Vulnplusbot

A weakness in the Rapids setproperty Primitive Handler allows remote attackers to perform manipulations that lead to improper access controls and remote code execution. This issue specifically affects the `exec()` function within the file h2o-core/src/main/java/water/rapids/ast/prims/misc/AstSetProperty.java.

A flaw in the JAR Handler component allows remote attackers to trigger deserialization by manipulating the `importBinaryModel()` function within the `h2o-core/src/main/java/hex/Model.java` file. Deserialization is a process where data is converted from a binary format back into an object, which can be exploited to execute unauthorized code if the input is not properly validated.

A remote information disclosure issue exists within the ImportFile API. The flaw is located in the `importFiles()` function of the `h2o-core/src/main/java/water/persist/PersistNFS.java` file, allowing an attacker to remotely access sensitive information.

A business logic error exists in the Trade Payment Flow component within the file `publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradeOrderController.java`. This issue affects the functions `TradeOrderController.pay()`, `TradePaymentController.pay()`, and `AccountGatewayComponent.pay()`, allowing for remote exploitation.

An improper authorization issue exists in the Comment Approval Handler component. A remote attacker can manipulate the `CheckComment()` function within the 'zb system/function/c system event.php' file to bypass authorization controls.

A template injection flaw exists in the templateResult API. The `execute()` function within the file `publiccms-core/src/main/java/com/publiccms/views/directive/tools/TemplateResultDirective.java` fails to properly neutralize special elements used in a template engine when processing the `templateContent` argument. This allows a remote attacker to manipulate the template engine.

A missing authentication issue exists in the Trade Address Query Handler component. A remote attacker can manipulate the `userId`/`id` arguments within the `execute()` function of the file `publiccms-trade/src/main/java/com/publiccms/views/directive/trade/TradeAddressListDirective.java` to bypass authentication.

A remote attack is possible due to the use of a hard-coded cryptographic key. The issue exists within the `getSignKey()` function located in the `publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java` file, specifically when manipulating the `privatefile key` argument.

Command injection is possible via remote attack in the fileThumb Plugin. The issue exists within the `parseVideoInfo()` function located in the `/workspace/source-code/plugins/fileThumb/lib/VideoResize.class.php` file, where improper manipulation of the `ffmpegBin` argument allows for the execution of arbitrary commands.

Improper authorization exists in the 'fileUpload' endpoint within the '/app/controller/share.class.php' file. Manipulation of the `fileUpload` argument allows for remote exploitation.

A path traversal issue exists in the Public Share Handler component. Remote attackers can manipulate the `path` argument in the `initShareOld()` function located in the `/app/controller/share.class.php` file to access files and directories outside the intended folder.

Improper authentication can be triggered remotely via the `fileGet()` function within the '/app/controller/share.class.php' file of the fileGet component. This occurs through the manipulation of the `fileUrl` argument.

A flaw in the `initInstall()` function within the '/app/controller/systemMember.class.php' file allows for authorization bypass. This occurs when the `path` argument is manipulated, enabling a remote attacker to bypass security checks.

A weakness in the `roleGroupAction()` function within the '/app/controller/systemRole.class.php' file allows for remote authorization bypass. This occurs through the manipulation of the `group role` argument.

An issue exists in the Instant Exam Creation Handler component within the `temppage` function of the '/app/exam/controller/exams.master.php' file. Remote manipulation of the `uploadfile` argument allows for server-side request forgery, a flaw where an attacker can induce the server-side application to make requests to an unintended location.

An issue exists in the API Upload Endpoint component involving the processing of the file '/public/install/lp.sql'. Remote manipulation of the `key` argument can lead to the exposure of hard-coded credentials.

Name of the Vulnerable Software and Affected Versions kalcaddle kodbox versions up to 1.64 Description A server-side request forgery condition exists in the shareMake/shareCheck component of kalcaddle kodbox. Manipulation of the `siteFrom` and `siteTo` arguments can trigger the issue. The attack is possible remotely and has a high complexity, with difficult exploitability. The exploit is publicly available. Recommendations Update to a version beyond 1.64.

A security flaw exists in kalcaddle kodbox version 1.64 related to improper authentication within the Password-protected Share Handler component. The issue resides in the `can` function of the file `/workspace/source-code/app/controller/explorer/auth.class.php`. A remote attacker with high complexity and difficult exploitability can manipulate the system. The exploit has been publicly released. The vendor was notified but did not respond.

A flaw exists in the Public Share Handler component of kalcaddle kodbox. Specifically, the `Add` function within the file app/controller/explorer/userShare.class.php allows for unrestricted file uploads. This issue is remotely exploitable and is considered difficult to exploit, but a public exploit is available. The vendor was notified but did not respond.

A cross-site request forgery flaw exists in kalcaddle kodbox. The issue is located in the `/workspace/source-code/plugins/oauth/controller/bind/index.class.php` file, specifically within the `loginSubmit` API. Manipulation of the `third` argument can trigger the flaw. Exploitation is considered difficult and requires a high degree of complexity. The exploit has been publicly released. The vendor was contacted regarding this issue but did not respond.