CVE Vulnerability Catalog

A permission control vulnerability was found in the event notification management module. Successful exploitation may affect service confidentiality.

A null pointer dereference vulnerability exists in the ArkWeb module. Successful exploitation of this vulnerability may affect availability.

A DoS vulnerability exists in the DSoftBus module. Successful exploitation of this vulnerability may affect availability.

A DoS vulnerability exists in the DSoftBus module. Successful exploitation of this vulnerability may affect availability.

A permission control vulnerability exists in the graphics module. Successful exploitation of this vulnerability may affect confidentiality.

A permission control vulnerability exists in the background task management module. Successful exploitation of this vulnerability may affect service integrity.

A DoS vulnerability exists in the file parsing module. Successful exploitation of this vulnerability may affect availability.

A vulnerability was identified in dayrui XunRuiCMS up to 4.7.4, affecting the _get_tpl_content function in dayrui/Fcms/Library/Notice.php within the Email Template Rendering component. The manipulation leads to code injection, and the attack can be initiated remotely. The exploit is publicly available and might be used; the vendor did not respond to the disclosure.

A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4, affecting the View function in dayrui/Fcms/Core/View.php within the Member Module component. Manipulating the catid argument leads to SQL injection, and the attack can be launched remotely. The exploit has been publicly disclosed and may be utilized; the patch is identified as 9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231.

A vulnerability was found in the WAVLINK WN551X3-A device, affecting the sub_41a430 function in /bin/ioos within the DNS Resolution Handler component. Manipulating the data argument results in OS command injection, and the attack can be launched remotely. The exploit has been made public and could be used.

The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product. APIs exposed through the WSO2 API Manager's API Gateway are not affected.

The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. The lock condition is only applied to the secondary user store account, allowing continued authentication attempts against the primary user store account. This flaw enables brute force attacks.

A vulnerability was found in the WAVLINK WN551X3-A device in the system function of /bin/ioos, within the WireGuard CLI Group Handler component. Manipulating the group_name argument leads to OS command injection, and the attack can be performed remotely. The exploit has been publicly disclosed and may be used.

A flaw was found in the CloudClassroom-PHP-Project in an unknown function of manageassessment2.php. Manipulating the ExamName/Q1/Q2/Q3/Q4/Q5 arguments causes cross-site scripting, and the attack can be carried out remotely. The exploit has been published and may be used; the vendor did not respond to the disclosure.

A vulnerability was detected in the CloudClassroom-PHP-Project in an unknown function of viewquery.php. Manipulating the eid argument results in SQL injection, and the attack can be executed remotely. The exploit is now public and may be used; the vendor did not respond to the disclosure.

A security vulnerability was detected in the CloudClassroom-PHP-Project in an unknown function of studentdetails.php. Manipulation leads to execution after redirect, and remote exploitation is possible. The exploit has been publicly disclosed and may be used; the vendor did not respond to the disclosure.

A weakness was identified in the CloudClassroom-PHP-Project in some unknown processing of the Global Session Handler component. Manipulation can lead to session expiration, and the attack may be launched remotely. The attack complexity is high and exploitability is assessed as difficult; the exploit is publicly available and the vendor did not respond to the disclosure.

A cross-site scripting vulnerability was found in the mathurvishal CloudClassroom-PHP-Project in the file updatedetailsfromfaculty.php due to manipulation of the fname argument. The attack can be launched remotely and a public exploit is already available.

A use-after-free vulnerability was found in VStarcam O-KAM SuperIPCam 1.3.3.32 in the function FUN_005a2d44 of SuperIPCam.exe, related to P2P session teardown. The attack can be launched remotely and a public exploit is already available.

A stack-based buffer overflow was found in VStarcam O-KAM Client 1.3.3.32 in the function FUN_10003EA0 of the DevDll_925.dll library. The vulnerability can be exploited remotely and a public exploit is already available.