Alices614

A weakness has been identified in manjurulhoque django-job-portal up to dfa352f305bba44445ac5dc12e9b2a98c9dcd71f. Affected by this vulnerability is the function EditEmployeeProfileAPIView of the file accounts/api/views.py of the component Employee Dashboard Endpoint. This manipulation of the argument role causes improper access controls. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

**Nome do Software Vulnerável e Versões Afetadas** macrozheng mall versões anteriores a 1.0.4 **Descrição** Ocorre uma autorização inadequada no componente Super Admin Password Handler, afetando especificamente uma função desconhecida no arquivo '/admin/update/'. Isso permite a exploração remota por meio de manipulação. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha a correção para esta vulnerabilidade.

**Nome do Software Vulnerável e Versões Afetadas** JeecgBoot versões anteriores a 3.9.2 **Description** Controles de acesso inadequados existem no componente AiragModelController. Um invasor remoto pode explorar isso manipulando o argumento `list/queryById`, resultando em acesso não autorizado. **Recommendations** Atualizar para a versão 3.9.2.

**Nome do Software Vulnerável e Versões Afetadas** JeecgBoot versões anteriores a 3.9.2 **Descrição** Controles de acesso inadequados existem no endpoint `/sys/comment/add`, o que permite a execução remota do ataque. **Recomendações** Atualizar para a versão 3.9.2.

**Nome do Software Vulnerável e Versões Afetadas** JeecgBoot versões anteriores a 3.9.2 **Description** Controles de acesso inadequados existem no componente SysUser. Um invasor remoto pode manipular a variável `userIdentity` na função `user.getUsername()` do endpoint '/sys/user/login/setting/userEdit' para obter acesso não autorizado. **Recommendations** Atualizar para a versão 3.9.2.

**Nome do Software Vulnerável e Versões Afetadas** JeecgBoot versões anteriores a 3.9.2 **Description** Controles de acesso inadequados existem na função `LoginController.selectDepart()` dentro do arquivo `/sys/selectDepart`. Esta falha permite a exploração remota. **Recommendations** Atualize para a versão 3.9.2. Como mitigação temporária, restrinja o acesso à função `LoginController.selectDepart()`.

**Nome do Software Vulnerável e Versões Afetadas** eladmin versões anteriores a 2.8 **Descrição** Controles de acesso inadequados no Users API Endpoint permitem ataques remotos. O problema reside na função `checkLevel()` localizada no arquivo `/rest/UserController.java`. **Recomendações** Como medida paliativa temporária, restrinja o acesso ao Users API Endpoint ou à função `checkLevel()` até que uma correção esteja disponível. No momento, não há informações sobre uma versão mais recente que contenha a correção para esta vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** yeqifu warehouse (affected versions not specified) **Description** A flaw exists due to improper access controls. This issue is related to the `deleteCache`, `removeAllCache`, and `syncCache` functions within the `CacheController.java` file, located in the `datasetreposwarehousesrcmainjavacomyeqifusyscontroller` directory. The affected component is the Cache Sync Handler. The issue can be exploited remotely, and details of the exploit have been publicly disclosed. The product operates on a rolling release basis, meaning specific version details for affected and updated releases are unavailable. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** yeqifu warehouse versions prior to aaf29962ba407d22d991781de28796ee7b4670e4 **Description** A flaw exists in the Customer Endpoint component of yeqifu warehouse. The `addCustomer`, `updateCustomer`, and `deleteCustomer` functions within the `datasetreposwarehousesrcmainjavacomyeqifubuscontrollerCustomerController.java` file are susceptible to improper access controls. Remote exploitation is possible. The exploit has been publicly disclosed. The project was notified of the issue but has not yet responded. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** yeqifu warehouse versions prior to aaf29962ba407d22d991781de28796ee7b4670e4 **Description** A security issue exists in yeqifu warehouse. A manipulation of the `addInport`, `updateInport`, or `deleteInport` functions within the `InportController.java` file, located in the `datasetreposwarehousesrcmainjavacomyeqifubuscontroller` component, can lead to improper access controls. This issue can be exploited remotely. The exploit has been publicly disclosed. The affected component is the Inport Endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** yeqifu warehouse (affected versions not specified) **Description** A security issue exists in yeqifu warehouse related to improper access controls. The issue impacts the `addSales`, `updateSales`, and `deleteSales` functions within the `SalesController.java` file located in the `datasetreposwarehousesrcmainjavacomyeqifubuscontrollerSalesController.java` component, specifically affecting the Sales Endpoint. This allows for remote exploitation. The exploit is publicly available. The project has been notified but has not yet responded. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** yeqifu warehouse (affected versions not specified) **Description** A flaw exists in the Log Info Handler component of yeqifu warehouse, specifically within the `loadAllLoginfo()`, `deleteLoginfo()`, and `batchDeleteLoginfo()` functions located in the file `datasetreposwarehousesrcmainjavacomyeqifusyscontrollerLoginfoController.java`. This issue leads to improper authorization and is exploitable remotely. The exploit has been publicly disclosed. The product does not utilize versioning, making it difficult to determine affected and unaffected releases. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** yeqifu warehouse versions prior to aaf29962ba407d22d991781de28796ee7b4670e4 **Description** A security flaw exists due to improper access controls. The issue is located in the `saveRolePermission` function within the file datasetreposwarehousesrcmainjavacomyeqifusyscontrollerRoleController.java of the Role-Permission Binding Handler component. This flaw allows for remote attacks, and an exploit has been publicly released. The project has been notified but has not yet responded. **Recommendations** Update to version aaf29962ba407d22d991781de28796ee7b4670e4 or later.

