CVE Vulnerability Catalog

A flaw has been found in yaojingang GEOFlow up to 2.1.0. This issue affects the function preview of the file app/Http/Controllers/Admin/SiteThemeEditorController.php of the component Superadmin Theme Editor. This manipulation of the argument blade causes code injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 2.1.1 is capable of addressing this issue. Patch name: 67abfd864a15d169a78429f3290c91cb3b93e849.

A cross-site scripting (XSS) vulnerability has been detected in yaojingang GEOFlow up to version 2.1.0. It affects an unknown part of the file app/Http/Controllers/Site/HomeController.php in the JSON-LD Theme Handler component. Manipulation of the Search argument allows remote XSS attacks. The exploit has been publicly disclosed, and upgrading to version 2.1.1 mitigates the issue.

Nodemailer before version 8.0.8 disables TLS certificate verification in lib/fetch/index.js via rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections.

Nodemailer before version 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.

Nodemailer before version 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls.

Nodemailer before version 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedded attachments to cause the event loop to hang and deny service.

The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set.

A vulnerability was determined in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. The issue affects the function MyJwWebJwid3Controller.doUpload in the file jeewx-boot-module-weixin/src/main/java/com/jeecg/p3/open/web/back/MyJwWebJwid3Controller.java of the doUpload Endpoint component. Manipulation of the File argument leads to unrestricted upload. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release, so version information is unavailable. The project was informed but has not responded yet.

When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0 only in deployments that use the Jakarta EE integration module. Upgrade to version 3.0.1 or later fixes the issue. Alternatively, set the org.apache.shiro.form-resubmit-host and org.apache.shiro.form-resubmit-port system properties to restrict the host and port that Shiro will connect to when resubmitting a form.

A cross-site scripting (XSS) vulnerability has been found in code-projects Simple Inventory System 1.0. It affects an unknown part of the file /register.php in the User Registration component. Manipulation of the last_name argument leads to XSS. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

A flaw has been found in code-projects Simple Inventory System 1.0. The issue affects some unknown functionality of the file inventorymanagement.sql in the Database Backup File Handler component. This manipulation causes information disclosure. The attack may be initiated remotely. The exploit has been published and may be used.

A vulnerability was detected in open62541 up to 1.5.5 in the function UA_DataValue_backend_copyRange of the History Backend component. Manipulation leads to use after free. The attack can be launched remotely, and the exploit is publicly available.

The WordPress plugin '爱采集数据采集和发布插件' through version 1.0.0 does not restrict which handler methods can be invoked and lacks capability or nonce checks, allowing unauthenticated users to create user accounts and taxonomy terms.

GROWI contains an incorrect authorization vulnerability. If exploited, an unauthenticated attacker could retrieve other users' bookmark data.

GROWI contains an authorization bypass vulnerability through user-controlled key in bookmark folder APIs. An authenticated attacker could retrieve, tamper with, and/or delete other users' bookmark data.

NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL (or redirect) parameter.

NSP is vulnerable to stored XSS due to insufficient validation or encoding of user-controlled input in a workflow application. An authenticated attacker can embed malicious code that executes when another user views the content.

A security flaw was discovered in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. The function CourseDao.course_ranking in CourseDao.java is vulnerable to SQL injection via the cno argument. The attack can be initiated remotely, and the exploit is public.

A vulnerability was identified in Systerel S2OPC up to 1.7.3. The function monitored_item_event_filter_treatment_bs__init_event_filter_ctx_and_result in subscription_mgr.c is vulnerable to use after free via the EventFilter argument. The attack may be performed remotely, and the exploit is public. A patch is available.

A vulnerability was determined in Systerel S2OPC up to 1.7.3 in the function set_range_matrix_on_string_array of src/Common/opcua_types/sopc_builtintypes.c in the String Array Range Writing component. This manipulation causes out-of-bounds read. The attack can be carried out remotely. The project was informed but has not responded.