CVE Vulnerability Catalog

A security vulnerability was detected in SohuTV CacheCloud up to 3.2.0 affecting the doAppAuditList function in src/main/java/com/sohu/cache/web/controller/AppManageController.java. Such manipulation leads to cross site scripting. The attack may be performed remotely and the exploit has been publicly disclosed.

A cross-site scripting vulnerability was found in SohuTV CacheCloud up to 3.2.0 in the advancedAnalysis function in InstanceController.java. The attack can be executed remotely and the exploit is publicly available. The project has not responded.

A cross-site scripting vulnerability was found in SohuTV CacheCloud up to 3.2.0 in the preview function in RedisConfigTemplateController.java. The attack can be executed remotely and the exploit has been publicly released. The project has not responded.

A cross-site scripting vulnerability was found in SohuTV CacheCloud up to 3.2.0 in the index function in ServerController.java. The attack can be executed remotely and the exploit is publicly available. The project has not responded.

A weakness was identified in PbootCMS up to version 3.2.12 in the file /data/pbootcms.db of the SQLite Database component. Manipulation leads to files or directories accessible. The attack can be launched remotely but is difficult to exploit.

A vulnerability in TaleLin Lin-CMS up to 0.6.0 involves the /tests/config.py file where username/password arguments are stored in a configuration file. The attack can be performed remotely but has high complexity and is difficult to exploit. The exploit has been publicly disclosed.

A vulnerability has been found in rawchen ecms up to b59d7feaa9094234e8aa6c8c6b290621ca575ded in the updateProductServlet function of src/servlet/product/updateProductServlet.java (Add New Product Page component). Manipulation of the productName argument leads to cross site scripting, and remote exploitation is possible. The exploit has been disclosed publicly and may be used; the vendor did not respond.

A vulnerability was detected in SohuTV CacheCloud up to 3.2.0 in the doUserList function of src/main/java/com/sohu/cache/web/controller/UserManageController.java. Manipulation leads to cross site scripting, and the attack may be initiated remotely. The exploit is now public and may be used; the project has not responded.

A security vulnerability has been detected in SohuTV CacheCloud up to 3.2.0 in the doTotalList function of src/main/java/com/sohu/cache/web/controller/TotalManageController.java. Manipulation leads to cross site scripting, and the attack can be launched remotely. The exploit has been disclosed publicly and may be used; the project has not responded.

A vulnerability in Halo up to version 2.21.10 affects some unknown processing in the file /actuator of the Configuration Handler component. Manipulation leads to information disclosure. The attack may be performed remotely but requires high complexity and is difficult to exploit. The exploit has been publicly disclosed.

A security flaw has been discovered in yourmaileyes MOOC up to 1.17 in the subreview function of mooc/controller/MainController.java (Submission Handler component). Manipulation of the review argument results in cross site scripting, and the attack can be initiated remotely. The exploit has been released to the public and may be exploited; the project has not responded.

A weakness was identified in JeecgBoot up to version 3.9.0 in the function getPositionUserList of the file /sys/position/getPositionUserList. Manipulation of the positionId argument causes improper authorization. The attack may be initiated remotely but is difficult to exploit. The vendor was contacted but did not respond.

A security flaw was discovered in JeecgBoot up to version 3.9.0 in the function queryDepartPermission of the file /sys/permission/queryDepartPermission. Manipulation of the departId argument results in improper authorization. The attack can be launched remotely but is difficult to exploit. The vendor was contacted but did not respond.

A vulnerability in JeecgBoot up to version 3.9.0 affects the getParameterMap function in the file /sys/sysDepartPermission/list. Manipulation of the departId argument leads to improper authorization. The attack can be initiated remotely but requires high complexity and is difficult to exploit. The exploit is publicly available.

A vulnerability in JeecgBoot up to version 3.9.0 affects an unknown function in the file /sys/sysDepartPermission/datarule/. Manipulation leads to improper authorization. The attack can be launched remotely but requires high complexity and is difficult to exploit. The exploit is publicly disclosed.

A vulnerability in JeecgBoot up to version 3.9.0 affects the loadDatarule function in the file /sys/sysDepartRole/datarule/. Manipulation of the departId/roleId arguments results in improper authorization. The attack can be initiated remotely but requires high complexity and is difficult to exploit. The exploit has been made public.

A vulnerability was found in JeecgBoot up to version 3.9.0 in the function getDeptRoleByUserId of the file /sys/sysDepartRole/getDeptRoleByUserId. Manipulation of the departId argument leads to information disclosure. The vendor was contacted but did not respond.

A flaw was found in JeecgBoot up to version 3.9.0 in the function getDeptRoleList of the file /sys/sysDepartRole/getDeptRoleList. Manipulation of the departId argument causes improper authorization. The attack is possible to be carried out remotely but is difficult to exploit. The vendor was contacted but did not respond.

A vulnerability in JeecgBoot up to version 3.9.0 affects the queryPageList function in the file /sys/sysDepartRole/list. Manipulation of the deptId argument results in improper authorization. The attack can be executed remotely but requires high complexity and is difficult to exploit. The exploit is now public.

A weakness was identified in Dromara Sa-Token up to 1.44.0 affecting the ObjectInputStream.readObject function in SaJdkSerializer.java. Manipulating input can lead to deserialization of untrusted data. The attack may be launched remotely, though it is characterized by high complexity and difficult exploitability.