Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from improper resource cleanup in the probe error path, which could lead to the disclosure of warning messages...

Student Attendance Management System Security Vulnerabilities

Student Attendance Management System is a student attendance management system developed by rickxy. A security vulnerability exists in Student Attendance Management System v1. The vulnerability stems from SQL injection due to incorrect manipulation of the classId and classArmName parameters in th...

Cisco IOS XR Permission Authorization and Access Control Vulnerabilities

Cisco IOS XR is a set of operating systems developed by Cisco USA for its network devices. A Privilege Permission and Access Control Issues vulnerability exists in Cisco IOS XR Software that stems from incorrect handling of packets, which could lead to bypassing configured access control lists...

WordPress plugin Glossy has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress plugin Elementor Header & Footer Builder has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

ChargePoint Home Flex information leakage vulnerability

ChargePoint Home Flex is a series of electric vehicle charging devices from ChargePoint USA. An information disclosure vulnerability exists in the ChargePoint Home Flex, which stems from a Bluetooth low-power information disclosure in the Wi-Fi setup logic, which could lead to a network-adjacent...

WordPress plugin UltraAddons has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin extensions for Elementor: Cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

WordPress plugin: Persian Nested Show/Hide Text – Cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Brocade Fabric OS security vulnerabilities

Brocade Fabric OS FOS is a set of embedded operating systems used in devices such as switches and routers from Brocade USA. A security vulnerability exists in Brocade Fabric OS versions prior to 9.2.2, which stems from a vulnerability that could allow a man-in-the-middle attack for remote service...

BYOB security vulnerabilities

BYOB Build Your Own Botnet is an open source post-exploitation framework for students, researchers and developers by malwaredllc individual developers. BYOB has a security vulnerability that originates from unauthenticated remote code execution via arbitrary file writes and command injection...

Livewire input validation vulnerability

Livewire is Livewire open source a full stack framework for Laravel that allows you to build dynamic UI components without leaving PHP. An input validation error vulnerability exists in Livewire prior to version v3.5.2, which stems from unvalidated actual file extensions for filenames...

Chicheng JFLow Access Control Vulnerability

Chicheng JFLow is a workflow engine form from China Chicheng Chicheng. An access control error vulnerability exists in Chicheng JFLow version 2.0.0, which stems from a parameter oid in file /WF/Ath/EntityMutliFileLoad.do that can lead to improper access control...

OSIsoft PI Web API Code Issue Vulnerability

The Osisoft OSIsoft PI Web API is a RESTful interface to a set of PI systems from the US company Osisoft. The product supports client applications with read and write access to their AF and PI data over HTTPS. A code issue vulnerability exists in the OSIsoft PI Web API, which stems from a...

Jasmin The Ransomware security vulnerability

Jasmin The Ransomware is a powerful ransomware security testing tool used by ReadTeams, a personal developer of Siddhant Gour. A security vulnerability exists in Jasmin The Ransomware version v.1.0.1. The vulnerability is exploited by attackers to obtain sensitive information via the...

CasaOS security vulnerabilities

CasaOS is a simple, easy to use and elegant open source home cloud system. A security vulnerability exists in CasaOS versions prior to 0.4.8 that stems from a username enumeration vulnerability in the Casa OS login page...

WordPress Plugin WP All Export Pro Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on PHP and MySQL servers.WordPress plugin is an...

Vitess security vulnerabilities

Vitess is a database clustering system for horizontally scaling MySQL from Vitess. A security vulnerability exists in Vitess versions prior to 16.0.2 that stems from the fact that if VTAdmin creates a slice containing the / character, anyone attempting to create a new slice from VTAdmin will...

Pulsar Plus System Controller security feature vulnerabilities

Pulsar Plus System Controller is a Pulsar Plus series controller. A security vulnerability exists in the ABB Pulsar Plus System Controller NE843S, ABB Infinity DC Power Plant, which stems from the presence of an Insufficient Use of Random Values vulnerability. The following products and versions...

