CVE-2024-8694 : JFINALCMS UP TO 20240903 COM.CMS.CONTROLLER.ADMIN.TEMPLATECONTROLLER /ADMIN/TEMPLATE/UPDATE FILENAME PATH TRAVERSAL

Description

A vulnerability, which was classified as problematic, was found in JFinalCMS up to 20240903. This affects the function update of the file /admin/template/update of the component com.cms.controller.admin.TemplateController. The manipulation of the argument fileName leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

References

VDB-277167 | JFinalCMS com.cms.controller.admin.TemplateController update path traversal

VDB-277167 | CTI Indicators (IOB, IOC, TTP, IOA)

10Web CMS <=1.0 Unrestricted Upload

https://gitee.com/heyewei/JFinalcms/issues/IAOKSQ

https://github.com/wave-to/SomeCms/blob/main/JFinalCMS.md

For More Information

CVERecord

Contact us to get started

CVE-2024-54198 : SAP NETWEAVER APPLICATION SERVER ABAP UP TO KRNL64UC 7.22 RFC REQUEST IMPROPER CONTROL OF DYNAMICALLY-IDENTIFIED VARIABLES

Description In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC)

Learn more

CVE-2024-48956 : SERVICEWARE PROCESSES UP TO 7.3 HTTP REQUEST IMPROPER AUTHENTICATION

Description Serviceware Processes 6.0 through 7.3 allows attackers without valid authentication to send a specially crafted HTTP request to a

Learn more

CVE-2024-12369 : RED HAT KEYCLOAK/JBOSS ENTERPRISE APPLICATION PLATFORM WILDFLY-ELYTRON-OIDC-CLIENT-SUBSYSTEM CODE INJECTION

Description A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using

Learn more