Xin-Yue

The issue exists due to the lack of measures to neutralize special elements used in operating system commands. This allows a remote attacker to execute arbitrary code without requiring authentication.

The issue is related to a hard-coded machine key in OMICARD EDM. This allows an unauthenticated remote attacker to send a serialized payload to the server, which can result in the execution of arbitrary code, manipulation of system data, and disruption of service.

The issue concerns a path traversal vulnerability in OMICARD EDM's mail file relay function. This vulnerability can be exploited by an unauthenticated remote attacker to bypass authentication and access arbitrary system files.

The issue is related to insufficient validation for user input in OMICARD EDM's API function. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, which can be used to access, modify, or delete the database, or disrupt the service.

The mail image relay function in OMICARD EDM has a path traversal issue. This allows an unauthenticated remote attacker to bypass authentication and access arbitrary system files.

The issue is related to an inadequate validation vulnerability in EasyUse MailHunter Ultimate's cookie deserialization function. Deserializing a cookie containing a malicious payload can trigger this vulnerability, allowing an unauthenticated remote attacker to execute arbitrary code, manipulate system commands, or interrupt services.

The issue allows remote code execution due to the use of `window.open` without checking the URL, specifically with the `obsidian://hook-get-address` protocol. This can lead to unauthorized code execution.

The issue is related to insufficient validation for user input in a function of Digiwin BPM. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially accessing, modifying, or deleting the database, or disrupting the service.

The issue is related to inadequate filtering for URL parameters in Digiwin BPM, allowing an unauthenticated remote attacker to perform a Blind SSRF (Server-Side Request Forgery) attack. This attack can be used to discover the internal network topology based on URL error responses.

The issue is related to a XML External Entity Injection (XXE) vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perform an XML injection attack to access arbitrary system files.