**Name of the Vulnerable Software and Affected Versions** yeqifu warehouse versions prior to aaf29962ba407d22d991781de28796ee7b4670e4 **Description** A weakness exists due to improper authorization within the User Management Endpoint component. The issue is related to the `addUser`, `updateUser`, and `deleteUser` functions located in the file datasetreposwarehousesrcmainjavacomyeqifusyscontrollerUserController.java. The attack can be initiated remotely, and the exploit has been publicly released. Continuous delivery with rolling releases is utilized, meaning specific version details for affected or updated releases are unavailable. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** yeqifu warehouse (affected versions not specified) **Description** A security issue exists in yeqifu warehouse related to improper authorization. The issue is present in the `addRole`, `updateRole`, and `deleteRole` functions within the `RoleController.java` file located in the `datasetreposwarehousesrcmainjavacomyeqifusyscontroller` directory, part of the Role Management Handler component. The exploit for this issue has been publicly disclosed and may be used to launch remote attacks. The project maintainers were notified of the problem but have not yet responded. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** yeqifu warehouse (affected versions not specified) **Description** A security issue exists in yeqifu warehouse related to improper authorization. The issue is located within the Permission Management component, specifically in the `addPermission()`, `updatePermission()`, and `deletePermission()` functions of the file datasetreposwarehousesrcmainjavacomyeqifusyscontrollerPermissionController.java. The attack can be initiated remotely and the exploit is publicly available. The product utilizes a rolling release model, meaning specific version information for affected or updated releases is not available. The project was notified of the issue but has not yet responded. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** yeqifu warehouse (affected versions not specified) **Description** A flaw exists that can lead to improper authorization. The issue affects the `addMenu()`, `updateMenu()`, and `deleteMenu()` functions within the `MenuController.java` file located in the `datasetreposwarehousesrcmainjavacomyeqifusyscontroller` directory, specifically related to the Menu Management component. The product operates on a rolling release basis, meaning there are no specific version details for affected or updated releases. The exploit has been published. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** yeqifu warehouse versions prior to aaf29962ba407d22d991781de28796ee7b4670e4 **Description** A flaw exists due to improper authorization within the Department Management component. The issue resides in the `addDept()`, `updateDept()`, and `deleteDept()` functions located in the file datasetreposwarehousesrcmainjavacomyeqifusyscontrollerDeptController.java. This allows for remote exploitation. The project has been notified of the issue but has not yet responded. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** yeqifu warehouse versions prior to aaf29962ba407d22d991781de28796ee7b4670e4 **Description** A flaw exists within the Notice Management component of yeqifu warehouse, specifically in the `addNotice()`, `updateNotice()`, `deleteNotice()`, and `batchDeleteNotice()` functions located in the file datasetreposwarehousesrcmainjavacomyeqifusyscontrollerNoticeController.java. This issue results in improper authorization and can be exploited remotely. The exploit details have been publicly disclosed. The product utilizes continuous delivery with rolling releases, and the project maintainers have been notified but have not yet responded. **Recommendations** Apply updates to yeqifu warehouse beyond aaf29962ba407d22d991781de28796ee7b4670e4. As a temporary workaround, restrict access to the `addNotice()`, `updateNotice()`, `deleteNotice()`, and `batchDeleteNotice()` functions.

**Nome do Software Vulnerável e Versões Afetadas** Sanluan PublicCMS versões 4.0.202506.d até 6.202506.d **Descrição** Existe uma falha de segurança no Sanluan PublicCMS relacionada à autorização inadequada. A função `Paid` dentro do arquivo `TradePaymentService.java`, localizado em `publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java`, é afetada. A manipulação do argumento `paymentId` pode levar ao acesso não autorizado. O ataque pode ser iniciado remotamente e requer um alto nível de complexidade, tornando a exploração difícil. Os detalhes do exploit foram divulgados publicamente. **Recomendações** Aplique um patch com o identificador 7329437e1288540336b1c66c114ed3363adcba02 para resolver este problema.