rust-openssl security vulnerabilities

rust-openssl is a library from Rust for interacting with the OpenSSL library. A security vulnerability exists in rust-openssl that stems from the presence of a timing-based side channel flaw...

WordPress Plugin Themify Code Issue Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

Softnext Technologies Mail SQR Expert Security Vulnerability

Softnext Technologies Mail SQR Expert is a comprehensive email content security management system from Softnext Technologies, China. A security vulnerability exists in Softnext Technologies Mail SQR Expert prior to v230330, which is caused by a Local File Inclusion LFI vulnerability in a special...

Microsoft Windows Defender Security Vulnerability

Microsoft Windows Defender is a suite of antivirus software that comes with Windows systems from Microsoft USA. A security vulnerability exists in Microsoft Windows Defender. An attacker can exploit the vulnerability to elevate privileges...

Number withdrawal

SQLite is a lightweight database that is an ACID-compliant relational database management system. This CVE number has been withdrawn...

WordPress plugin WP Plugin Manager has a cross-site request forgeing vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

Crossplane resource management error vulnerability

crossplane is a framework for building cloud-native control planes without writing code. A resource management error vulnerability exists in crossplane-runtime that stems from user-supplied input that is not properly validated, which could use too much memory and lead to out of memory...

Hoosk CMS code-related vulnerabilities

Hoosk CMS is a lightweight content management system. Hoosk CMS v1.8.0 suffers from an arbitrary file upload vulnerability that stems from its /attachments component failing to validate uploaded files. An attacker can exploit the vulnerability to remotely execute code...

IBAX go-ibax SQL injection vulnerability

IBAX go-ibax is a blockchain system platform from IBAX Corporation. IBAX go-ibax suffers from a SQL injection vulnerability that stems from some unknown functionality in file/api/v2/open/rowsInfo, where manipulation of the parameter order leads to SQL injection...

Adobe RoboHelp Cross-Site Script Vulnerability

Adobe RoboHelp is a help authoring tool developed and released for Windows by the American company Audobee Adobe. A cross-site scripting vulnerability exists in Adobe RoboHelp version 2020.0.7 and earlier, which stems from the program's lack of checksum filtering of user-supplied data and output...

H3C SSL VPN Cross-Site Script Vulnerability

H3C SSL VPN is a secure session layer VPN from China's Xinhua San H3C. A cross-site scripting vulnerability exists in H3C SSL VPN 2022-07-10 and prior versions, which can be exploited by remote attackers to allow wnm/login/login.json svpnlang cross-site scripting attacks...

Django-MFA3 authorization issue vulnerability

django-mfa3 is a stubborn Django application that handles multi-factor authentication MFA via FIDO2, TOTP and recovery code. A security vulnerability exists in django-mfa3. No information about this vulnerability is available at this time, so please stay tuned to CNNVD or the vendor announcement...

iRZ Mobile Routers: Cross-site Request Forgery Vulnerability

iRZ Mobile Routers is a series of mobile routers from the Russian company iRZ. A security vulnerability exists in /api/crontab of iRZ Mobile Routers, which can be exploited by an attacker to create a crontab entry in the router's administration panel, which will be executed by a cronjob at an...

Rust encryption vulnerabilities

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. version 0.9.7 before Rust sha2 crate 0.9.8 contains a security vulnerability in which the hash of a long message may be incorrect when the AVX2-accelerated backend is used. No details of the vulnerability are...

Solarwinds Kiwi Syslog Server code-related vulnerabilities

Solarwinds Kiwi Syslog Server is an affordable Syslog management tool for network and system engineers from Solarwinds USA. It is used to receive syslog messages and Snmp traps from network devices routers, switches, firewalls, etc. and Linux®/Unix® hosts. A code issue vulnerability exists in the...

WordPress plugin information leakage vulnerability

WordPress Plugin is an open source application plugin for WordPress. The WordPress plugin BulletProof Security suffers from an information disclosure vulnerability that stems from the fact that the BulletProof Security plugin for WordPress can easily disclose sensitive information due to a file...

Cerebrate security vulnerabilities

Cerebrate is an open-source platform developed by Cerebrate. It serves as an interconnected coordinator for trusted contact information providers and other security tools. Prior to version 1.37 of Cerebrate, there were security vulnerabilities. These vulnerabilities stemmed from CRUD editing...

tmp Path Traversal Vulnerability

“tmp” is a temporary file and directory creator developed by KARASZI István for Node.js developers. Versions of “tmp” prior to 0.2.6 had a path traversal vulnerability; this vulnerability could lead to files being created outside of the intended temporary directories due to path traversal...