WordPress Plugin Video.js Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

Bank Management System Cross-site Scripting Vulnerabilities

Bank Management System is a bank management system. A cross-site scripting vulnerability exists in SourceCodester Blood Bank Management System version 1.0, which stems from an unknown function in the index.php?page=users file of its User Registration Handler component that operates on the paramet...

pgAdmin code injection vulnerability

pgAdmin 4 is a reliable and comprehensive database design and management software for PostgreSQL. A remote code execution vulnerability exists in pgAdmin 4. The vulnerability is required in Windows environments where, due to lax privilege checks by the developer, an attacker can exploit the...

Fortinet FortiADC input validation error vulnerability

Fortinet FortiADC is an application delivery controller from Fortinet, Inc. An input validation error vulnerability exists in Fortinet FortiADC, which stems from improper input validation of the application and could be exploited by an authenticated attacker to retrieve a file with a specific...

D-Link DVG-G5402SP: Operating System Command Injection Vulnerability

The D-Link DVG-G5402SP is a wireless router from China-based AUO D-Link. An operating system command injection vulnerability exists in the D-Link DVG-G5402SP firmware version GE1.03, which stems from its Maintenance function that allows an attacker to implement command injection...

Library Management System SQL Injection Vulnerability

Library Management System is a library management system with QR code attendance and automatic library card generation by King Albaracin Personal Developer. A security vulnerability exists in the v1.0 version of Library Management System due to an SQL injection issue in the ok parameter of the...

Varnish Cache security vulnerability

Varnish Cache is a suite of reverse web caching servers. A security vulnerability exists in Varnish Cache version 7.0.0, 7.0.1, 7.0.2, and 7.1.0, which originates. An attacker can exploit the vulnerability by spoofing HTTP/1 back-end response assertions and automatically restarting the server...

Microsoft Visual Studio security vulnerabilities

Microsoft Visual Studio is a family of development tool suites from Microsoft Corporation USA and a largely complete development toolset that includes most of the tools needed throughout the software lifecycle. A security vulnerability exists in Microsoft Visual Studio. The following products and...

Roxy-WI operating system command injection vulnerability

Roxy-WI is an open source web interface for managing Haproxy, Nginx and Keepalived servers. A security vulnerability exists in Roxy-WI versions prior to 6.1.1.0, which can be exploited by a remote attacker to execute remote code via a system command that can be run remotely via the...

WordPress plugin Smush has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plug-in. A cross-site scripting vulnerability exists in versions of WordPress Smush plugin prior to 3.9.9,...

NextCloud information leakage vulnerability

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. Nextcloud suffers from an information disclosure vulnerability that originates when the full path of an application is exposed to an unauthorized user...

Red Hat Vscode-Xml code-related vulnerabilities

Red Hat Vscode-Xml is an open source Xml language support from Red Hat. It makes it easy to edit Xml in Visual Studio Code. A code issue vulnerability exists in Red Hat Vscode-Xml, which stems from a flaw found in vcode -xml in versions prior to 0.19.0. An attacker could exploit this vulnerabilit...

Jenkins plugin: Vulnerabilities related to permissions, licensing, and access control

Jenkins plug-ins are plug-ins that provide functionality for Jenkins. The Jenkins SWAMP Plugin Access Control Error vulnerability can be exploited by an attacker to connect to the attacker's specified web server using the attacker's specified credentials...

Adobe Prelude code issue vulnerabilities

Adobe Prelude is a video recording and capture tool designed for intuitive and efficient media organization and metadata entry to quickly tag and transcode video footage and quickly create rough cuts.Adobe Prelude 10.1 and earlier versions are vulnerable to a null pointer dereference. An attacker...

Microsoft System Center Operations Manager information leakage vulnerability

Microsoft System Center Operations Manager is a large-scale monitoring and management software for corporate environments from Microsoft. Formerly known as MOM Microsoft Operations Manager, the software is primarily used to monitor IT systems and provide monitoring support for distributed...

