Yonyou

Records45All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical9CVSS 9.0–10.0

CVSS high5CVSS 7.0–8.9

Exploited now

Yonyou records in CISA KEV

No Yonyou vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Ksoa 20 records HIGH Yonbip 6 records MEDIUM Ufida Erp-nc 4 records MEDIUM Turbocrm 1 record LOW U8+ 1 record MEDIUM Ufida-nc 1 record LOW Ufida Product Lifecycle Management 1 record MEDIUM Yonyou 1 record LOW

Records

6 records in Yonbip · all components

TI-2023-28458 CVE-2023-51928 · GHSA-36mq-j57w-rh2g

An arbitrary file upload vulnerability in the…

MEDIUM 50

An arbitrary file upload vulnerability in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3_23.05 allows attackers to execute arbitrary code via uploading a crafted file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00769 Published 2024-01-20 No fix listed CWE-434

TI-2023-28457 CVE-2023-51927 · GHSA-hq74-5cxf-phqw

YonBIP v3_23.05 was discovered to contain a SQL injection vulnerability via the…

MEDIUM 50

YonBIP v3_23.05 was discovered to contain a SQL injection vulnerability via the com.yonyou.hrcloud.attend.web.AttendScriptController.runScript() method.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00555 Published 2024-01-20 No fix listed CWE-89

TI-2023-28454 CVE-2023-51924 · GHSA-vf8q-f3vp-ccgf

An arbitrary file upload vulnerability in the uap.framework.rc.itf.IResourceManager…

MEDIUM 50

An arbitrary file upload vulnerability in the uap.framework.rc.itf.IResourceManager interface of YonBIP v3_23.05 allows attackers to execute arbitrary code via uploading a crafted file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00769 Published 2024-01-20 No fix listed CWE-434

TI-2023-28453 CVE-2023-51906 · GHSA-jc3c-72g2-mm2j

An issue in yonyou YonBIP v3_23.05 allows a remote attacker to execute arbitrary code via…

MEDIUM 45

An issue in yonyou YonBIP v3_23.05 allows a remote attacker to execute arbitrary code via a crafted script to the ServiceDispatcherServlet uap.framework.rc.itf.IResourceManager component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00982 Published 2024-01-20 No fix listed

TI-2023-28455 CVE-2023-51925 · GHSA-4g25-v4mv-2xm5

An arbitrary file upload vulnerability in the…

MEDIUM 44

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00769 Published 2024-01-20 No fix listed CWE-434

TI-2023-28456 CVE-2023-51926 · GHSA-xhgx-qvgm-xg3q

YonBIP v3_23.05 was discovered to contain an arbitrary file read vulnerability via the…

LOW 39

YonBIP v3_23.05 was discovered to contain an arbitrary file read vulnerability via the nc.bs.framework.comn.serv.CommonServletDispatcher component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00505 Published 2024-01-20 No fix listed

Open these records in search →

Critical	9
High	5
Medium	31
Low	0
No CVSS	0