CVE Vulnerability Catalog

A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2 affecting the function MainController.autoUpdate in /adminPage/main/autoUpdate. Manipulation of the url argument causes code injection. Remote exploitation is possible and the exploit has been publicly disclosed.

A vulnerability was found in FlowiseAI Flowise up to 3.0.2 affecting the function axios.post in packages/server/src/controllers/evaluations/index.ts of the Evaluations Endpoint component. Manipulation of the Host/X-Forwarded-Proto argument results in server-side request forgery. The attack may be launched remotely and the exploit is public. Upgrading to version 3.1.3 (patch 700137738bcaebefd4709021f6d6b0abcd7df0ac) resolves the issue.

CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list. The lack of logging makes it difficult to detect unauthorized changes.

CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic. This may lead to incorrect function behavior.

A use-after-free flaw was found in GPAC up to f1219cde in the gf_list_count function of utils/list.c, used by the MP4Box component. The attack requires local access and a public exploit is already available. The issue is fixed in version abi-16.23 (patch 49dee5cad329cfed310c1682703df7daa47df31a).

A heap-based buffer overflow was detected in GPAC up to f1219cde in the gf_node_get_field function of scenegraph/base_scenegraph.c, used by the MP4Box component. The attack requires local access and a public exploit is already available. The issue is fixed in version abi-16.23 (patch 49dee5cad329cfed310c1682703df7daa47df31a).

Zettlab D6 Ultra before 1.7.0 allows mounting /etc/passwd and /etc/shadow in a container via ".." manipulations such as volumes: - ../../../../../../../etc:/h_etc:rw in a compose file.

In LibreNMS 1.65, a remote authenticated attacker with normal privileges can extract all information from the LibreNMS database via SQL injection in the searchPhrase parameter in the /ajax_table.php API endpoint. This affects multiple files in includes/html/table, including as-selection.inc.php, edit-ports.inc.php, alertlog-stats.inc.php, alerts.inc.php, eventlog.inc.php, inventory.inc.php, ix-list.inc.php, ix-peers.inc.php, mempool-edit.inc.php, mempool.inc.php, poll-log.inc.php, processor-edit.inc.php, processor.inc.php, routing-edit.inc.php, sensors-common.inc.php, storage-edit.inc.php, storage.inc.php, and toner.inc.php.

A SQL injection vulnerability was discovered in itsourcecode Sales and Inventory System 1.0 in an unknown function of /pages/emp_transac.php?action=add. Manipulation of the firstname argument leads to SQL injection. The attack can be performed remotely and the exploit has been publicly disclosed.

A vulnerability was determined in davenardella snap7 up to 1.4.3 in the TSnap7MicroClient::opUpload function of src/core/s7_micro_client.cpp. Manipulation of the DataLen argument can lead to memory corruption. The attack can be executed remotely and the exploit has been publicly disclosed. The project was informed but has not responded.

A vulnerability was found in Exrick xmall up to 19e7917d5ed3bd2a2421a3a246ad494c133ba94c. Impacted is an unknown function of the file xmall-manager-web/src/main/webapp/WEB-INF/jsp/order-print.jsp of the component Order Printing. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is an unknown function of the file dashboard.php. Performing a manipulation of the argument userid results in improper access controls. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was detected in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file blog-admin/src/views/message/message/index.vue of the component Add Message API. The manipulation of the argument body.content results in cross site scripting. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.

A weakness has been identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/cust_pos_trans.php. Executing a manipulation of the argument firstname can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

S2OPC through 1.7.3 contains a null pointer dereference in msg_subscription_publish_bs__alloc_notification_message_items() where a failed allocation for DataChangeNotification is overwritten by a successful allocation for EventNotificationList. Attackers can trigger heap allocation failures on sessions with both data-change and event notifications to cause the server process to terminate.

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process.

A vulnerability was found in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. This issue affects some unknown processing of the file MenpiaodingdanController.java of the component CRUD. The manipulation of the argument ID results in authorization bypass. It is possible to launch the attack remotely. The exploit has been made public and could be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The patch is identified as d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86. It is best practice to apply a patch to resolve this issue.

A vulnerability was found in jaychouchannel Tourism-Management-System in AuthorizationInterceptor.java of the Authorization Interceptor component. Manipulation leads to improper authorization and the attack can be launched remotely. The exploit has been publicly disclosed and may be used.

A weakness was identified in PHPGurukul Bank Locker Management System 1.0 in /blms/banker/add-locker-form.php. Manipulation of the addressproof argument causes unrestricted upload and the attack can be performed remotely. The exploit is publicly available and could be used for attacks.

PostGIS address_standardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers can craft malicious rule rows with out-of-range Weight values to trigger out-of-bounds reads in the load_value array, causing the PostgreSQL backend process to crash and terminate all cluster sessions.