CVE Vulnerability Catalog

The Lotus Cars Android app (com.lotus.carsdomestic.intl) version 1.2.8 has allowBackup=true set in its manifest, allowing data exfiltration via ADB backup on rooted or debug-enabled devices. This poses a risk of user data exposure.

The Lotus Cars Android app (version 1.2.8) exposes the PushDeepLinkActivity component without authentication, accessible via ADB or malicious apps. This allows unauthorized access to internal app mechanisms, potentially leading to denial of service or logic abuse.

EyouCMS 1.7.3 is vulnerable to Cross Site Scripting (XSS) in index.php, which can be exploited to obtain sensitive information.

An XSS vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to inject malicious JavaScript via the title parameter. The attack can be executed without authentication if the endpoint does not require authorization.

An XSS vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to inject malicious JavaScript via the email parameter, which executes in the victim's browser.

An XSS vulnerability in the /Calendar endpoint of hortusfox-web v4.4 allows attackers to inject malicious JavaScript via the add function, executing in the victim's browser.

An Integer Overflow vulnerability exists in FortiOS, FortiProxy, and FortiPAM that may allow an authenticated user to affect the device's SSL-VPN availability via crafted requests.

Improper validation of syntactic correctness of input in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Improper handling of additional special element in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.

In WuKongOpenSource WukongCRM 11.0, a vulnerability in the /adminFile/upload file of the API Response Handler component leads to information exposure through error messages. The attack can be performed remotely, and exploit details are publicly available.

Operator-SDK before version 0.15.2 includes a user_setup script that sets /etc/passwd permissions to 664 (group-writable) with root group ownership (gid=0) during build time. An attacker with access to the container, even as a non-root user, can leverage membership in the root group to modify /etc/passwd and add a user with arbitrary UID, including 0, leading to full root privileges within the container.

An issue in 4C Strategies Exonaut before version 22.4 allows attackers to perform a directory traversal attack. This vulnerability enables reading files outside the intended directory.

EyouCMS 1.6.7 is vulnerable to Cross Site Scripting (XSS) in /login.php?m=admin&c=System&a=web&lang=cn. An attacker can inject malicious JavaScript code that executes in the victim's browser.

An SSRF vulnerability in Vedo Suite 2024.17 allows authenticated attackers to send HTTP requests to arbitrary external paths via the "file" parameter in the /api_vedo/video/preview endpoint.

A local file inclusion (LFI) vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'readfile()' function call in '/api_vedo/video/preview'.

A vulnerability in Vedo Suite 2024.17 allows unauthenticated remote attackers to obtain a valid high-privilege JWT token by sending an empty HTTP POST request to the /autologin/ endpoint, due to incorrect access control.

A Cross-site scripting (XSS) vulnerability in /api_vedo/ in Vedo Suite version 2024.17 allows remote attackers to inject arbitrary JavaScript or HTML code, potentially leading to code execution in the victim's browser.

A path traversal vulnerability in Vedo Suite 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'file_get_contents()' function call in '/api_vedo/template'.

An access control issue was discovered in 4C Strategies Exonaut prior to version 22.4, which may allow unauthorized users to access resources without proper permissions.