Poppingsnack

A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.3. Impacted is the function VelocityUtils.getFileName of the file VelocityUtils.java of the component Code Generator. Performing a manipulation of the argument className results in path traversal. The attack is possible to be carried out remotely.

A TimeOut error exists in the `ParseTools.subCompileExpression` method due to many Java class lookups, potentially causing a long execution time. The vendor disputes the significance of this issue, stating that the only expected consequence is a significant delay in the parser completing its task.

The issue is related to a stack overflow in the `Criteria.parse()` method of the json-path library. This can potentially allow a remote attacker to cause a denial of service.

An issue allows attackers to cause a denial of service or other unspecified impacts via a crafted object that uses cyclic dependencies.

An issue was discovered that allows attackers to cause a denial of service or other unspecified impacts via a crafted object that uses cyclic dependencies.

An issue allows attackers to cause a denial of service or other unspecified impacts via a crafted object that uses cyclic dependencies.

An issue allows attackers to cause a denial of service or other unspecified impacts via a crafted object that uses cyclic dependencies.

An issue was discovered in JSONUtil that allows attackers to cause a denial of service or other unspecified impacts via crafted objects that use cyclic dependencies or have deeply nested structures.

An issue allows attackers to cause a denial of service or other unspecified impacts via a crafted object that uses cyclic dependencies.

An issue allows attackers to cause a denial of service or other unspecified impacts via crafted objects that use cyclic dependencies or have deeply nested structures.

An issue in hjson allows attackers to cause a denial of service or other unspecified impacts via crafted objects that use cyclic dependencies or have deeply nested structures.

An issue in jjson allows attackers to cause a denial of service or other unspecified impacts via crafted objects that use cyclic dependencies or have deeply nested structures.

The issue is related to a stack overflow error in the jtidy library, which is used for cleaning and validating HTML code. Exploitation of this issue can allow a remote attacker to cause a denial of service or other unspecified impacts via a crafted object that uses cyclic dependencies.

The issue in jackson-databind is related to unlimited resource allocation, which can be exploited to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies.

The issue allows attackers to cause a denial of service or other unspecified impacts via a crafted object that uses cyclic dependencies. It is related to a buffer overflow in memory, which can be exploited by a remote attacker to cause a denial of service.

The issue allows an attacker to input malicious zip files, which can result in high-risk files after decompression being stored in any location, potentially leading to file overwrite. This is due to a Path Traversal vulnerability.

The issue allows for denial of service (DOS) attacks when using the `evaluator.guess` parameter name method. If the parser runs on user-supplied input, an attacker could supply content that causes the parser to crash due to a stack overflow. It is noted that this is disputed by multiple parties because Janino is not intended for use with untrusted input.

The issue allows attackers to inject arbitrary web script or HTML via editing the article content in the "article editor" page. This is a Cross Site Scripting (XSS) vulnerability.

A cross site scripting (XSS) issue allows attackers to inject arbitrary web script or HTML via the `title` field in the "blog management" page due to the default configuration not using `MyBlogUtils.cleanString`. This enables attackers to execute malicious scripts on the website.

The issue allows attackers to inject arbitrary web script or HTML via editing blog articles, which is a Cross Site Scripting (XSS) vulnerability. This can be exploited by attackers to inject malicious scripts.