Gscsd

A flaw has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected is an unknown function of the file dmCorePlugin/lib/vendor/gapi/gapi.class.php of the component Google Analytics Client. Executing a manipulation can lead to improper certificate validation. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is told to be difficult. The exploit has been published and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected by this vulnerability is the function html of the file dmAdminPlugin/web/js/dmAdminCtrl.js of the component Version Check Service. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected by this issue is the function append of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component Administrative Console. The manipulation of the argument dm command results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this vulnerability is the function file exists of the file Public/Home/js/uploadify/check-exists.php of the component Uploadify. The manipulation of the argument filename results in file and directory information exposure. The attack may be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A flaw has been found in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is some unknown functionality of the file App/Home/Controller/VoteController.class.php of the component Vote Handler. This manipulation of the argument X-Requested-With causes business logic errors. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability has been found in diem-project diem up to 5.1.3. This affects an unknown part of the file lib/model/doctrine/PluginDmUser.class.php of the component SHA1 Handler. Such manipulation of the argument salt/password leads to password hash with insufficient computational effort. The attack needs to be performed locally. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmCorePlugin/lib/data/dmDataLoad.php. Performing a manipulation results in use of default password. The attack is possible to be carried out remotely. The exploit has been made public and could be used. It is suggested to update the configuration settings. The project was informed of the problem early through an issue report but has not responded yet.

A flaw has been found in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Impacted is the function UserDao.login of the file code/src/service/AdminDao.java. This manipulation of the argument Password causes cleartext storage of sensitive information. The attack is restricted to local execution. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This impacts an unknown function of the file App/Home/Controller/UserController.class.php of the component Captcha Validation. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected is the function sha1 of the file App/Home/Model/UserModel.class.php. The manipulation of the argument Password leads to password hash with insufficient computational effort. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

**Name of the Vulnerable Software and Affected Versions** ningzichun student-management-system versions up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf **Description** A remote cross site scripting issue exists in the `echo` function within the `admin/fun/addLog.php` file. This occurs when the `reason/detail` argument is manipulated, allowing an attacker to execute malicious scripts in the victim's browser. **Recommendations** As a temporary workaround, restrict access to the `admin/fun/addLog.php` file or avoid using the `reason/detail` argument until a fix is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** sfturing hosp order versions up to 627f426331da8086ce8fff2017d65b1ddef384f8 **Description** The User Password Handler component contains a flaw where the `MD5.getMD5()` function in the `ssm pro/src/main/java/cn/sfturing/utils/MD5.java` file implements a one-way hash without salt. This allows for remote attacks, although they require a high degree of complexity and are considered difficult to execute. **Recommendations** As a temporary workaround, consider restricting the use of the `MD5.getMD5()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** aircheng-org iWebShop-5 versions prior to 5.16 **Description** A flaw in the Authentication Storage component within the `controllers/admin.php` file allows remote attackers to manipulate the `Password` argument. This can result in the generation of password hashes with insufficient computational effort, making them easier to crack. The attack is characterized by high complexity and is considered difficult to execute. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** sambitraj Student-Management-System versions prior to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 **Description** A remote attack can be launched against the `session start()` function, resulting in cookies being issued without the 'httponly' flag. The 'httponly' flag is a security measure that prevents client-side scripts from accessing the cookie, which helps mitigate the risk of session theft via cross-site scripting. **Recommendations** As a temporary workaround, consider restricting the use of the `session start()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** mjperpinosa stumasy حتى الإصدار 327d1b0f2915ba79d7ef8ebb74553e987609d9be **الوصف** يوجد ثغرة في مكون Note Handler/Assignment Handler داخل الملف `/PHP/objects/notes` تسمح بتجاوز إجراءات التفويض. يمكن لمهاجم عن بُعد استغلال هذه الثغرة من خلال التلاعب بالمعلمة `assignment item id`. **التوصيات** في الوقت الحالي، لا توجد معلومات حول إصدار أحدث يحتوي على إصلاح لهذه الثغرة الأمنية.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** mjperpinosa stumasy حتى الإصدار 327d1b0f2915ba79d7ef8ebb74553e987609d9be **الوصف** يحدث حقن SQL عن بُعد بسبب المعالجة غير الصحيحة لحجة `Password` داخل الدالة `Notes controller::accessing dictionary authorization()` الموجودة في الملف application/PHP/objects/notes/accessing dictionary authorization.php. حقن SQL هو تقنية يقوم فيها المهاجم بإدراج كود SQL ضار في استعلام، مما يسمح له بالتلاعب بقاعدة البيانات. **التوصيات** كحل مؤقت، يُنصح بتقييد الوصول إلى الدالة `Notes controller::accessing dictionary authorization()` حتى يتوفر تصحيح. في الوقت الحالي، لا توجد معلومات حول إصدار أحدث يحتوي على إصلاح لهذه الثغرة الأمنية.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** mjperpinosa stumasy حتى الإصدار 327d1b0f2915ba79d7ef8ebb74553e987609d9be **الوصف** توجد مشكلة في حقن التعليمات البرمجية عن بُعد بسبب المعالجة غير الصحيحة لحجة `mathematical sentence` داخل الدالة `eval()` الموجودة في الملف application/pages/imba calculator/calculate.php. **التوصيات** كحل مؤقت، قم بتقييد الوصول إلى الدالة `eval()` الموجودة في الملف application/pages/imba calculator/calculate.php أو تجنب استخدام الحجة `mathematical sentence` حتى يتم إصدار تصحيح. في الوقت الحالي، لا توجد معلومات حول إصدار أحدث يحتوي على تصحيح لهذه الثغرة الأمنية.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات نظام إدارة الطلاب a4m4 حتى f0c5f6842c5e8c431ff02b5260a565ca844df3a0 **الوصف** يسمح ثغرة في مكون Admin Endpoint، وتحديدًا داخل الملف `admin/`، للمهاجمين عن بُعد بتنفيذ التعليمات بعد إعادة التوجيه. ويحدث ذلك من خلال التلاعب بالمعلمة `uid` عبر نقاط نهاية متعددة. **التوصيات** في الوقت الحالي، لا توجد معلومات حول إصدار أحدث يحتوي على إصلاح لهذه الثغرة الأمنية.