CVE Vulnerability Catalog

A cross-site scripting (XSS) vulnerability exists in xnx3 wangmarket up to 6.4 in an unknown function of /siteVar/save.do (Add Global Variable Handler component). Manipulation of the Remark/Variable Value argument leads to XSS. The attack can be executed remotely and the exploit is public.

Vulnerability in Uasoft Badaso up to 2.9.7 in the forgetPassword function of the Token Handler component. Weak password recovery allows remote attack, though with high complexity.

A missing authorization vulnerability in the Automattic Crowdsignal Forms plugin allows exploitation of incorrectly configured access control security levels. This issue affects Crowdsignal Forms from n/a through <= 1.7.2.

A vulnerability was found in D-Link DCS-850L 1.02.09. The function uploadfirmware of the Firmware Update Service component is affected. Manipulation of the argument DownloadFile results in path traversal. The attack must originate from the local network. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

A vulnerability has been found in PHPEMS up to 11.0. This impacts an unknown function of the component Purchase Request Handler. The manipulation leads to race condition. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used.

A vulnerability was detected in PHPEMS up to version 11.0. It affects an unknown function of the Coupon Handler component. Manipulation leads to a race condition. The attack can be initiated remotely, but the attack complexity is rather high and exploitability is considered difficult. The exploit is now public and may be used.

A security vulnerability was detected in CloudPanel Community Edition up to version 2.5.1. It affects an unknown function in the /admin/users file of the HTTP Header Handler component. Manipulation of the Referer argument leads to an open redirect. The attack can be launched remotely. The exploit has been publicly disclosed. Upgrading to version 2.5.2 fixes the issue.

A flaw was found in SohuTV CacheCloud up to version 3.2.0. It affects the index function in the file src/main/java/com/sohu/cache/web/controller/AppDataMigrateController.java. This manipulation causes cross-site scripting. Remote exploitation is possible. The exploit has been published and may be used. The project was informed but has not responded.

In SohuTV CacheCloud up to 3.2.0, the doMachineList/doPodList functions in MachineManageController.java are vulnerable to cross-site scripting (XSS). The attack can be performed remotely, and the exploit has been publicly disclosed. The project has not responded to the issue report.

A vulnerability was found in Campcodes Park Ticketing System 1.0. The impacted element is the function save_pricing of the file admin_class.php. The manipulation of the argument name/ride results in cross site scripting. The attack may be performed from remote and the exploit is public.

A vulnerability in the qs library (parse module) involves improper input validation — the arrayLimit option was not enforced for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This allows arrays larger than the defined limit to be created. The default parameterLimit (1000) effectively mitigates the practical impact.

A vulnerability was determined in SohuTV CacheCloud up to 3.2.0. The function doQuartzList in QuartzManageController.java is affected. Executing manipulation can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed but has not responded.

A vulnerability was found in SohuTV CacheCloud up to 3.2.0. The function index in ResourceController.java is affected. Performing manipulation results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and could be used. The project was informed but has not responded.

In SohuTV CacheCloud up to 3.2.0, the taskQueueList function in TaskController.java is vulnerable to cross-site scripting (XSS). The attack can be performed remotely, and the exploit has been publicly disclosed. The project has not responded to the issue report.

A cross-site scripting vulnerability was found in SohuTV CacheCloud up to 3.2.0 in the redirectNoPower function in WebResourceController.java. The attack can be executed remotely and the exploit has been published. The project has not responded.

A cross-site scripting vulnerability was found in SohuTV CacheCloud up to 3.2.0 in functions getExceptionStatisticsByClient/getCommandStatisticsByClient/doIndex in AppClientDataShowController.java. The attack can be executed remotely and the exploit is public. The project has not responded.

W funkcji d_unqualified_name w pliku cp-demangle.c w BinUtils 2.26 odkryto problem, który pozwala atakującym na spowodowanie odmowy usługi poprzez spreparowany plik PE.

A vulnerability was determined in Campcodes Complete Online Beauty Parlor Management System 1.0 affecting unknown code in /admin/search-invoices.php. Manipulating the searchdata argument can lead to cross site scripting. The attack can be launched remotely and the exploit has been publicly disclosed.

A vulnerability was found in GreenCMS up to version 2.3 in the file /DataController.class.php of the File Handler component. Manipulation of the sqlFiles/zipFiles arguments leads to path traversal. The attack can be initiated remotely and the exploit has been made public.

A vulnerability was detected in SohuTV CacheCloud up to 3.2.0 affecting the doAppList/appCommandAnalysis function in src/main/java/com/sohu/cache/web/controller/AppController.java. Manipulating input results in cross site scripting. The attack can be launched remotely and the exploit is publicly available.