Open Cascade OCCT 缓冲区错误漏洞

Open Cascade OCCT is a 3D modeling and geometry computation kernel from the French company Open Cascade. A buffer error vulnerability exists in Open Cascade OCCT version V800rc5, which stems from multiple issues with the IGES and STEP file parsers, including an out-of-bounds read of...

anything-llm 安全漏洞

anything-llm is an integrated desktop and Docker AI application developed by Mintplex. Versions of anything-llm prior to 1.9.1 contain security vulnerabilities. These vulnerabilities stem from the improper handling of user input by the AgentFlows component, which may lead to path traversal attack...

Frigate 安全漏洞

Frigate is a complete native NVR designed by Blake Blackshear for home assistants with AI object detection capabilities. Version 0.17.0 of Frigate contains a security vulnerability caused by improper access control, which may lead to the exposure of sensitive configuration information...

dify 安全漏洞

dify is an open source LLM application development platform from LangGenius Open Source. A security vulnerability exists in version 1.9.1 of dify, which stems from improper privileges and could lead to unauthorized access to system configuration data...

WordPress plugin PhpList Subber 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel, which stems from a NULL pointer dereference in the media/iris module...

HP LaserJet Pro 安全漏洞

HP LaserJet Pro is a line of laser printers and MFPs from Hewlett-Packard HP in the United States. A security vulnerability exists in the HP LaserJet Pro that stems from an information disclosure issue that could cause a non-authenticated user to query the device's local address book...

ABB RMC-100 安全漏洞

The ABB RMC-100 is a remote modular controller from ABB Switzerland. Capable of managing automation, liquid and gas measurements, asset data centralization for large production and transmission facilities. A security vulnerability exists in the ABB RMC-100 that stems from the use of hard-coded...

Microsoft Windows Netlogon 安全漏洞

Microsoft Windows Netlogon is an important component of Windows from Microsoft Corporation USA, whose main functions are authentication of users and machines on intra-domain networks and replication of databases for domain-controlled backups, as well as maintenance of domain member-to-domain,...

Browser Use 安全漏洞

Browser Use is an open source application from Browser Use. Allows AI agents to access websites. A security vulnerability exists in versions of Browser Use prior to 0.1.45 that stems from improper URL parsing of alloweddomains, which could lead to user information being placed in the authorizatio...

Cisco IOS XR 权限许可和访问控制问题漏洞

Cisco IOS XR is a set of operating systems developed by Cisco USA for its network devices. A Privilege Permission and Access Control Issues vulnerability exists in Cisco IOS XR Software that stems from incorrect handling of packets, which could lead to bypassing configured access control lists...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that originates from post-release reuse in the ep93xxclkregistergate function...

NginxProxyManager 安全漏洞

NginxProxyManager is NginxProxyManager individual developer's Docker container for managing Nginx proxy hosts with a simple, powerful interface. A security vulnerability exists in NginxProxyManager version 2.11.3, which stems from the presence of a command injection vulnerability that could allow...

Chicheng JFLow 访问控制错误漏洞

Chicheng JFLow is a workflow engine form from China Chicheng Chicheng. An access control error vulnerability exists in Chicheng JFLow version 2.0.0, which stems from a parameter oid in file /WF/Ath/EntityMutliFileLoad.do that can lead to improper access control...

Red Hat Keycloak 安全漏洞

Red Hat Keycloak is a suite of software from Red Hat USA that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in Red Hat Keycloak version 24.0.3 and prior versions. An attacker could use this vulnerability to brute-force...

OSIsoft PI Web API Code Issue Vulnerability

The Osisoft OSIsoft PI Web API is a RESTful interface to a set of PI systems from the US company Osisoft. The product supports client applications with read and write access to their AF and PI data over HTTPS. A code issue vulnerability exists in the OSIsoft PI Web API, which stems from a...

TP-LINK AX1800 安全漏洞

The TP-LINK AX1800 is a dual-band Wi-Fi 6 router from China P&L TP-LINK. The TP-LINK AX1800 suffers from a contention condition vulnerability that can be exploited by an attacker to access resources available on the LAN interface and execute arbitrary code...

