CVSS: 9.9EPSS: 0%CPEs: 4EXPL: 0CVE-2023-45162 – Blind SQL vulnerability in 1E platform
https://notcve.org/view.php?id=CVE-2023-45162
Affected 1E Platform versions have a Blind SQL Injection vulnerability that can lead to arbitrary code execution. Application of the relevant hotfix remediates this issue. for v8.1.2 apply hotfix Q23166 for v8.4.1 apply hotfix Q23164 for v9.0.1 apply hotfix Q23169 SaaS implementations on v23.7.1 will automatically have hotfix Q23173 applied. Customers with SaaS versions below this are urged to upgrade urgently - please contact 1E to arrange this Las versiones afectadas de 1E Platform tienen una vulnerabilidad de inyección Blind SQL que puede provocar la ejecución de código arbitrario. La aplicación del hotfix correspondiente soluciona este problema. para v8.1.2 aplique hotfix Q23166 para v8.4.1 aplique hotfix Q23164 para v9.0.1 aplique hotfix Q23169 Las implementaciones de SaaS en v23.7.1 tendrán automáticamente aplicado el hotfix Q23173. Se insta a los clientes con versiones de SaaS inferiores a esta a actualizar urgentemente; comuníquese con 1E para organizar esto. • https://www.1e.com/trust-security-compliance/cve-info • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.0EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15263 – XSS in platform
https://notcve.org/view.php?id=CVE-2020-15263
In platform before version 9.4.4, inline attributes are not properly escaped. If the data that came from users was not escaped, then an XSS vulnerability is possible. The issue was introduced in 9.0.0 and fixed in 9.4.4. En platform versiones anteriores a 9.4.4, los atributos en línea no son escapados apropiadamente. Si los datos que provienen de los usuarios no se escaparon, entonces es posible una vulnerabilidad de tipo XSS. • https://github.com/orchidsoftware/platform/commit/03f9a113b1a70bc5075ce86a918707f0e7d82169 https://github.com/orchidsoftware/platform/security/advisories/GHSA-589w-hccm-265x • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •