Djie

**Name of the Vulnerable Software and Affected Versions** jaychouchannel Tourism-Management-System versions up to 84d8ec384f669df3985293dab293bb7b477efa64 **Description** Improper authorization exists within the Authorization Interceptor component, specifically affecting the `AuthorizationInterceptor.java` file. This flaw allows a remote attacker to manipulate the system to bypass authorization controls. **Recommendations** Apply patch d984d172dceca907f8b447efbdb06dc233f7938d to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** jaychouchannel Tourism-Management-System versions up to 8122bf020d91199eddfff3ee02d1632a70a9a132 **Description** An authorization bypass exists in the CRUD component within the file MenpiaodingdanController.java. A remote attacker can exploit this by manipulating the `ID` argument, allowing unauthorized access to system functions. **Recommendations** Apply patch d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86 to resolve this issue.

**Name of the Vulnerable Software and Affected Versions** jaychouchannel Tourism-Management-System (affected versions not specified) **Description** A flaw in the Password Recovery component allows for weak password recovery. This issue can be triggered remotely via the `resetPass()` function located in the `UsersController.java` file. **Recommendations** Apply patch 9cb6215ac871f99a90cde763cf003e95ff282283. As a temporary workaround, restrict access to the `resetPass()` function until the patch is applied.