Xe

Anubis هو أداة جدار حماية ويب مدعومة بالذكاء الاصطناعي مصممة لحماية الموارد في المرحلة الأولية من برامج الروبوتات التي تقوم بجمع البيانات. يمكن للمهاجمين إنشاء صفحات «pass-challenge» خبيثة تجبر المستخدم على تنفيذ كود JavaScript تعسفي أو تشغيل مخططات أخرى غير قياسية. تم في البداية تضمين تصحيح غير كامل في الإصدار 1.21.2، لكن تم إلغاء إصداره. تم إصلاح المشكلة في الإصدار 1.21.3.

A vulnerability was found in the processing of the file /language.php, where the manipulation of the arguments `LangID`, `LangName`, and `LangEName` leads to cross-site scripting. The attack may be initiated remotely. The vendor was contacted about this disclosure but did not respond.

A critical issue has been found in the AMTT Hotel Broadband Operation System. It affects an unknown function of the file /manager/frontdesk/online status.php. The manipulation of the `AccountID` argument leads to sql injection. This issue can be exploited remotely. The vendor was contacted about this disclosure but did not respond.

A critical issue was found in the URL Handler component, specifically affecting the `/api/sys/ng-alain/getDictItemsByTable/` API endpoint. This issue leads to sql injection and can be initiated remotely. The exploit has been disclosed publicly.

Name of the Vulnerable Software and Affected Versions: xiaohe4966 TpMeCMS versions 1.3.3.1 and earlier Description: A problematic issue has been found in xiaohe4966 TpMeCMS, affecting some unknown functionality of the file "/index/ajax/lang". The manipulation of the `lang` argument leads to path traversal. The attack may be launched remotely. Recommendations: For xiaohe4966 TpMeCMS versions 1.3.3.1 and earlier, upgrade to version 1.3.3.2 to address this issue. As a temporary workaround, consider restricting access to the "/index/ajax/lang" file until the upgrade is applied. Avoid manipulating the `lang` argument in the affected file to minimize the risk of exploitation.