CVSS: 9.9EPSS: 0%CPEs: 4EXPL: 0CVE-2023-45162 – Blind SQL vulnerability in 1E platform
https://notcve.org/view.php?id=CVE-2023-45162
Affected 1E Platform versions have a Blind SQL Injection vulnerability that can lead to arbitrary code execution. Application of the relevant hotfix remediates this issue. for v8.1.2 apply hotfix Q23166 for v8.4.1 apply hotfix Q23164 for v9.0.1 apply hotfix Q23169 SaaS implementations on v23.7.1 will automatically have hotfix Q23173 applied. Customers with SaaS versions below this are urged to upgrade urgently - please contact 1E to arrange this Las versiones afectadas de 1E Platform tienen una vulnerabilidad de inyección Blind SQL que puede provocar la ejecución de código arbitrario. La aplicación del hotfix correspondiente soluciona este problema. para v8.1.2 aplique hotfix Q23166 para v8.4.1 aplique hotfix Q23164 para v9.0.1 aplique hotfix Q23169 Las implementaciones de SaaS en v23.7.1 tendrán automáticamente aplicado el hotfix Q23173. Se insta a los clientes con versiones de SaaS inferiores a esta a actualizar urgentemente; comuníquese con 1E para organizar esto. • https://www.1e.com/trust-security-compliance/cve-info • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2023-36825 – Orchid Deserialization of Untrusted Data vulnerability leads to Remote Code Execution
https://notcve.org/view.php?id=CVE-2023-36825
Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dashboards. A vulnerability present starting in version 14.0.0-alpha4 and prior to version 14.5.0 is related to the deserialization of untrusted data from the `_state` query parameter, which can result in remote code execution. The issue has been addressed in version 14.5.0. Users are advised to upgrade their software to this version or any subsequent versions that include the patch. There are no known workarounds. • https://github.com/orchidsoftware/platform/releases/tag/14.5.0 https://github.com/orchidsoftware/platform/security/advisories/GHSA-ph6g-p72v-pc3p • CWE-502: Deserialization of Untrusted Data •