Aceware Aceweb Online Portal
5 CVEs affecting Aceware Aceweb Online Portal. Latest disclosed: 2022-06-02. Critical: 2, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-24240 | Critical | 9.8 | 2022-06-02 | ACEweb Online Portal 3.5.065 was discovered to contain a SQL injection vulnerability via the criteria parameter in showschedule.awp. |
CVE-2022-24239 | Critical | 9.8 | 2022-06-02 | ACEweb Online Portal 3.5.065 was discovered to contain an unrestricted file upload vulnerability via attachments.awp. |
CVE-2022-24581 | High | 7.5 | 2022-06-02 | ACEweb Online Portal 3.5.065 allows unauthenticated SMB hash capture via UNC. By specifying the UNC file path of an external SMB share when uploading a file, a… |
CVE-2022-24241 | High | 7.5 | 2022-06-02 | ACEweb Online Portal 3.5.065 was discovered to contain an External Controlled File Path and Name vulnerability via the txtFilePath parameter in attachments.awp. |
CVE-2022-24238 | Medium | 6.1 | 2022-06-02 | ACEweb Online Portal 3.5.065 was discovered to contain a cross-site scripting (XSS) vulnerability via the txtNmName1 parameter in person.awp. |