CVE-2026-1122
published 2026-01-18CVE-2026-1122: A vulnerability was determined in Yonyou KSOA 9.0. This impacts an unknown function of the file /worksheet/work_info.jsp of the component HTTP GET Parameter…
PriorityP358critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.46%
38.9th percentile
A vulnerability was determined in Yonyou KSOA 9.0. This impacts an unknown function of the file /worksheet/work_info.jsp of the component HTTP GET Parameter Handler. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| yonyou | ksoa | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.05.5MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
ghsa9.3CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-64611 cups-filters: libcupsfilters: CPU exhaustion via infinite loop in cfIEEE1284NormalizeMakeModel() [fedora-all]
bugzilla·2026-07-23·CVSS 7.5
CVE-2026-64611 [HIGH] CVE-2026-64611 cups-filters: libcupsfilters: CPU exhaustion via infinite loop in cfIEEE1284NormalizeMakeModel() [fedora-all]
CVE-2026-64611 cups-filters: libcupsfilters: CPU exhaustion via infinite loop in cfIEEE1284NormalizeMakeModel() [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
libcupsfilters through 2.1.1 contains a denial-of-service flaw in cfIEEE1284NormalizeMakeModel() in cupsfilters/ieee1284.c. When processing an IEEE-1284 device ID with an empty MDL field, modelptr equals buffer after copying zero model characters, causing the dedup loop at line 1122 to call strncasecmp(buffer, modelptr, 0) which always returns 0 and move_right_part(buffer, bufsize, modelptr, 0) which makes no progress. The loop never terminates
Bugzilla
CVE-2026-64611 libcupsfilters: cups-filters: libcupsfilters: CPU exhaustion via infinite loop in cfIEEE1284NormalizeMakeModel()
bugzilla·2026-07-20·CVSS 7.5
CVE-2026-64611 [HIGH] CVE-2026-64611 libcupsfilters: cups-filters: libcupsfilters: CPU exhaustion via infinite loop in cfIEEE1284NormalizeMakeModel()
CVE-2026-64611 libcupsfilters: cups-filters: libcupsfilters: CPU exhaustion via infinite loop in cfIEEE1284NormalizeMakeModel()
libcupsfilters through 2.1.1 contains a denial-of-service flaw in cfIEEE1284NormalizeMakeModel() in cupsfilters/ieee1284.c. When processing an IEEE-1284 device ID with an empty MDL field, modelptr equals buffer after copying zero model characters, causing the dedup loop at line 1122 to call strncasecmp(buffer, modelptr, 0) which always returns 0 and move_right_part(buffer, bufsize, modelptr, 0) which makes no progress. The loop never terminates and pins one CPU core indefinitely. The function is reachable over the network via cfIEEE1284GetMakeModel() called by cups-browsed on printer-advertised device IDs (IPP/DNS-SD). CWE-835. No upstream fix; PR #139 / commit 7
2026-01-18
Published