NVD disclosure day
CVE-2023-51925
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An arbitrary file upload vulnerability in YonBIP allows attackers to execute code by uploading a crafted file. This could compromise system data and impact platform integrity if the vulnerable component is reachable.
CVE-2023-51924
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in YonBIP's resource management interface allows unauthenticated attackers to upload malicious files and execute arbitrary code, potentially compromising systems. This issue is considered external and likely exploitable.
CVE-2023-51906
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability exists in yonyou YonBIP's ServiceDispatcherServlet that allows remote attackers to execute arbitrary code by sending a crafted script. This could lead to system compromise if the affected component is network-reachable.
CVE-2023-51928
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An arbitrary file upload vulnerability in YonBIP's `ArcpUploadAction.doAction()` method allows unauthenticated attackers to upload crafted files, potentially leading to arbitrary code execution and system compromise. The platform is an enterprise business innovation tool.
CVE-2023-51927
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A SQL injection vulnerability exists in YonBIP, a business management software, which an attacker could exploit remotely and without authentication. This could lead to unauthorized access to or modification of sensitive business data.
CVE-2023-51892
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in weaver e-cology's FrameworkShellController, enabling remote attackers to execute arbitrary code without authentication via a crafted script. This could potentially disrupt services or compromise system integrity, impacting enterprise collaboration and office automation.