SolidInvoice cross-site scripting vulnerability

SolidInvoice is an open-source invoice processing application developed by SolidInvoice. Versions of SolidInvoice prior to 2.3.17 contained a cross-site scripting vulnerability. This vulnerability stemmed from the company logo upload feature not verifying file types. As a result, authenticated...

VMware Spring Security and Spring Authorization Server have vulnerabilities related to input validation errors.

VMware Spring Security and Spring Authorization Server are both products of the American company VMware. VMware Spring Security is a security framework designed to provide descriptive security protections for Spring-based applications. Spring Authorization Server is a framework used to build secu...

KubeV2V Migration assessment: Authorization issue vulnerability

Migration assessment is an open-source tool developed by KubeV2V for evaluating and providing migration recommendations for VMware environments. There is a security vulnerability in Migration assessment. This vulnerability stems from the /api/v1/sources/id/image-url endpoint, where improper acces...

QNAP QTS buffer error vulnerability

QNAP Systems QTS and QNAP Systems QuTS are both products of QNAP Systems Corporation. QNAP Systems QTS is an entry-level operating system. QNAP Systems QuTS hero is a software with data storage and management capabilities. Both QNAP Systems QTS and QNAP Systems QuTS hero have security...

WordPress plugin Xstore has a SQL injection vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. Versions...

Microsoft Windows Push Notifications Information Leakage Vulnerability

Microsoft Windows Push Notifications is a push notification service provided by Microsoft Corporation. It provides a reliable way to deliver new updates. However, Microsoft Windows Push Notifications has information leakage vulnerabilities. The following products and versions are affected: Window...

Microsoft Defender for Endpoint security vulnerabilities

Microsoft Defender for Endpoint is an enterprise endpoint security platform provided by Microsoft Corporation in the United States. It helps protect against advanced persistent threats. There are security vulnerabilities in Microsoft Defender for Endpoint. Attackers can exploit these...

VMware Spring AI Security Vulnerabilities

VMware Spring AI is a development framework created by VMware Corporation in the Spring ecosystem, which integrates artificial intelligence and large language model capabilities. VMware Spring AI has a security vulnerability. This vulnerability allows malicious users to manipulate the behavior of...

Admidio cross-site scripting vulnerabilities

Admidio is a set of open-source member management systems developed by the Admidio team. This system supports features such as member lists, event management, message boards, photo albums, and downloads. Prior to Admidio 5.0.9, there was a cross-site scripting vulnerability. This vulnerability...

WVP-GB28181-pro SQL Injection Vulnerability

WVP-GB28181-pro is a video monitoring platform developed by individual developer 648540858. Versions of WVP-GB28181-pro 2.7.4 and earlier have a SQL injection vulnerability. This vulnerability stems from a SQL injection vulnerability in the selectAll function within the Stream Proxy Query Handler...

TOTOLINK A7000R Command Injection Vulnerability

TOTOLINK A7000R is a wireless router produced by TOTOLINK, a Chinese company. The TOTOLINK A7000R version 4.1cu.4154 contains a command injection vulnerability. This vulnerability arises from incorrect handling of the parameter FileName in the file /cgi-bin/cstecgi.cgi, which may lead to command...

Microsoft Windows Network Driver Interface Specification Buffer Error Vulnerability

The Microsoft Windows Network Driver Interface Specification is one of the core components of a Windows network architecture from Microsoft Corporation. A buffer error vulnerability exists in the Microsoft Windows Network Driver Interface Specification. An attacker could exploit this vulnerabilit...

Zeroheight security vulnerability

Zeroheight is a design system management platform from Zeroheight UK. A security vulnerability exists in versions of Zeroheight prior to 2025-06-13, which stems from a legacy user creation API that allows bypassing the email validation step to create an account, potentially leading to spam or fak...

Itsourcecode Student Management System SQL Injection Vulnerability

itsourcecode Student Management System is an open source student management system from itsourcecode. A SQL injection vulnerability exists in version 1.0 of itsourcecode Student Management System, which stems from incorrect manipulation of the parameter ID in the file /studentp.php, which could...

