SourceCodester User Registration and Login System Cross-Site Scripting Vulnerability

User Registration and Login System is a user registration and login system by Remy Andrade, an individual developer. A cross-site scripting vulnerability exists in the SourceCodester User Registration and Login System, which originates from cross-site scripting in the firstname parameter of...

H3C R160 security vulnerabilities

The H3C R160 is a wireless router from China's Xinhua San H3C. A security vulnerability exists in the H3C R160 V1004004 version that stems from a stack-based buffer overflow due to incorrect manipulation of the parameter go...

Publify input validation error vulnerability

Publify is a simple but full-featured web publishing software. versions of Publify prior to 9.2.10 are vulnerable to an input validation error, which stems from the presence of an integer overflow issue. No detailed vulnerability details are currently available...

Discourse cross-site scripting vulnerabilities

Discourse is an open source community discussion platform. The platform includes community, email and chat room features. A cross-site scripting vulnerability exists in Discourse BBCode, which stems from the fact that it allows an attacker to utilize multiple CSS injections...

Google TensorFlow buffer error vulnerability

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc...

pymatgen security vulnerabilities

pymatgen is an open source Python library for material analysis. A security vulnerability exists in pymatgen that can be exploited to trigger an exponential ReDoS when an attacker provides arbitrary input to the GaussianInput.fromstring method...

Microsoft Network Policy Server security vulnerabilities

Microsoft Network Policy Server is used to create and enforce organization-wide network access policies for connection request authentication and authorization by Microsoft Corporation USA. A security vulnerability exists in Microsoft Network Policy Server NPS. The following products and versions...

Ruby on Rails cross-site scripting vulnerabilities

Ruby on Rails is an open source web application framework based on the Ruby language by the American Rails team. A cross-site scripting vulnerability exists in Ruby on Rails. An attacker could exploit this vulnerability to perform a cross-site scripting attack...

WordPress plugin Taskbuilder has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Taskbuilder plugin versions prior to 1.0.8 have a cross-site scripting vulnerability that stems fro...

Microsoft Windows security vulnerabilities

Microsoft Windows is a suite of operating systems for use on personal devices from the U.S.-based Microsoft Corporation Microsoft. A security vulnerability exists in the Microsoft Windows Credential Roaming Service. The following products and versions are affected:Windows 10 Version 1809 for 32-b...

Teledyne FLIR AX8 Operating System Command Injection Vulnerability

Teledyne FLIR AX8 is a series of thermal surveillance cameras from Teledyne FLIR USA. Teledyne FLIR AX8 1.46.16 and earlier versions suffer from an operating system command injection vulnerability that originates from an attacker being able to use root privileges to execute arbitrary commands on...

Microsoft Excel security vulnerabilities

Microsoft Excel is a spreadsheet processing software in the Office suite of Microsoft Corporation USA. A security vulnerability exists in Microsoft Office Excel. The following products and editions are affected: Microsoft Excel 2016 32-bit edition,Microsoft Excel 2016 64-bit edition,Microsoft Exc...

TYPO3 cross-site scripting vulnerabilities

TYPO3 is a free and open source content management system framework CMS/CMF from the TYPO3 Association in Switzerland. A security vulnerability exists in TYPO3. No information about this vulnerability is available at this time, so please stay tuned to CNNVD or the vendor's announcement. The...

XWiki Platform Cross-site Scripting Vulnerabilities

XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from XWiki France. A security vulnerability exists in the XWiki Platform Filter UI, which stems from the discovery of a cross-site scripting issue...

WordPress plugin Web To Print Shop: uDraw security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress plugin Web To Print Shop: An arbitrary file reading vulnerability exists in versions of uDraw prior...

CheckMK Raw Edition security vulnerabilities

tribe29 CheckMK Raw Edition is a comprehensive and flexible IT monitoring system from tribe29, Germany. A security vulnerability exists in CheckMK Raw Edition that originates from a successful exploit that requires the use of valid credentials or a user with the administrator role to hijack a...

Oracle MySQL input validation vulnerability

Oracle MySQL Cluster is a write-scalable, real-time, ACID-compatible transactional database developed by Oracle Corporation USA. Oracle MySQL Cluster 8.0.26 and earlier versions of the Cluster: General component are vulnerable to an input validation error that could be exploited by an attacker to...

