Veritas NetBackup security vulnerabilities

Veritas NetBackup is a storage service from Veritas, Inc. that is used to provide backup and recovery capabilities for enterprise environments. The software supports the detection of ransomware and backup protection of environmental data such as metadata and virtual environments. A security...

Advantech iView SQL injection vulnerability

Advantech iView, a software based on Simple Network Protocol SNMP for managing B B SmartWorx devices from Advantech, China, is vulnerable to a SQL injection vulnerability in versions prior to Advantech iView 5.7.04.6469, which results from the use of special elements in SQL commands that are not...

Red Hat search-api resource management error vulnerability

Red Hat search-api is a software component from Red Hat that allows developers to seamlessly introduce search functionality into websites and applications. It provides back-end tools for indexing documents, querying various types of data, managing cluster configurations, viewing search analytics,...

Microsoft Windows security vulnerabilities

Microsoft Windows is a suite of operating systems for use on personal devices from the U.S.-based Microsoft Corporation Microsoft. A security vulnerability exists in Microsoft Windows Autopilot. The following products and editions are affected: Windows 10 Version 21H1 for x64-based Systems,Window...

convert-svg code injection vulnerability

convert-svg is open source series of open source software for converting SVG format files to other formats. A security vulnerability exists in versions of convert-svg prior to 0.6.3, which stems from the use of specially crafted SVG files that can read arbitrary files from the file system and the...

HashiCorp go-getter input validation vulnerability

HashiCorp go-getter is a library for HashiCorp's Go golang for downloading files or directories from various sources using URLs as the primary form of input. An input validation error vulnerability exists in HashiCorp go-getter version 2.0.2 and prior versions, which stems from the inability to...

Cambium Networks cnMaestro operating system command injection vulnerability

Cambium Networks cnMaestro is a cloud-based or native software platform from Cambium Networks for secure end-to-end network control. Cambium Networks cnMaestro suffers from an operating system command injection vulnerability. An attacker could exploit this vulnerability to upload specially crafte...

Sourcegraph Code Injection Vulnerability

Sourcegraph is an open source code search and navigation tool from Sourcegraph, Inc. Sourcegraph is vulnerable to a code injection vulnerability that could be exploited by attackers to cause remote code execution...

Adobe Prelude code issue vulnerabilities

Adobe Prelude is a video recording and capture tool designed for intuitive and efficient media organization and metadata entry to quickly tag and transcode video footage and quickly create rough cuts.Adobe Prelude 10.1 and earlier versions are vulnerable to a null pointer dereference. An attacker...

Cobbler security vulnerability

Cobbler is a Linux installation server that allows for quick setup of network installation environments.Cobbler is vulnerable to authorization issues in versions prior to 3.3.0.The vulnerability stems from a lack of authentication measures or insufficient authentication strength in the network...

Schneider Electric IGSS buffer error vulnerability

The Schneider Electric Interactive Graphical SCADA System IGSS is an advanced SCADA system for monitoring and controlling industrial processes. An out-of-bounds write vulnerability exists in the Definition module of Interactive Graphical SCADA System IGSS versions 15.0.0.21140 and earlier. The...

JD Cloud Box AX6600 security vulnerabilities

JD Cloud Box AX6600 is a wireless router produced by JD.com, a Chinese company. The JD Cloud Box AX6600 version 4.5.3.r4546 contains a security vulnerability. This vulnerability stems from a stack buffer overflow in the setmacfilter function located in the file /sbin/jdcwebrpc. An attacker can...

Oracle OCI CLI path traversal vulnerability

Oracle OCI CLI is a cloud infrastructure management command-line tool developed by Oracle Corporation in the United States. Version 3.77 of Oracle OCI CLI contains a path traversal vulnerability. This vulnerability allows unauthorized attackers to access the system through the network, enabling...

