Show filters
5 Total Results
Displaying 1-5 of 5
Sort by:
Attacker Value
Unknown
CVE-2022-24581
Disclosure Date: June 02, 2022 (last updated February 23, 2025)
ACEweb Online Portal 3.5.065 allows unauthenticated SMB hash capture via UNC. By specifying the UNC file path of an external SMB share when uploading a file, an attacker can induce the victim server to disclose the username and password hash of the user executing the ACEweb Online software.
0
Attacker Value
Unknown
CVE-2022-24241
Disclosure Date: June 02, 2022 (last updated February 23, 2025)
ACEweb Online Portal 3.5.065 was discovered to contain an External Controlled File Path and Name vulnerability via the txtFilePath parameter in attachments.awp.
0
Attacker Value
Unknown
CVE-2022-24240
Disclosure Date: June 02, 2022 (last updated February 23, 2025)
ACEweb Online Portal 3.5.065 was discovered to contain a SQL injection vulnerability via the criteria parameter in showschedule.awp.
0
Attacker Value
Unknown
CVE-2022-24239
Disclosure Date: June 02, 2022 (last updated February 23, 2025)
ACEweb Online Portal 3.5.065 was discovered to contain an unrestricted file upload vulnerability via attachments.awp.
0
Attacker Value
Unknown
CVE-2022-24238
Disclosure Date: June 02, 2022 (last updated February 23, 2025)
ACEweb Online Portal 3.5.065 was discovered to contain a cross-site scripting (XSS) vulnerability via the txtNmName1 parameter in person.awp.
0