SonicOS Input Verification Vulnerability

Sonicwall SonicOS is an operating system designed for SonicWall firewall appliances from SonicWall USA. SonicOS suffers from an input validation error vulnerability that stems from the system's lack of effective validation and escaping of host headers. The host header redirection vulnerability...

Hashicorp Vault information leakage vulnerability

HashiCorp HashiCorp Vault is a private key access management tool from HashiCorp Hashicorp, USA. An information disclosure vulnerability exists in HashiCorp Vault, which stems from a misconfiguration of the product's cache that causes the browser to incorrectly cache sensitive information about a...

ZEIT Next.js Input Validation Vulnerability

ZEIT Next.js is an open source web application framework from ZEIT based on Vue.js, Node.js, Webpack, and Babel.js. ZEIT Next.js is vulnerable to an input validation error in versions prior to 11.1.0, which stems from a web system or product that does not properly validate input data. An attacker...

Zope path traversal vulnerability

Zope is a set of object-oriented, open source web application servers written in the Python language by the Zope ZOPE community. A security vulnerability exists in Zope in versions prior to 4.6 and 5.2 that allows untrusted users to trigger the vulnerability by adding sites that edit Zope page...

CyberArk Idira Secrets Manager SaaS Edge Access Control Vulnerability

CyberArk Idira Secrets Manager SaaS Edge is a distributed confidential access node component offered by the American company CyberArk. Versions of CyberArk Idira Secrets Manager SaaS Edge prior to version 1.8 contained an access control vulnerability. This vulnerability stemmed from improper acce...

VMware Spring for Apache Kafka code issue vulnerabilities

VMware Spring for Apache Kafka is a Kafka messaging integration framework developed by VMware, Inc. Versions of VMware Spring for Apache Kafka prior to 4.0.0, as well as versions 3.3.0 and earlier, 3.2.0 and earlier, 2.9.0 and earlier, and 2.8.0 and earlier, contain code vulnerabilities. These...

Microsoft Windows Deployment Services Resource Management Error Vulnerability

Microsoft Windows Deployment Services are a container for Windows deployment services an updated and redesigned version of Remote Installation Services RIS provided by Microsoft Corporation. These services allow for the setup of new computers through network-based unattended installations...

Lyrion Music Server Cross-Site Script Vulnerability

Lyrion Music Server is an audio server software developed by the Lyrion organization. Version 9.2.0 of Lyrion Music Server contains a cross-site scripting vulnerability. This vulnerability stems from an unvalidated reflective cross-site scripting vulnerability present in the server.log endpoint,...

NextCloud Tables SQL Injection Vulnerability

NextCloud Tables is an open-source table-based application developed by NextCloud. Versions of NextCloud Tables from 0.7.0 to 0.7.7, 0.8.0 to 0.8.10, 0.9.0 to 0.9.8, and 1.0.0 to 1.0.4 have SQL injection vulnerabilities. These vulnerabilities stem from stored injection attacks, allowing...

XCharge C6 security vulnerabilities

XCharge C6 is a series of intelligent electric vehicle DC charging stations developed by the German company XCharge. There is a security vulnerability in the XCharge C6, which stems from a configuration flaw in the device’s remote management service. This flaw allows for the establishment of...

Protobuf.js code injection vulnerability

protobuf.js is an open-source implementation of the Protocol Buffers protocol, written entirely in JavaScript. It supports Node.js and browsers with TypeScript. It’s easy to use, extremely fast, and can be used out of the box through.proto files. Versions prior to 7.5.6 and 8.0.2 of protobuf.js h...

vm2 security vulnerabilities

vm2 is a high-level virtual machine/sandbox developed by Czech developer Patrik Simek. It runs untrusted code using Node’s built-in modules listed in the allowlist. Versions of vm2 prior to 3.11.0 have security vulnerabilities; these vulnerabilities stem from sandbox boundary violations. During...

SOCFortress CoPilot authorization issue vulnerability

SOCFortress CoPilot is an open-source unified security operations platform developed by SOCFortress. Versions of SOCFortress CoPilot prior to 0.1.57 contained authorization-related vulnerabilities. These vulnerabilities stemmed from a hardcoded JWT signing key being used as a backup value, and th...

Janet buffer error vulnerability

Janet is a functional and imperative programming language and bytecode interpreter developed by Janet Language. Versions of Janet prior to 1.40.1 contained a buffer error vulnerability, which was caused by an out-of-bounds read in the function janetcpopfuncdef, potentially leading to information...

