CVE Vulnerability Catalog

A vulnerability was identified in O2OA up to 10.0-410 in the file /x_organization_assemble_control/jaxrs/unit/ within the Personal Profile Page component. Manipulation of the name/shortName/distinguishedName/pinyin/pinyinInitial/levelName arguments leads to cross site scripting. The attack can be launched remotely and the exploit is publicly available.

A cross-site scripting (XSS) vulnerability was found in O2OA up to version 10.0-410 in the /x_processplatform_assemble_designer/jaxrs/form file of the Personal Profile Page component. Manipulating the name/alias/description arguments leads to malicious script execution. The exploit has been publicly disclosed, and the vendor stated a fix will be included in a new version.

A cross-site scripting (XSS) vulnerability was found in O2OA up to version 10.0-410. It affects an unknown function in the file /x_cms_assemble_control/jaxrs/script of the Personal Profile Page component, where manipulation of the name/alias/description arguments leads to script execution. The attack can be launched remotely and the exploit has been made public.

A cross-site scripting (XSS) vulnerability was found in O2OA up to version 10.0-410. It affects some unknown functionality in the file /x_cms_assemble_control/jaxrs/form of the Personal Profile Page component, where manipulation leads to script execution. The attack can be launched remotely and the exploit has been made public.

A cross-site scripting (XSS) vulnerability was found in O2OA up to version 10.0-410. It affects an unknown functionality in the file /x_cms_assemble_control/jaxrs/design/appdict of the Personal Profile Page component, where manipulation leads to script execution. The attack may be initiated remotely and the exploit has been disclosed to the public.

A cross-site scripting (XSS) flaw was found in O2OA up to version 10.0-410. It affects an unknown function in the file /x_program_center/jaxrs/agent of the Personal Profile Page component, where manipulation leads to script execution. The attack can be launched remotely and the exploit has been published.

In O2OA up to 10.0-410, the personal profile page at /x_portal_assemble_designer/jaxrs/page is vulnerable to cross-site scripting. The attack can be initiated remotely and the exploit is publicly available; the vendor stated a fix will be included in a new version.

tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters when writing events to destinations that may be printed to the terminal. A workaround involves avoiding printing logs to terminal emulators without escaping ANSI control sequences.

In Centurion ERP versions 1.12.0 to before 1.21.0, an authenticated user can view all authentication token details in the database, including hashed tokens. The issue is patched in version 1.21.0.

A vulnerability was found in O2OA up to 10.0-410 in the file /x_portal_assemble_designer/jaxrs/widget within the Personal Profile Page component. Manipulation leads to cross site scripting. The attack can be executed remotely and the exploit has been disclosed publicly; the vendor stated it will be fixed in the new version.

A flaw was found in O2OA up to 10.0-410 in the file /x_portal_assemble_designer/jaxrs/dict/ within the Personal Profile Page component. Manipulation of the name/alias/description arguments causes cross site scripting. Remote exploitation is possible and the exploit has been published; the vendor stated it will be fixed in the new version.

A vulnerability was detected in O2OA up to 10.0-410 in the file /x_program_center/jaxrs/script within the Personal Profile Page component. Manipulation of the name/alias/description arguments results in cross site scripting. The attack can be launched remotely and the exploit is public; the vendor stated it will be fixed in the new version.

A weakness was identified in O2OA up to 10.0-410 in the file /x_organization_assemble_control/jaxrs/person/ within the Personal Profile Page component. Manipulation of the Description argument can lead to cross site scripting. The attack can be launched remotely; the vendor stated it will be fixed in the new version.

A vulnerability was identified in Portabilis i-Educar up to 2.10. An unknown function of the file /intranet/educar_projeto_cad.php in the Cadastrar projeto Page component is affected. Manipulation of the nome/observacao arguments leads to cross site scripting. The attack can be initiated remotely and the exploit is publicly available.

A vulnerability was determined in Portabilis i-Educar up to 2.10. An unknown function of the file /intranet/educar_transferencia_tipo_cad.php in the Cadastrar tipo de transferência Page component is affected. Manipulation of the nm_tipo/desc_tipo arguments causes cross site scripting. The attack can be initiated remotely and the exploit has been publicly disclosed.

A vulnerability was detected in appneta tcpreplay 4.5.1 in the calc_sleep_time function of send_packets.c, leading to a divide-by-zero error. The attack requires local access, and the exploit has been publicly disclosed. Upgrading to version 4.5.3-beta3 is recommended to address the issue.

A security flaw was discovered in O2OA up to 10.0-410 in the file /x_organization_assemble_personal/jaxrs/definition/calendarConfig. Manipulation of the toMonthViewName argument results in cross site scripting. The attack can be launched remotely and the exploit has been released publicly; the vendor stated it will be fixed in the new version.

Oberon microsystems AG's Oberon PSA Crypto library (all versions up to 1.5.1) erroneously used an all-zero seed for RSA-OAEP padding instead of generated random bytes. This results in deterministic RSA, leading to loss of confidentiality for guessable messages, recognition of repeated messages, and loss of security proofs.

coze-studio up to 0.2.4 uses a hard-coded cryptographic key in backend/domain/plugin/encrypt/aes.go (AuthSecretKey/StateSecretKey/OAuthTokenSecretKey). The attack can be remote but is considered difficult and highly complex. The vendor recommended deploying a patch and plans user-defined key management via configuration.

An out-of-bounds read in macOS was addressed with improved bounds checking. The issue affects macOS Sequoia 15.6, macOS Sonoma 14.7.7, and macOS Ventura 13.7.7. An app may be able to cause unexpected system termination.