Xe

Anubis is a Web AI Firewall Utility designed to protect upstream resources from scraper bots. Attackers can craft malicious pass-challenge pages that cause a user to execute arbitrary JavaScript code or trigger other nonstandard schemes. The incomplete fix was initially tagged in version 1.21.2, but the release was aborted. The issue is addressed in version 1.21.3.

A vulnerability was found in the processing of the file /language.php, where the manipulation of the arguments `LangID`, `LangName`, and `LangEName` leads to cross-site scripting. The attack may be initiated remotely. The vendor was contacted about this disclosure but did not respond.

A critical issue has been found in the AMTT Hotel Broadband Operation System. It affects an unknown function of the file /manager/frontdesk/online status.php. The manipulation of the `AccountID` argument leads to sql injection. This issue can be exploited remotely. The vendor was contacted about this disclosure but did not respond.

A critical issue was found in the URL Handler component, specifically affecting the `/api/sys/ng-alain/getDictItemsByTable/` API endpoint. This issue leads to sql injection and can be initiated remotely. The exploit has been disclosed publicly.

Name of the Vulnerable Software and Affected Versions: xiaohe4966 TpMeCMS versions 1.3.3.1 and earlier Description: A problematic issue has been found in xiaohe4966 TpMeCMS, affecting some unknown functionality of the file "/index/ajax/lang". The manipulation of the `lang` argument leads to path traversal. The attack may be launched remotely. Recommendations: For xiaohe4966 TpMeCMS versions 1.3.3.1 and earlier, upgrade to version 1.3.3.2 to address this issue. As a temporary workaround, consider restricting access to the "/index/ajax/lang" file until the upgrade is applied. Avoid manipulating the `lang` argument in the affected file to minimize the risk of exploitation.