Ruvar vulnerabilities
We track 7 vulnerabilities in Ruvar products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on May 8, 2024.
Latest Ruvar vulnerabilities
- 9.4 Critical severity
ruvarOA: Improper Neutralization of Special Elements used in an SQL Command
Error messages in RuvarOA v6.01 and v12.01 were discovered to leak the physical path of the website (/WorkFlow/OfficeFileUpdate.aspx). This vulnerability can allow attackers to write files to the server or execute arbitrary commands via crafted SQL statements.
- 9.4 Critical severity
ruvarOA: Improper Neutralization of Special Elements used in an SQL Command
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkPlan/WorkPlanAttachDownLoad.aspx.
- 9.4 Critical severity
ruvarOA: Improper Neutralization of Special Elements used in an SQL Command
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the office_missive_id parameter at /WorkFlow/wf_work_form_save.aspx.
- 9.4 Critical severity
ruvarOA: Improper Neutralization of Special Elements used in an SQL Command
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the template_id parameter at /WorkFlow/wf_get_fields_approve.aspx.
- 7.3 High severity
ruvarOA: Improper Neutralization of Special Elements used in an SQL Command
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkFlow/wf_work_finish_file_down.aspx.
- 9.4 Critical severity
ruvarOA: Improper Neutralization of Special Elements used in an SQL Command
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the template_id parameter at /SysManage/wf_template_child_field_list.aspx.
- 9.4 Critical severity
ruvarOA: Improper Neutralization of Special Elements used in an SQL Command
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkFlow/wf_file_download.aspx.