Alex111998
Alex111998
(Please include as much information as possible, and attach a sample image if possible.) When I test the latest version(2.19.0) of metadata-extractor by CIFuzz，a OOM security issue was found, it...
## Summary A denial of service vulnerability in vavr was discovered by CIFuzz. A bug in method CharSeq.repeat(char, int) means that an input of modest size can lead to indefinite...
### Description bus-core provides XML utility classes that may be vulnerable to remote code execution when using XmlKit.readObjectFromXml() to interpret untrusted XML strings. --- ### Detail The program will call...
https://github.com/nutzam/nutz/blob/595355b3ce41d5e98538a9ef6cbec7f76fa09345/src/org/nutz/dao/jdbc/Jdbcs.java#L709 Preamble --------------------------------------------------------------- The system temporary directory is shared between all users on most unix-like systems (not MacOS, or Windows). Thus, code interacting with the system temporary directory must be...
https://github.com/ueboot/ueboot/blob/55763e037fd339ca0e8165ccda185ce5028deb03/ueboot-core/src/main/java/com/ueboot/core/utils/XMLUtil.java#LL35C19-L35C26 # Description ueboot-core provides XML utility classes that may be vulnerable to XXE when using XMLUtil.doXMLParse(String strxml) to interpret untrusted XML strings.Attacker can get important file content on the...
When I test the latest version(20231013) of JSON-java by CIFuzz，a OOM security issue was found, it caused when put a big number in JSONArray, may cause denial of service issues...
Log in by admin, create a account test which is not admin, then log in with test, in the reader page, account test can change any user passowrd by modify...
Use fiddler to mock a request to add reader:  then the message "xss2" popup will be on reader list page:  the poc is ： `POST http://localhost:8080/user/addReader Host: localhost:8080...
In borrow page, input ISBN "131e12e" and submit:  The return book page will alert the message：xss1 
Add a book info,book name input  Then the book list page alert the message: xss1 