OpenSTAManager: Operating system command injection vulnerability

OpenSTAManager is an open-source management software for technical assistance and billing developed by Devcode. Versions of OpenSTAManager 2.9.8 and earlier contained a vulnerability related to operating system command injection. This vulnerability stemmed from the P7M file decoding function’s...

SchedMD Slurm security vulnerability

SchedMD Slurm is an open-source, highly scalable cluster management and job scheduling system developed by SchedMD in the United States. Versions prior to 24.11.5, 24.05.8, and 23.11.11 of SchedMD Slurm contained security vulnerabilities. These vulnerabilities stemmed from the accounting system...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an MSR access error that could result in a register write failure...

IPFire security vulnerabilities

IPFire is an open source Linux distribution from the IPFire organization. It is primarily used as a router and firewall. A security vulnerability exists in IPFire versions prior to 2.29, which stems from the creation of proxy reports without cleaning up multiple parameters, which could lead to...

Wavlink WL-WN578W2: Operating System Command Injection Vulnerability

The Wavlink WL-WN578W2 is a wireless repeater from China's Wavlink. The Wavlink WL-WN578W2 221110 version has an operating system command injection vulnerability, which originates from the parameter macAddr in the sub404DBC function of the file /cgi-bin/wireless.cgi that fails to correctly filter...

SUSE Linux’s various products have security vulnerabilities

SUSE Linux Enterprise Desktop is an enterprise server version of the Linux desktop operating system from SUSE Germany. A security vulnerability exists in various SUSE Linux products that originates from a stream reset in the HTTP/2 implementation that results in excessive consumption of server...

Microsoft SQL Server security vulnerabilities

Microsoft SQL Server is a large commercial database system from Microsoft Corporation USA that is used under Microsoft Windows. A security vulnerability exists in Microsoft SQL Server. An attacker can exploit the vulnerability to elevate privileges. The following products and versions are...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a null pointer dereference vulnerability that stems from not verifying the validity of a decoder, which could lead to a null pointer dereference. An...

LiteLLM security vulnerabilities

LiteLLM is an open source application from Berri AI. All LLM APIs can be called using the OpenAI format. A security vulnerability exists in LiteLLM v1.52.1, which stems from an error in the parsing team settings that resulted in the disclosure of Langfuse API keys, potentially leading to the...

Rails security vulnerabilities

Rails is a set of open source web application frameworks based on the Ruby language by the US-based Rails team. A security vulnerability exists in Rails that stems from the presence of a DOM-based cross-site scripting vulnerability that allows an attacker to inject malicious script into a victim'...

Mastodon security vulnerabilities

Mastodon is an open source social networking server based on ActivityPub by Mastodon Open Source. A security vulnerability exists in Mastodon versions 4.1.x prior to 4.1.17 and 4.2.x prior to 4.2.9, which stems from a vulnerability that allows rate limiting to be bypassed via a crafted HTTP reque...

WordPress plugin mFolio Lite: Code issues and vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

Splunk Enterprise and Splunk Cloud Platform security vulnerabilities

Splunk Cloud Platform and Splunk Enterprise are both products of Splunk Corporation, U.S.A. Splunk Cloud Platform is a powerful data collection, processing, and analytics service.Splunk Enterprise is a suite of data collection and analytics software. A security vulnerability exists in Splunk...

WordPress plugin TI WooCommerce Wishlist has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Red Hat Keycloak security vulnerabilities

Red Hat Keycloak is a suite of software from Red Hat USA that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in Red Hat Keycloak version 24.0.3 and prior versions. An attacker could use this vulnerability to brute-force...

Microsoft Visual Studio and Microsoft .NET Security Vulnerabilities

Microsoft Visual Studio and Microsoft .NET are both products of Microsoft Corporation, USA. Microsoft Visual Studio is a family of development tool suites and a fundamentally complete set of development tools that includes most of the tools needed throughout the software lifecycle. Microsoft .NET...

idcCMS Security Breach

Net Titanium Technology idcCMS Net Titanium IDC Cloud Management Agent System is a cloud management agent system by Net Titanium Technology China. A security vulnerability exists in idcCMS v1.35, which originates from a cross-site request forgery vulnerability in the...

Flowise security vulnerabilities

Flowise is a tool for easily building LLM applications. A security vulnerability exists in Flowise version 1.6.5 that stems from the presence of an authentication bypass vulnerability...

Microsoft SharePoint security vulnerabilities

Microsoft SharePoint Server is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A spoofing...