致远OA

Zhiyuan OA Platform - Arbitrary File Upload

An arbitrary file upload vulnerability exists in the Zhiyuan OA platform 5.0, 5.1 - 5.6sp1, 6.0 - 6.1sp2, 7.0, 7.0sp1 - 7.1, 7.1sp1, and 8.0 - 8.0sp2 via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server.

Seeyon A8 Management Monitor - Default Login

Seeyon OA A8-m has status monitoring page information leakage. Attackers can obtain sensitive information such as website paths and user names for further attacks. Attackers can use this vulnerability to directly enter the application system or management system to conduct system, web page, data tampering and deletion, illegally obtaining system and user data, and may even cause the server to collapse.

Zhiyuan Oa Unauthorized

Zhiyuan Oa is exposed.

Zhiyuan OA Session Leak

A vulnerability in Zhiyuan OA allows remote unauthenticated users access to sensitive session information via the 'getSessionList.jsp' endpoint.

Zhiyuan Oa A6-s info Leak

Zhiyuan OA Arbitrary File Upload Vulnerability

A vulnerability in Zhiyuan OA allows remote unauthenticated attackers to upload arbitrary files to the remote server and cause execute arbitrary code to be executed.

Seeyon WooYun - Local File Inclusion

Seeyon WooYun allows remote attackers to include the content of locally stored content and disclose it back to the attacker via local file inclusion.

Seeyon OA A8 - Default Login

Seeyon (seeyon) OA A8+ Enterprise Edition has a weak password vulnerability, which can be used to log in to the background

致远OA M1Server userTokenService 远程命令执行漏洞

致远 M1 Server是一个移动服务。致远 M1 Server userTokenService 代码执行漏洞，攻击者可通过该漏洞在服务器端任意执行代码，写入后门，获取服务器权限，进而控制整个web服务器。

Seeyon OA wpsAssistServlet - Arbitrary File Upload

There is an arbitrary file upload vulnerability in the Seeyon OA wpsAssistServlet interface. Through the vulnerability, an attacker can send a specific request packet to upload malicious files and obtain server permissions.

Seeyon OA A6 setextno.jsp - SQL Injection

Seeyon OA A6 initDataAssess.jsp has leaked user sensitive information,You can blast the user password through the obtained username to enter the background for further attacks

Seeyon OA Fastjson Remote Code Execution

Seeyon OA Fastjson is vulnerable to RCE.

Seeyon OA A6 initDataAssess.jsp - Information Disclosure

Seeyon OA A6 initDataAssess.jsp has leaked user sensitive information, attacker can use the obtained username to blast the user's password to enter the background for further attacks.

Seeyon OA A6 createMysql.jsp Database - Information Disclosure

Seeyon OA A6 has leaked sensitive database information. An attacker can obtain the database account and password MD5 by accessing a specific URL.

致远OA 帆软组件 ReportServer 目录遍历漏洞

Seeyon OA A6 config.jsp - Information Disclosure

The Seeyon OA A6 config.jsp page can be accessed without authorization, resulting in sensitive information leakage vulnerabilities, through which attackers can obtain sensitive information in the server

Seeyon OA (Log4j) - Remote Code Execution

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Seeyon Unauthoried Access

Seeyon is vulnerable to unauthorised access.

Seeyon - Local File Inclusion

Seeyon is vulnerable to local file inclusion.