CVE Vulnerability Catalog

A flaw was found in linlinjava litemall 1.5.0/1.6.0/1.7.0/1.8.0 in the function AdminTopicController.validate of litemall-vue/src/views/items/topic/index.vue of the Admin Topic Handler component. Manipulation causes cross site scripting and the attack may be initiated remotely. The project was informed early but has not responded yet.

A vulnerability was detected in moxi624 Mogu Blog v2 up to 5.2 in the function BlogSortServiceImpl.addBlogSort of mogu_web/src/main/resources/templates/info.ftl of the blogSort Endpoint component. Manipulation of the sortName argument results in cross site scripting and the attack can be launched remotely. The project was informed early but has not responded yet.

A security vulnerability was detected in quequnlong shiyi-blog up to 1.2.1 in the function highlightKeyword of blog-web/src/components/Search/index.vue of the Search component. Manipulation of the title/summary argument leads to cross site scripting and the attack can be initiated remotely. The project was informed early through an issue report.

A weakness has been identified in Rizwan17 inventory-management-system in the createUserAccount function of register.php. Manipulation of the usertype argument leads to improper authorization, allowing remote attacks. The exploit has been publicly disclosed and may be used.

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is an unknown function of the file dashboard.php. Performing a manipulation of the argument userid results in improper access controls. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was identified in quequnlong shiyi-blog 1.0.0-1.2.1 in the function SysChatMsgMapper.getChatMsgList of blog-web/src/views/chat/index.vue of the chat sendMsg Endpoint component. Manipulation of the chat_msg argument leads to cross site scripting and the attack may be performed from remote. The project was informed early but has not responded yet.

A vulnerability was found in maliangnansheng bbs-springboot version 3.0.0. It affects the utils.toToc function in ArticleController.java and allows cross site scripting (XSS). The attack can be carried out remotely.

A vulnerability was found in DataEase up to versions 2.10.25/2.10.26. It affects the buildTooltip function in symbolic-map.ts of the Symbolic Map component, where manipulation of the canvasViewInfo[*].customAttr.tooltip.backgroundColor argument leads to cross site scripting (XSS). The attack can be performed remotely, and the project was informed early via an issue report but has not responded.

A flaw was found in TDuckApp tduck-platform up to version 5.3. It affects an unknown functionality in tduck-front/src/views/form/write/index.vue of the Form Write View component, where manipulation of the submitShowCustomPageContent argument causes cross site scripting (XSS). The attack can be carried out remotely, and the project was informed early via an issue report but has not responded.

A vulnerability was detected in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file blog-admin/src/views/message/message/index.vue of the component Add Message API. The manipulation of the argument body.content results in cross site scripting. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.

A security vulnerability has been detected in SourceCodester School Registration and Fee System 1.0 in /bilal/save_class.php. Manipulation of the Category argument leads to SQL injection, allowing remote exploitation. The exploit has been publicly disclosed.

A weakness has been identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/cust_pos_trans.php. Executing a manipulation of the argument firstname can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

A security flaw has been discovered in jaychouchannel Tourism-Management-System in the Update Endpoint component. Manipulation leads to missing authentication, allowing remote attacks. The exploit has been released and a patch is available.

A vulnerability was identified in jaychouchannel Tourism-Management-System in the User Register Endpoint component (UsersController.java). Manipulation of the UsersEntity argument leads to improper privilege management, allowing remote attacks. The exploit is publicly available and a patch exists.

MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in 32-bit arithmetic. Attackers can craft a malicious AVI file with oversized entry counts, causing a heap buffer overflow when parsed by mkvmerge.

S2OPC through 1.7.3 contains a null pointer dereference in msg_subscription_publish_bs__alloc_notification_message_items() where a failed allocation for DataChangeNotification is overwritten by a successful allocation for EventNotificationList. Attackers can trigger heap allocation failures on sessions with both data-change and event notifications to cause the server process to terminate.

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process.

A vulnerability was determined in jaychouchannel Tourism-Management-System in the resetPass function of UsersController.java (Password Recovery component). Manipulation causes weak password recovery, allowing remote attacks. The exploit has been publicly disclosed and a patch is available.

A vulnerability was found in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. This issue affects some unknown processing of the file MenpiaodingdanController.java of the component CRUD. The manipulation of the argument ID results in authorization bypass. It is possible to launch the attack remotely. The exploit has been made public and could be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The patch is identified as d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86. It is best practice to apply a patch to resolve this issue.

A vulnerability was found in jaychouchannel Tourism-Management-System in AuthorizationInterceptor.java of the Authorization Interceptor component. Manipulation leads to improper authorization and the attack can be launched remotely. The exploit has been publicly disclosed and may be used.