WordPress Plugin LiteSpeed Cache 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

Microsoft SharePoint 安全漏洞

Microsoft SharePoint Server is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A spoofing...

Astro-Shield 安全漏洞

Astro-Shield is an open source library from KindSpells Labs. It is used to compute sub-resource integrity hashes for JS scripts and CSS stylesheets. A security vulnerability exists in Astro-Shield versions 1.2.0 through 1.3.1, which stems from a vulnerability that allows an attacker to bypass the...

rust-openssl 安全漏洞

rust-openssl is a library from Rust for interacting with the OpenSSL library. A security vulnerability exists in rust-openssl that stems from the presence of a timing-based side channel flaw...

WiX Toolset 安全漏洞

WiX Toolset is an open source code library for . A security vulnerability exists in WiX Toolset that originates from a standard user being able to hijack a binary before it is loaded into an application, resulting in elevated privileges...

wolfSSL 缓冲区错误漏洞

wolfSSL CyaSSL is the United States wolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. A security vulnerability exists in wolfSSL versions prior to 5.6.6, which can be exploited by an attacker to trigger a 5-byte buffer out-of-bounds read...

Label Studio 代码问题漏洞

Label Studio is an open source data labeling tool from Heartex Open Source. Allows you to use a simple and clear UI mark audio, text, images, video and time series and other data types , and exported to a variety of model formats . A code issue vulnerability exists in Label Studio versions prior ...

Wazuh Security Breach

Wazuh is a Wazuh open source application. It is used to collect, aggregate, index and analyze security data to help organizations detect intrusions, threats and behavioral anomalies. A security vulnerability exists in Wazuh versions prior to 4.5.3 that stems from the presence of a stack overflow...

Tenda i29 安全漏洞

The Tenda i29 is a wireless router from the Chinese company Tenda. The Tenda i29 suffers from a buffer overflow vulnerability that originates from the lanGw parameter of the lanCfgSet method failing to correctly validate the length and size of the input data, which can be exploited by a remote...

find-exec 操作系统命令注入漏洞

find-exec is a shime personal developer that takes a list of shell commands and returns the first available command. An operating system command injection vulnerability exists in find-exec versions prior to 1.0.3, which stems from the inability to properly escape user input and the ease with whic...

Kubernetes 安全漏洞

Kubernetes K8s is an open source system from the Cloud Native Computing Foundation for automating the deployment, scaling, and management of containerized applications. A security vulnerability exists in Kubernetes Kubelet that stems from a setting that allows Pods to bypass seccomp configuration...

Linksys E2000 命令注入漏洞

The Linksys E2000 is a wireless router from Linksys USA. The Linksys E2000 1.0.06 firmware version suffers from a command injection vulnerability that stems from the fact that if an attacker gains web administrative privileges, he/she can inject commands into the post request parameters wlssid,...

H3C R160 安全漏洞

The H3C R160 is a wireless router from China's Xinhua San H3C. A security vulnerability exists in the H3C R160 V1004004 version that stems from a stack-based buffer overflow due to incorrect manipulation of the parameter go...

Zyxel ZyWALL USG 操作系统命令注入漏洞

The Zyxel ZyWALL USG is a network security firewall appliance from China's Heqin Zyxel. An operating system command injection vulnerability exists in Zyxel ZyWALL USG versions 4.60 through 5.35, which stems from improper error message handling. An attacker could exploit this vulnerability to...

WordPress plugin WP Plugin Manager 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

Pulsar Plus System Controller 安全特征问题漏洞

Pulsar Plus System Controller is a Pulsar Plus series controller. A security vulnerability exists in the ABB Pulsar Plus System Controller NE843S, ABB Infinity DC Power Plant, which stems from the presence of an Insufficient Use of Random Values vulnerability. The following products and versions...

