CVE-2024-24014

A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQL injection via /novel/author/list...

CVE-2024-24014: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQL injection via /novel/author/list...

CVE-2024-24018: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform SQL injection via /system/dataPerm/list...

CVE-2024-24017: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQL injection via /common/dict/list...

CVE-2024-24021: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior. An attacker can pass specially crafted offset, limit, and sort parameters to perform SQL injection via /novel/userFeedback/list...

CVE-2024-24023: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior. An attacker can pass specially crafted offset, limit, and sort parameters to perform SQL injection via /novel/bookContent/list...

CVE-2024-24019

A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform SQL injection via /system/roleDataPerm/list...

PT-2024-20235 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: Novel-Plus versions prior to 4.3.0-RC1 Description: A SQL injection issue exists, allowing an attacker to perform SQL injection by passing crafted offset, limit, and sort parameters via the "/common/dict/list" API endpoint. Recommendations: F...

CVE-2024-24019

A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform SQL injection via /system/roleDataPerm/list...

CVE-2024-24019

A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform SQL injection via /system/roleDataPerm/list...

CVE-2024-24019: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform SQL injection via /system/roleDataPerm/list...

CVE-2023-43534 Use of Out-of-range Pointer Offset in WLAN HOST

Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point...

CVE-2023-43516 Use of out-of-range pointer offset in Video

Memory corruption when malformed message payload is received from firmware...

Novel-Plus Security Vulnerability

Novel-Plus is an online social reading and writing platform from Novel-Plus, Inc. A security vulnerability exists in Novel-Plus version v4.3.0-RC1 and earlier versions. An attacker can exploit the vulnerability to pass specially crafted offset, limit, and sort parameters to perform a SQL injectio...

CVE-2023-43513: Use of Out-of-range Pointer Offset

Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element...

CVE-2024-24015: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform SQL via /sys/user/exit...

CVE-2024-24013: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQL injection via /novel/pay/list...

PT-2024-20237 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: Novel-Plus versions prior to 4.3.0-RC1 Description: A SQL injection issue exists, allowing an attacker to perform SQL injection by passing crafted offset, limit, and sort parameters via the "/system/roleDataPerm/list" API endpoint...

PT-2024-20234

Name of the Vulnerable Software and Affected Versions Novel-Plus versions 4.3.0-RC1 and prior Description A SQL injection issue exists, allowing an attacker to perform SQL operations by passing crafted offset, limit, and sort parameters via the /sys/user/exit API endpoint. Recommendations For...

CVE-2023-43534: Use of Out-of-range Pointer Offset

Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point...