CVE Vulnerability Catalog

A flaw was found in Tomofun Furbo 360 and Furbo Mini in the Bluetooth Handler component. Manipulation of an unknown function can lead to denial of service. The attacker must be present on the local network; affected firmware versions are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074.

A vulnerability was detected in Tomofun Furbo 360 up to FB0035_FW_036. Impacted is an unknown function of the component Audio Handler. Performing manipulation results in race condition. The attack is possible to be carried out remotely.

A security vulnerability has been detected in Tomofun Furbo 360 up to FB0035_FW_036. This issue affects some unknown processing of the component Account Handler. Such manipulation leads to server-side request forgery. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The vendor was contacted early about this disclosure but did not respond in any way.

IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user to cause a denial of service by uploading specially crafted files using uncontrolled recursion.

IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to spoof email identity of the sender due to improper verification of source data.

A weakness has been identified in Tomofun Furbo 360 up to FB0035_FW_036, affecting unknown code of the File Upload component. Manipulation causes resource consumption, and remote exploitation is possible. The vendor was contacted early but did not respond.

HCL Unica Platform is impacted by a misconfigured Content Security Policy (CSP). This can result in malicious resources being loaded and browsers being exposed to attacks such as cross-site scripting and clickjacking.

A path traversal vulnerability in RainyGao DocSys up to 2.02.36 in /Doc/deleteDoc.do allows manipulation of the path argument. The attack can be launched remotely, and the exploit has been publicly disclosed.

A path traversal vulnerability in RainyGao DocSys up to 2.02.36 in the updateRealDoc function of /Doc/uploadDoc.do allows manipulation of the path argument. The attack can be initiated remotely, and the exploit has been made public.

A vulnerability has been found in RainyGao DocSys up to 2.02.36. This impacts the function getUserList of the file /Manage/getUserList.do. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

HCL Unica MaxAI Assistant is susceptible to an HTML injection vulnerability. An attacker could insert special characters that are processed client-side in the context of the user's session.

HCL Unica 12.1.10 can expose sensitive system information. An attacker could use this information to form an attack plan by leveraging known vulnerabilities in the application.

A flaw has been found in jimit105 Project-Online-Shopping-Website up to commit 7d892f442bd8a96dd242dbe2b9bd5ed641e13e64. This affects an unknown function of the file /delete.php of the component Product Inventory Handler. Manipulation of the argument product_code causes SQL injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This product uses a rolling release model, so no version details for affected or updated releases are available. The vendor was contacted but did not respond.

HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR). An attacker can bypass authorization and access resources in the system directly, for example database records or files.

A SQL injection vulnerability was found in code-projects Simple Food Ordering System 1.0 in /addcategory.php. Manipulation of the cname argument allows remote attack. The exploit is publicly available.

A SQL injection vulnerability was found in code-projects Simple Food Ordering System 1.0 in /addproduct.php. Manipulation of the Category argument allows remote attack. The exploit is publicly available.

A SQL injection vulnerability was identified in SourceCodester Simple Inventory System 1.0, specifically in the /user.php file. Manipulation of the 'uemail' argument allows injection of malicious SQL code. The attack can be carried out remotely, and the exploit is publicly available.

A SQL injection vulnerability was found in SourceCodester Simple Inventory System 1.0 in /brand.php. Manipulation of the editBrandName argument allows remote attack. The exploit is publicly available.

A weakness has been identified in harry0703 MoneyPrinterTurbo up to 1.2.6, impacting the upload_music function in app/controllers/v1/music.py of the API Endpoint component. Manipulation of the File argument can lead to path traversal, and the attack can be performed remotely. The exploit has been made public.

A security flaw has been discovered in iPynch Social Network Website up to commit b6933b6d7f82c84819abe458ccf0e59d61119541. The affected element is an unknown function of the component Search. Performing manipulation results in SQL injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited. This product adopts a rolling release strategy.