitation is possible, and the exploit has been publicly disclosed. The vendor was notified but did not respond.

A flaw exists in Bjskzy Zhiyou ERP that could allow for remote manipulation. The issue is related to the `openForm` function within the `com.artery.richclient.RichClientService` component. Specifically, manipulating the `contentString` argument can lead to xml external entity reference. The exploit is publicly available.

A path traversal issue exists in Dibo Data Decision Making System. The issue is related to the manipulation of the `filePath` argument within the `downloadImpTemplet()` function located in the `/common/dep/common dep.action.jsp` file. This allows for remote exploitation. The exploit has been publicly disclosed.