CVE Vulnerability Catalog

A vulnerability was found in NousResearch hermes-agent 0.8.0 in the _check_auth function of gateway/platforms/api_server.py, related to the API_SERVER_KEY handler. Improper authentication can be exploited remotely, though attack complexity is high. The exploit has been publicly disclosed and the project has not yet reacted.

A vulnerability was detected in code-projects Invoice System in Laravel 1.0 affecting the /item file of the API Endpoint component. Manipulation leads to improper authorization, the attack can be initiated remotely, and the exploit is publicly available.

A security vulnerability has been detected in code-projects Invoice System in Laravel 1.0. It affects an unknown function and leads to cross-site request forgery. The attack may be performed remotely, and the exploit has been disclosed publicly and may be used.

A weakness has been identified in code-projects Invoice System in Laravel 1.0. The impacted element is an unknown function of the file /company. This manipulation of the argument logo causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

In Tenda F456 1.0.0.5, the FromWriteFacMac function in /goform/WriteFacMac (httpd component) does not neutralize the mac argument, leading to command injection. The attack can be executed remotely and the exploit has been made public.

A vulnerability was identified in code-projects Employee Management System 1.0 affecting 370project/edit.php. Manipulation of the ID argument leads to cross-site scripting, the attack can be initiated remotely, and the exploit is publicly available.

The OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions. This may lead to account token hijacking and sensitive information disclosure.

A vulnerability was found in code-projects Invoice System in Laravel 1.0. Affected by this vulnerability is an unknown functionality of the file /invoice/ of the component Invoice Endpoint. Performing a manipulation of the argument ID results in improper authorization. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

A vulnerability has been found in code-projects Invoice System in Laravel 1.0, affecting an unknown function of the /profile/ file in the Profile Handler component. Manipulation of the ID argument leads to improper authorization, and the attack can be performed remotely. The exploit has been publicly disclosed and may be used.

A flaw has been found in code-projects Invoice System in Laravel 1.0, impacting an unknown function of the /user file in the User Management Handler component. Manipulation causes improper authorization, and remote exploitation is possible. The exploit has been published and may be used.

A security vulnerability has been detected in code-projects Home Service System 1.0 in an unknown function of /booking.php within the Appointment Booking component. Manipulation of the fname/lname arguments leads to cross-site scripting, and the attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

A vulnerability was identified in HBAI-Ltd Toonflow-app up to 1.1.1 affecting the updateStoryboardUrl function in replaceUrl.ts of the Storyboard Export component; manipulation of the url argument leads to path traversal. The attack can be launched remotely and a public exploit may be used. The vendor states the URL is designed to be local or trusted unless the user modifies the code.

A vulnerability was determined in HBAI-Ltd Toonflow-app up to 1.1.1 in the z.url function of src/routes/setting/about/downloadApp.ts (downloadApp Endpoint), where manipulation of the url argument causes path traversal. The attack can be initiated remotely, is considered high complexity, and the exploit has been publicly disclosed. The real existence of this vulnerability is still doubted, and the vendor states the update URL is statically compiled in the official repository.

A vulnerability was found in HBAI-Ltd Toonflow-app up to 1.1.1. It affects the fetch function of the file src/routes/setting/vendorConfig/getCodeByLink.ts of the getCodeByLink Endpoint component. Manipulation of the Link argument results in server-side request forgery. There is ongoing doubt regarding the real existence of this vulnerability.

A vulnerability has been found in likeadmin-likeshop likeadmin_php up to 1.9.6 in the queryResult function of server\app\adminapi\lists\tools\DataTableLists.php (dataTable Admin API), leading to SQL injection. The attack is possible remotely and the exploit has been disclosed. The project was informed but has not responded.

An improper ownership management vulnerability in Moxa's Secure Router allows a low-privileged authenticated user to access a configuration file containing the hashed password of the administrative account. Exploitation is only possible when the configuration file has been exported, and it does not impact integrity or availability.

In CodeAstro Online Job Portal 1.0, an unknown functionality of /users/user-cvs/ leads to file and directory information exposure. Remote exploitation is possible and the exploit has been publicly disclosed.

There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event log data is loaded, the contents of the database may be altered.

A vulnerability was found in 666ghj MiroFish up to 0.1.2. The get_simulation_posts function in backend/app/api/simulation.py (Query Parameter Handler component) allows path traversal via manipulation of the Platform argument. The attack can be initiated remotely and the exploit has been made public.

In baomidou dynamic-datasource 2.5.0, the DsSpelExpressionProcessor#doDetermineDatasource function in DsSpelExpressionProcessor.java (StandardEvaluationContext/SpelExpressionParser component) allows injection through manipulation. The attack may be initiated remotely, and a patch named 273fcedaee984c08197c0890f14190b86ab7e0b8 is available.