Open Cascade OCCT buffer error vulnerability

Open Cascade OCCT is a 3D modeling and geometry computation kernel from the French company Open Cascade. A buffer error vulnerability exists in Open Cascade OCCT version V800rc5, which stems from an out-of-bounds read issue in the VrmlDataIndexedLineSet::TShape function in the VRML parser, as the...

Bouncy Castle Java security vulnerability

Bouncy Castle Java is an open-source encryption algorithm developed by Legion of the Bouncy Castle Inc. Versions of Bouncy Castle Java prior to 1.84 contained security vulnerabilities. These vulnerabilities stemmed from unlimited resource allocation, which could lead to exhaustion of pre-authoriz...

Anything-llm security vulnerabilities

anything-llm is an integrated desktop and Docker AI application developed by Mintplex. Versions of anything-llm prior to 1.9.1 contain security vulnerabilities. These vulnerabilities stem from the improper handling of user input by the AgentFlows component, which may lead to path traversal attack...

Rauc data falsification issue vulnerabilities

RAUC is a security update controller for open-source embedded Linux systems developed by RAUC. Versions of RAUC prior to 1.15.2 had a data manipulation vulnerability. This vulnerability arises from using plaintext formats, and when a RAUC bundle with an effective payload size exceeding 2 GiB is...

Rails cross-site scripting vulnerabilities

Rails is an open-source web application framework based on the Ruby language, developed by the Rails team in the United States. Versions of Rails Active Support prior to 8.1.2.1, 8.0.4.1, and 7.2.3.1 contained a cross-site scripting vulnerability. This vulnerability stemmed from the lack of...

OpenClaw data falsification vulnerability

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from a Data Forgery Issue vulnerability that stems from an unverified webhook key in Telegram webhook mode, which can be exploited by an attacker to forge Telegram updates to bypass the sender permission li...

Sz-Admin security vulnerabilities

Sz-Admin is a mid-backend management software developed by INS6+ individuals. Versions of Sz-Admin such as 1.3.2-beta and earlier contained security vulnerabilities. These vulnerabilities were caused by incorrect handling of the parameter messageId in files/api/admin/sys-message/, which could lea...

pnpm security vulnerabilities

PNPM is a package manager developed by the open-source project Pnpm. Versions of Pnpm prior to 10.28.1 contained security vulnerabilities. These vulnerabilities were caused by path traversal in binary links, which could allow malicious npm packages to create executable files or symbolic links...

Freshchat WordPress plugin has a security vulnerability

WordPress Freshchat plugin is a tool for integrating live chat functionality on WordPress websites, mainly providing customer support and user interaction features. The WordPress Freshchat plugin suffers from a cross-site request forgery vulnerability that originates from a web application that...

Nginx Proxy Manager security vulnerabilities

Nginx Proxy Manager is a Docker container for Nginx Proxy Manager open source. It is used to manage Nginx proxy hosts through a simple and powerful interface. A security vulnerability exists in Nginx Proxy Manager version v2.12.3, which stems from an improperly configured CORS and could lead to a...

Microsoft SQL Server SQL injection vulnerability

Microsoft SQL Server is a large commercial database system from Microsoft Corporation USA that is applied under the Microsoft Windows system. A SQL injection vulnerability exists in Microsoft SQL Server. An attacker can exploit the vulnerability to elevate privileges. The following products and...

HP LaserJet Pro security vulnerabilities

HP LaserJet Pro is a line of laser printers and MFPs from Hewlett-Packard HP in the United States. A security vulnerability exists in the HP LaserJet Pro that stems from an information disclosure issue that could cause a non-authenticated user to query the device's local address book...

Palo Alto Networks GlobalProtect app security vulnerability

Palo Alto Networks GlobalProtect app is a network protection software from Palo Alto Networks. A security vulnerability exists in the Palo Alto Networks GlobalProtect app, which stems from an improperly assigned privilege that could result in a locally authenticated non-administrative user...

Mattermost security vulnerabilities

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a security vulnerability that stems from not checking the RestrictSystemAdmin setting, which can be exploited by an attacker to cause a system administrator to access...