WordPress Access Control Vulnerability

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on PHP and MySQL servers. WordPress SendGrid plugin version 1.11.8 and earlier is vulnerable to an access control error, which stems fro...

Microsoft Windows Ancillary Function Driver for WinSock: Race Condition Vulnerability

The Microsoft Windows Ancillary Function Driver for WinSock is a compatibility issue vulnerability in Winsock by Microsoft Corporation. Attackers can exploit this vulnerability to gain elevated privileges. The following products and versions are affected: Windows Server 2012 R2 Server Core...

JD Cloud Box AX6600 security vulnerabilities

JD Cloud Box AX6600 is a wireless router produced by JD.com, a Chinese company. The JD Cloud Box AX6600 version 4.5.3.r4546 contains a security vulnerability. This vulnerability stems from a stack buffer overflow in the setmacfilter function located in the file /sbin/jdcwebrpc. An attacker can...

Traccar cross-site scripting vulnerabilities

Traccar is a Java-based website monitoring system developed by the American company Traccar. This software supports over 170 GPS protocols and over 1,500 types of GPS tracking devices. Traccar can be used alongside any major SQL database systems. It also provides a user-friendly REST API. Version...

Rustfs Cross-Site Scripting Vulnerabilities

RustFS is a high-performance object storage system developed by RustFS. Versions of RustFS prior to 1.0.0-alpha.83 contained a cross-site scripting vulnerability. This vulnerability stems from stored-cross-site scripts and could lead to credential leakage and account takeover attacks...

CollabPlatform security vulnerabilities

CollabPlatform is a real-time collaboration platform developed by Manav Mahesh Sanger as an individual developer. CollabPlatform has a security vulnerability, which stems from improper CORS configuration in the Appwrite project. This allows credentials from any source to be requested, potentially...

Jamf Pro security vulnerabilities

Jamf Pro is a set of Apple device management solutions provided by the American company Jamf. Versions 11.20 to 11.24 of Jamf Pro contain security vulnerabilities. These vulnerabilities stem from critical weaknesses that allow authentication bypass, potentially causing unspecified impacts...

Dia security vulnerabilities

Dia is an AI-driven smart browser developed by Dia Company. Versions of Dia prior to 1.9.0 contained a security vulnerability. This vulnerability stemmed from the absence of the about:blank indicator in new windows with custom sizes, which could allow attackers to deceive trusted domains and...

Efacec QC security vulnerabilities

Efacec QC is a series of electric vehicle charging posts from Efacec Portugal. A security vulnerability exists in Efacec QC that stems from a lack of privilege control over user XXX, which could lead to unlimited privilege elevation...

WordPress plugin Stratum has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

N-able N-central security vulnerabilities

N-able N-central is an RMM platform from N-able Canada Inc. provides large-scale management, automation and orchestration capabilities for sophisticated MSPs and IT professionals. A security vulnerability exists in N-able N-central versions prior to 2025.4 that stems from generating session IDs f...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an attempt to write to a read-only memory region, which could cause the kernel to crash...

Nginx Proxy Manager security vulnerabilities

Nginx Proxy Manager is a Docker container for Nginx Proxy Manager open source. It is used to manage Nginx proxy hosts through a simple and powerful interface. A security vulnerability exists in Nginx Proxy Manager version v2.12.3, which stems from an improperly configured CORS and could lead to a...

Microsoft SQL Server SQL injection vulnerability

Microsoft SQL Server is a large commercial database system from Microsoft Corporation USA that is applied under the Microsoft Windows system. A SQL injection vulnerability exists in Microsoft SQL Server. An attacker can exploit the vulnerability to elevate privileges. The following products and...

HP LaserJet Pro security vulnerabilities

HP LaserJet Pro is a line of laser printers and MFPs from Hewlett-Packard HP in the United States. A security vulnerability exists in the HP LaserJet Pro that stems from an information disclosure issue that could cause a non-authenticated user to query the device's local address book...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from dwpcieepinit not freeing EPC memory, which could lead to a memory leak...