IBM Transformation Extender Advanced code issue vulnerability

IBM Transformation Extender Advanced is a data transformation, validation and standardization tool software from International Business Machines IBM. A code issue vulnerability exists in IBM Transformation Extender Advanced version 10.0.1 that stems from a failure to disable a session after loggi...

datart security vulnerabilities

datart is an open source data visualization open platform by running-elephant. A security vulnerability exists in datart version 1.0.0-rc.3, which stems from the POST /viz/image interface not strictly validating filenames, which could lead to a directory traversal attack...

Microsoft M365 Copilot command injection vulnerability

Microsoft M365 Copilot is an AI-powered productivity tool from Microsoft Corporation USA. Microsoft M365 Copilot suffers from a command injection vulnerability that stems from command injection and could lead to information disclosure over the network...

Ruby security vulnerabilities

Ruby is a cross-platform, object-oriented, dynamically typed programming language from the personal developer Yukihiro Matsumoto. A security vulnerability exists in Ruby that stems from vulnerability to the Marvin attack, which allows an attacker to decrypt previously encrypted messages or forge...

Adobe Photoshop digital error vulnerability

Adobe Photoshop is a set of image processing software from the American company Audobee Adobe. The software is mainly used for processing pictures. Adobe Photoshop suffers from a numeric error vulnerability that can be exploited by an attacker to cause arbitrary code to be executed in the current...

libheif security vulnerabilities

libheif is an ISO/IEC 23008-12:2017 HEIF file format decoder and encoder from struktur open source. A security vulnerability exists in libheif version 1.17.6, which stems from insufficient checks when decoding HEIF files containing forged offsets, which could lead to out-of-bounds reads and write...

Microchip TimeProvider 4100: Operating System Command Injection Vulnerability

Microchip TimeProvider 4100 is a gateway clock from Microchip, Inc. A security vulnerability exists in the Microchip TimeProvider 4100 prior to version 2.4.7 that stems from improper neutralization of special elements of operating system commands, resulting in OS command injection...

WordPress plugin Prime Slider has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

Triangle MicroWorks SCADA Data Gateway security vulnerability

Triangle MicroWorks SCADA Data Gateway is a SCADA data gateway product from Triangle MicroWorks, Inc. An information disclosure vulnerability exists in Triangle MicroWorks SCADA Data Gateway, which can be exploited by attackers to obtain sensitive information...

Quarkus security vulnerabilities

Quarkus is a cloud-native Linux container-first framework for writing Java applications. A security vulnerability exists in Quarkus that stems from the leakage of local configuration properties into Quarkus applications...

Gibbon security vulnerabilities

Gibbon is a school platform that solves real-world problems that educators encounter every day. A security vulnerability exists in Gibbon version 26.0.00 and earlier that stems from a vulnerability that allows an attacker to conduct a PHP via columnOrder in a POST request to...

Label Studio code issue vulnerabilities

Label Studio is an open source data labeling tool from Heartex Open Source. Allows you to use a simple and clear UI mark audio, text, images, video and time series and other data types , and exported to a variety of model formats . A code issue vulnerability exists in Label Studio versions prior ...

Wazuh Security Breach

Wazuh is a Wazuh open source application. It is used to collect, aggregate, index and analyze security data to help organizations detect intrusions, threats and behavioral anomalies. A security vulnerability exists in Wazuh versions prior to 4.5.3 that stems from the presence of a stack overflow...

Siemens JT2GO code issue vulnerabilities

JT2Go is a JT file viewer.Teamcenter Visualization is a software that provides teamwork capabilities for designing 2D and 3D scenarios. A null pointer dereference vulnerability exists in Siemens JT2Go and Teamcenter Visualization, which can be exploited by an attacker to cause the application to...

HashiCorp Vault security vulnerability

HashiCorp Vault is a private key access management tool from the US-based HashiCorp. HashiCorp Vault suffers from a security vulnerability that stems from vulnerability to a cache timing attack, where an attacker who is able to observe a large number of unblocking operations on a host through a...

ASUS ASMB8-iKVM command injection vulnerability

ASUS ASMB8-iKVM is an effective remote server management chip from Asus China. A security vulnerability exists in ASUS ASMB8-iKVM version 1.14.51 and earlier, which originated from a vulnerability that allows remote attackers to execute arbitrary code by creating an extension using SNMP...

Jenkins Plugin TestQuality Updater has a security vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

WordPress plugin ShiftNav has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...