CVE-2024-3314
published 2024-04-04CVE-2024-3314: A vulnerability was found in SourceCodester Computer Laboratory Management System 1.0 and classified as critical. This issue affects some unknown processing of…
PriorityP351critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.55%
41.9th percentile
A vulnerability was found in SourceCodester Computer Laboratory Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /classes/Users.php. The manipulation leads to sql injection. The attack may be initiated remotely. The identifier VDB-259385 was assigned to this vulnerability.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oretnom23 | computer_laboratory_management_system | — | — |
| sourcecodester | computer_laboratory_management_system | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
cisa9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-cq4r-22pw-4cc7: A vulnerability was found in SourceCodester Computer Laboratory Management System 1
ghsa_unreviewed·2024-04-04
CVE-2024-3314 [MEDIUM] CWE-89 GHSA-cq4r-22pw-4cc7: A vulnerability was found in SourceCodester Computer Laboratory Management System 1
A vulnerability was found in SourceCodester Computer Laboratory Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /classes/Users.php. The manipulation leads to sql injection. The attack may be initiated remotely. The identifier VDB-259385 was assigned to this vulnerability.
GHSA
Arbitrary file read vulnerability in Git server Plugin can lead to RCE
ghsa·2024-01-24
CVE-2024-23899 [HIGH] CWE-22 Arbitrary file read vulnerability in Git server Plugin can lead to RCE
Arbitrary file read vulnerability in Git server Plugin can lead to RCE
Jenkins Git server Plugin uses the [args4j](https://github.com/kohsuke/args4j) library to parse command arguments and options on the Jenkins controller when processing Git commands received via SSH. This command parser has a feature that replaces an @ character followed by a file path in an argument with the file’s contents (`expandAtFiles`). This feature is enabled by default and Git server Plugin 99.va_0826a_b_cdfa_d and earlier does not disable it.
This allows attackers with Overall/Read permission to read the first two lines of arbitrary files on the Jenkins controller file system using the default character encoding of the Jenkins controller process.
See [SECURITY-3314](https://www.jenkins.io/security/advisory/2
CISA
Jenkins Command Line Interface (CLI) Path Traversal Vulnerability
cisa·2024-08-19·CVSS 9.8
CVE-2024-23897 [CRITICAL] CWE-27 Jenkins Command Line Interface (CLI) Path Traversal Vulnerability
Vulnerability: Jenkins Command Line Interface (CLI) Path Traversal Vulnerability
Affected: Jenkins Jenkins Command Line Interface (CLI)
Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution.
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314; https://nvd.nist.gov/vuln/detail/CVE-2024-23897
Remediation Due Date: 2024-09-09
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-04-04
Published