CVE Vulnerability Catalog

XunRuiCMS (dayrui) through version 4.7.4 has a flaw in the str_replace function in /var/www/html/zzmob/index.php within the Mobile Site Directory component. Manipulation of the dirname argument results in code injection, and the attack can be launched remotely.

A Denial of Service (DoS) vulnerability was found in the window module. Successful exploitation may affect service availability.

An out-of-bounds read (OOB read) vulnerability was found in the peripheral module. Successful exploitation may affect service confidentiality.

A use-after-free (UAF) vulnerability was found in the location service module. Successful exploitation may affect service availability.

A race condition vulnerability was found in the location service module. Successful exploitation may affect service availability.

A permission control vulnerability was found in the WLAN module. Successful exploitation may affect service confidentiality.

A Denial of Service (DoS) vulnerability was found in the file parsing module. Successful exploitation may affect service availability.

A buffer overflow vulnerability exists in the file preview module. Successful exploitation of this vulnerability may affect availability.

A permission control vulnerability exists in the Optimizer module. Successful exploitation of this vulnerability may affect service confidentiality.

A permission control vulnerability was found in the event notification management module. Successful exploitation may affect service confidentiality.

A null pointer dereference vulnerability exists in the ArkWeb module. Successful exploitation of this vulnerability may affect availability.

A DoS vulnerability exists in the DSoftBus module. Successful exploitation of this vulnerability may affect availability.

A DoS vulnerability exists in the DSoftBus module. Successful exploitation of this vulnerability may affect availability.

A permission control vulnerability exists in the graphics module. Successful exploitation of this vulnerability may affect confidentiality.

A permission control vulnerability exists in the background task management module. Successful exploitation of this vulnerability may affect service integrity.

A DoS vulnerability exists in the file parsing module. Successful exploitation of this vulnerability may affect availability.

A vulnerability was identified in dayrui XunRuiCMS up to 4.7.4, affecting the _get_tpl_content function in dayrui/Fcms/Library/Notice.php within the Email Template Rendering component. The manipulation leads to code injection, and the attack can be initiated remotely. The exploit is publicly available and might be used; the vendor did not respond to the disclosure.

A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4, affecting the View function in dayrui/Fcms/Core/View.php within the Member Module component. Manipulating the catid argument leads to SQL injection, and the attack can be launched remotely. The exploit has been publicly disclosed and may be utilized; the patch is identified as 9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231.

A vulnerability was found in the WAVLINK WN551X3-A device, affecting the sub_41a430 function in /bin/ioos within the DNS Resolution Handler component. Manipulating the data argument results in OS command injection, and the attack can be launched remotely. The exploit has been made public and could be used.

The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product. APIs exposed through the WSO2 API Manager's API Gateway are not affected.