Valmet DNA security vulnerabilities

Valmet DNA is a platform for automation and information systems from the Finnish company Valmet. In this single platform, process control, machine control, quality control, drive control and equipment condition monitoring systems are covered. A security vulnerability exists in Valmet DNA, which...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that originates from post-release reuse in the ep93xxclkregistergate function...

WordPress Plugin Master Addons Cross-Site Script Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Splunk Cloud Platform and Splunk Enterprise security vulnerabilities

Splunk Cloud Platform and Splunk Enterprise are both products of Splunk, Inc. of the U.S.A. Splunk Cloud Platform is a powerful data collection, processing, and analytics service.Splunk Enterprise is a suite of data collection and analytics software. Splunk Cloud Platform and Splunk Enterprise ha...

WordPress plugin UltraAddons has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from not disabling MSGSPLICEPAGES...

WordPress plugin “File Upload Types by WPForms” has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in PHP. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress plugin File Upload Typ...

GitLab security vulnerabilities

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. A security vulnerability exists in GitLab versions 12.5 up to and including...

WordPress plugin has a SQL injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

JupyterLab security vulnerabilities

JupyterLab is a JupyterLab open source extensible environment for interactive and repeatable computation, based on the Jupyter Notebook and architecture. A security vulnerability exists in JupyterLab that originates from opening a malicious notebook or Markdown file with Markdown cells using the...

WordPress plugin Base64 Encoder/Decoder has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

TP-LINK AX1800 security vulnerabilities

The TP-LINK AX1800 is a dual-band Wi-Fi 6 router from China P&L TP-LINK. The TP-LINK AX1800 suffers from a contention condition vulnerability that can be exploited by an attacker to access resources available on the LAN interface and execute arbitrary code...

WordPress Plugin LiteSpeed Cache Cross-Site Script Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

GitLab security vulnerabilities

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab CE/EE. An attacker exploited the...

Grav code injection vulnerability

Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms and one-page product displays. A security vulnerability exists in Grav prior to version 1.7.45, which stems from validating accessible functions via the Utils::isDangerousFunction function,...

WordPress Plugin Visual Composer Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

Microsoft Open Management Infrastructure Security Vulnerability

Microsoft Open Management Infrastructure is a free, open source Common Information Model CIM management server from Microsoft. A security vulnerability exists in Microsoft Open Management Infrastructure. An attacker could exploit this vulnerability to gain elevated privileges. The following...

WordPress Plugin Image Regenerate & Select Crop Information Disclosure Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. An information disclosure vulnerability...

Carel Boss Mini security vulnerabilities

Carel Boss Mini is a locally supervised solution for small, medium and large systems from Carel Italia. A security vulnerability exists in Carel Boss Mini version 1.4.0 Build 6221, which stems from the parameter path of the file boss/servlet/document can lead to file inclusion...

GitLab cross-site scripting vulnerabilities

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab CE/EE, which stems from a possible...

Zyxel ZyWALL USG operating system command injection vulnerability

The Zyxel ZyWALL USG is a network security firewall appliance from China's Heqin Zyxel. An operating system command injection vulnerability exists in Zyxel ZyWALL USG versions 4.60 through 5.35, which stems from improper error message handling. An attacker could exploit this vulnerability to...

Notrinoserp SQL injection vulnerability

notrinoserp is a web-based ERP by Phương Individual Developer, an accounting system written in PHP and MySql. A SQL injection vulnerability exists in notrinoserp version 0.7, which originates from the OrderNumber parameter in /NotrinosERP/sales/customerdelivery.php contains a SQL injection...

AVEVA Plant SCADA Access Anywhere Authorization Issues Vulnerability

AVEVA Plant SCADA Access Anywhere is a reliable, flexible and high-performance Supervisory Control and Data Acquisition SCADA software solution for industrial process customers from AVEVA. The true value and power of Plant SCADA can be accessed in any compatible web browser. An authorization issu...