Jenkins Plugin TestQuality Updater 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

Cisco Small Business RV340 和 RV345 操作系统命令注入漏洞

The Cisco Small Business RV340 and the Cisco Small Business RV345 are both products of Cisco, Inc.The Cisco Small Business RV340 is a router. The Cisco Small Business RV340 is a router, a hardware device that connects two or more networks and acts as a gateway between them.The Cisco Small Busines...

Discourse 跨站脚本漏洞

Discourse is an open source community discussion platform. The platform includes community, email and chat room features. A cross-site scripting vulnerability exists in Discourse BBCode, which stems from the fact that it allows an attacker to utilize multiple CSS injections...

Google TensorFlow 缓冲区错误漏洞

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc...

Wiesemann & Theis Com-Server Family 安全特征问题特征问题漏洞

The Wiesemann & Theis Com-Server Family is a series of serial device servers from the German company Wiesemann & Theis. A security signature issue vulnerability exists in Wiesemann & Theis Com-Server Family. An attacker could exploit this vulnerability to brute force a session id and access...

Softmotions IOWOW 缓冲区错误漏洞

Softmotions IOWOW is a C11 persistent key/value store based on a jump table data structure from Softmotions. A security vulnerability exists in Softmotions IOWOW version 1.4.15 and prior versions, which stems from a contained stack buffer overflow vulnerability. An attacker could exploit this...

Google TensorFlow 安全漏洞

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A denial-of-service vulnerability exists in Google TensorFlow, which stems from the fact that when CollectiveGather receives a scalar input input, it gives an assertion of failure, which can be exploite...

Google TensorFlow 输入验证错误漏洞

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google, Inc. in the United States. Google TensorFlow suffers from an input validation error vulnerability that stems from a segmentation error that can be used to trigger a denial-of-service attack if...

WordPress plugin Beaver Builder – WordPress Page Builder 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Beaver Builder - A...

GNU Inetutils 代码问题漏洞

GNU Inetutils is a common set of networking programs in the GNU community. A security vulnerability exists in GNU Inetutils version 2.3 and earlier, MIT krb5-appl version 1.0.3 and earlier, which stems from dereferencing the NULL pointer and causes the telnetd application to crash...

WordPress Plugin WP phpMyAdmin 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Intel Ethernet Controllers 安全漏洞

Intel Ethernet Controllers is an Ethernet controller from Intel Corporation USA. A security vulnerability exists in IntelR E810 Ethernet Controllers versions prior to 1.6.2.9, which stems from incorrect access control. An attacker could exploit this vulnerability to perform a denial of service...

Microsoft Visual Studio 安全漏洞

Microsoft Visual Studio is a family of development tool suites from Microsoft Corporation USA and a largely complete development toolset that includes most of the tools needed throughout the software lifecycle. A security vulnerability exists in Microsoft Visual Studio. The following products and...

Ruby ruby-mysql 安全漏洞

Ruby ruby-mysql is a pure Ruby version of the MySQL connector from the Ruby community.An access control error vulnerability exists in Ruby ruby-mysql Gem versions prior to 2.10.0, which stems from the fact that a malicious MySQL server can request local file content from a client without explicit...

Motorola Solutions ACE1000 授权问题漏洞

The Motorola Solutions ACE1000 is a Remote Terminal Unit RTU from Motorola USA. The Motorola Solutions ACE1000 RTU version suffers from an authorization issue vulnerability that stems from the fact that the affected product's SSH service is controlled by five pre-configured accounts, all of which...

ArgoCD 安全漏洞

ArgoCD is a software application. A declarative GitOps continuous delivery tool for Kubernetes. It continuously monitors running applications and compares the current live state with the desired target state e.g., configuration in a Git repository, automatically synchronizing and deploying...

django-mfa3 授权问题漏洞

django-mfa3 is a stubborn Django application that handles multi-factor authentication MFA via FIDO2, TOTP and recovery code. A security vulnerability exists in django-mfa3. No information about this vulnerability is available at this time, so please stay tuned to CNNVD or the vendor announcement...