CVE Vulnerability Catalog

A vulnerability was identified in quequnlong shiyi-blog 1.0.0-1.2.1 in the function SysChatMsgMapper.getChatMsgList of blog-web/src/views/chat/index.vue of the chat sendMsg Endpoint component. Manipulation of the chat_msg argument leads to cross site scripting and the attack may be performed from remote. The project was informed early but has not responded yet.

A vulnerability was found in maliangnansheng bbs-springboot version 3.0.0. It affects the utils.toToc function in ArticleController.java and allows cross site scripting (XSS). The attack can be carried out remotely.

A vulnerability was found in DataEase up to versions 2.10.25/2.10.26. It affects the buildTooltip function in symbolic-map.ts of the Symbolic Map component, where manipulation of the canvasViewInfo[*].customAttr.tooltip.backgroundColor argument leads to cross site scripting (XSS). The attack can be performed remotely, and the project was informed early via an issue report but has not responded.

A flaw was found in TDuckApp tduck-platform up to version 5.3. It affects an unknown functionality in tduck-front/src/views/form/write/index.vue of the Form Write View component, where manipulation of the submitShowCustomPageContent argument causes cross site scripting (XSS). The attack can be carried out remotely, and the project was informed early via an issue report but has not responded.

A vulnerability was detected in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file blog-admin/src/views/message/message/index.vue of the component Add Message API. The manipulation of the argument body.content results in cross site scripting. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.

A security vulnerability has been detected in SourceCodester School Registration and Fee System 1.0 in /bilal/save_class.php. Manipulation of the Category argument leads to SQL injection, allowing remote exploitation. The exploit has been publicly disclosed.

A weakness has been identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/cust_pos_trans.php. Executing a manipulation of the argument firstname can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

A security flaw has been discovered in jaychouchannel Tourism-Management-System in the Update Endpoint component. Manipulation leads to missing authentication, allowing remote attacks. The exploit has been released and a patch is available.

A vulnerability was identified in jaychouchannel Tourism-Management-System in the User Register Endpoint component (UsersController.java). Manipulation of the UsersEntity argument leads to improper privilege management, allowing remote attacks. The exploit is publicly available and a patch exists.

MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in 32-bit arithmetic. Attackers can craft a malicious AVI file with oversized entry counts, causing a heap buffer overflow when parsed by mkvmerge.

S2OPC through 1.7.3 contains a null pointer dereference in msg_subscription_publish_bs__alloc_notification_message_items() where a failed allocation for DataChangeNotification is overwritten by a successful allocation for EventNotificationList. Attackers can trigger heap allocation failures on sessions with both data-change and event notifications to cause the server process to terminate.

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process.

A vulnerability was determined in jaychouchannel Tourism-Management-System in the resetPass function of UsersController.java (Password Recovery component). Manipulation causes weak password recovery, allowing remote attacks. The exploit has been publicly disclosed and a patch is available.

A vulnerability was found in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. This issue affects some unknown processing of the file MenpiaodingdanController.java of the component CRUD. The manipulation of the argument ID results in authorization bypass. It is possible to launch the attack remotely. The exploit has been made public and could be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The patch is identified as d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86. It is best practice to apply a patch to resolve this issue.

A vulnerability was found in jaychouchannel Tourism-Management-System in AuthorizationInterceptor.java of the Authorization Interceptor component. Manipulation leads to improper authorization and the attack can be launched remotely. The exploit has been publicly disclosed and may be used.

A weakness was identified in PHPGurukul Bank Locker Management System 1.0 in /blms/banker/add-locker-form.php. Manipulation of the addressproof argument causes unrestricted upload and the attack can be performed remotely. The exploit is publicly available and could be used for attacks.

SIPp through 3.7.7 contains a buffer overflow in the get_header() function in src/sip_parser.cpp when processing SIP messages with headers exceeding 20,490 bytes. Unauthenticated remote attackers can send crafted SIP messages with oversized headers to overflow the static buffer and crash the process.

SIPp through 3.7.7 contains a stack buffer overflow in createAuthHeader() when processing SIP authentication challenges with oversized algorithm parameters. A malicious SIP server can send a crafted 401 or 407 challenge to corrupt the stack and crash the client process.

SIPp through 3.7.7 contains a buffer overflow in get_peer_tag() when processing SIP To headers with tag parameters of 2049 bytes or more. Unauthenticated remote attackers can send crafted SIP messages with oversized tag parameters to overflow the static buffer and crash the process.

ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weights_only=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code during deserialization when loaded through the initialization or fine-tuning path.