CVE Vulnerability Catalog

A security flaw has been discovered in Total.js Flow up to 673ef9144dd25d4f4fd4fdfda5af27f230198924. The impacted element is an unknown function of the component SVG File Handler. Performing manipulation results in unrestricted upload. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. Continuous delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

Zidentyfikowano podatność w sklepie internetowym Inferno Online Clothing Store, która dotyczy nieznanej funkcji w pliku /log.php. Manipulacja argumentami cemail lub password prowadzi do możliwości wstrzyknięcia SQL.

Wykryto podatność w urządzeniu UTT HiPER 2620G do wersji 3.1.4, która dotyczy funkcji strcpy w pliku /goform/fNTP. Manipulacja argumentem NTPServerIP prowadzi do przepełnienia bufora, co umożliwia zdalne przeprowadzenie ataku.

A vulnerability was found in UTT 进取 518G up to V3v3.2.7-210919-161313. It affects some unknown processing of the file /goform/formTaskEdit_ap. Manipulation of the txtMin2 argument results in a buffer overflow. The attack may be performed remotely, and the exploit has been made public. The vendor was contacted but did not respond.

A vulnerability has been found in UTT 进取 518G up to V3v3.2.7-210919-161313. It affects the function sub_4247AC of the file /goform/formRemoteControl. Manipulation of the Profile argument leads to a buffer overflow. The attack can be carried out remotely, and the exploit has been disclosed. The vendor was contacted but did not respond.

Wykryto podatność w urządzeniach Tomofun Furbo 360 i Furbo Mini, związana z nieznaną funkcją komponentu Root Account Handler. Manipulacja tą funkcją prowadzi do wykorzystania twardo zakodowanego hasła.

A security vulnerability was detected in Tomofun Furbo Mobile App up to 7.57.0a on Android in the Authentication Token Handler component. The manipulation leads to insecure storage of sensitive information. The attack can be launched on the physical device. The exploit has been disclosed publicly and may be used.

A vulnerability was detected in Tomofun Furbo 360 up to FB0035_FW_036. Impacted is an unknown function of the component Audio Handler. Performing manipulation results in race condition. The attack is possible to be carried out remotely.

A security vulnerability has been detected in Tomofun Furbo 360 up to FB0035_FW_036. This issue affects some unknown processing of the component Account Handler. Such manipulation leads to server-side request forgery. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The vendor was contacted early about this disclosure but did not respond in any way.

IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user to cause a denial of service by uploading specially crafted files using uncontrolled recursion.

IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to spoof email identity of the sender due to improper verification of source data.

IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete reviews from other users due to client-side enforcement of server-side security.

IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete comments from other users due to client-side enforcement of server-side security.

A weakness has been identified in Tomofun Furbo 360 up to FB0035_FW_036, affecting unknown code of the File Upload component. Manipulation causes resource consumption, and remote exploitation is possible. The vendor was contacted early but did not respond.

HCL Unica Platform is impacted by misconfigured security related HTTP headers. This can lead to less secure browser default treatment for the policies controlled by these headers.

HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability. A malicious agent may be able to induce this event by feeding a user suitable links, either directly or via another web site.

HCL Unica Platform is impacted by a misconfigured Content Security Policy (CSP). This can result in malicious resources being loaded and browsers being exposed to attacks such as cross-site scripting and clickjacking.

A path traversal vulnerability in RainyGao DocSys up to 2.02.36 in /Doc/deleteDoc.do allows manipulation of the path argument. The attack can be launched remotely, and the exploit has been publicly disclosed.

A path traversal vulnerability in RainyGao DocSys up to 2.02.36 in the updateRealDoc function of /Doc/uploadDoc.do allows manipulation of the path argument. The attack can be initiated remotely, and the exploit has been made public.

A vulnerability has been found in RainyGao DocSys up to 2.02.36. This impacts the function getUserList of the file /Manage/getUserList.do. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.