HongCMS Cross-Site Scripting Vulnerability (CNVD-2023-36284)

HongCMS is an open source lightweight content management system CMS. A cross-site scripting vulnerability exists in HongCMS version 3.0, which originates from running arbitrary code via the callback parameter of /ajax/myshop. An attacker can exploit this vulnerability to perform a cross-site...

Google Chrome PictureInPicture Security Bypass Vulnerability

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome PictureInPicture, which can be exploited by attackers to bypass security restrictions...

Google Chrome Prompts Security Bypass Vulnerability

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome Prompts, which can be exploited by attackers to bypass security restrictions...

Emlog Cross-Site Scripting Vulnerability (CNVD-2023-36305)

emlog is a PHP and MySQL based CMS builder for emlog personal developers. A cross-site scripting vulnerability exists in Emlog Pro v2.0.3. The vulnerability stems from the lack of effective filtering and escaping of user-supplied data, which can be exploited by an attacker to execute arbitrary We...

Vulnerability of the Server component: The Optimizer component of the MySQL Server database management system, which allows attackers to cause downtime or service failures.

The vulnerability of the MySQL Server component of the database management system exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause the system to become unresponsive or lead to service failures...

CVE-2023-30467 Improper Authorization Vulnerability in Milesight Network Video Recorder (NVR)

This vulnerability exists in Milesight 4K/H.265 Series NVR models MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC, due to improper authorization at the Milesight NVR web-based management interface. A remote attacker could exploit this vulnerability by sending a specially...

Fortinet FortiADC Cross-Site Scripting Vulnerability (CNVD-2023-30840)

Fortinet FortiADC is an application delivery controller from Fortinet, Inc. The Fortinet FortiADC suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data, which can be exploited by an attacker to perform a...

Linux kernel elevation of privilege vulnerability (CNVD-2023-34461)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from an elevation of privilege vulnerability that stems from the lack of ctx-uringlock in the iofilegetfixed function, which could lead to a local elevatio...

Juniper Networks Junos OS Evolved 操作系统命令注入漏洞

Juniper Networks Junos OS Evolved is an upgraded version of Juniper Networks' Junos OS. Juniper Networks Junos OS Evolved suffers from an operating system command injection vulnerability that stems from the presence of an operating system command injection vulnerability that can be exploited by a...

CVE-2023-28982 Junos OS and Junos OS Evolved: In a BGP rib sharding scenario when a route is frequently updated an rpd memory leak will occur

A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network based attacker to cause a Denial of Service DoS. In a BGP rib sharding scenario, when an attribute of an active BG...

Qualcomm Chipsets 缓冲区错误漏洞

Qualcomm Chipsets are a series of chipsets from Qualcomm Incorporated USA. A security vulnerability exists in Qualcomm Chipsets. An attacker exploiting this vulnerability could cause information leakage...

Microsoft Releases April 2023 Security Updates

Microsoft has released updates to address multiple vulnerabilities in Microsoft software. An attacker can exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review Microsoft’s April 2023 Security Update Guidelink is external an...

ROS-20230411-02

Liblouis braille translator vulnerability is related to copying to buffer without checking the size of input data data. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of with the compileTranslationTable.c and lousetDataPath functions. The Liblouis...

Cisco Identity Services Engine Command Injection Vulnerability (CNVD-2023-93336)

Cisco Identity Services Engine is an environment-aware platform from Cisco USA. A security vulnerability exists in Cisco Identity Services Engine, which can be exploited by a local attacker to submit a special request to gain root privileges and execute arbitrary code...

Design/Logic Flaw

HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than requir...

CVE-2023-1750 CVE-2023-1750

The listed versions of Nexx Smart Home devices lack proper access control when executing actions. An attacker with a valid NexxHome deviceId could retrieve device history, set device settings, and retrieve device information...

Corel CorelDRAW Graphics Suite buffer overflow vulnerability (CNVD-2023-29422)

Corel CorelDRAW Graphics Suite is a vector graphics editing software from Corel Digital Technology Canada. Corel CorelDRAW Graphics Suite version 23.5.0.506 contains a buffer overflow vulnerability, which stems from a lack of proper validation of user-supplied data when parsing JP2 files and can ...

CVE-2023-28670

Jenkins Pipeline Aggregator View Plugin 1.13 and earlier does not escape a variable representing the current view's URL in inline JavaScript, resulting in a stored cross-site scripting XSS vulnerability exploitable by authenticated attackers with Overall/Read permission...

Adobe Experience Manager URL Redirection Vulnerability (CNVD-2023-45911)

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Audobee Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A URL...

Fortinet FortiWeb OS Command Injection Vulnerability (CNVD-2023-18291)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. An operating system command injection...