Grafana 安全漏洞

Grafana is a set of open source monitoring tools from Grafana open source that provides a visual monitoring interface. The tool is primarily used to monitor and analyze Graphite, InfluxDB, and Prometheus, among others. A security vulnerability exists in Grafana that stems from the fact that if a...

Red Hat Keycloak 安全漏洞

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in Red Hat Keycloak that stems from allowing unauthenticated cross-domain messages, allowing an attacker to...

Siemens JT2GO 代码问题漏洞

JT2Go is a JT file viewer.Teamcenter Visualization is a software that provides teamwork capabilities for designing 2D and 3D scenarios. A null pointer dereference vulnerability exists in Siemens JT2Go and Teamcenter Visualization, which can be exploited by an attacker to cause the application to...

WordPress Plugin Themify Code Issue Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

Vyper 安全漏洞

Vyper is the Pythonic smart contract language for EVM. A security vulnerability exists in Vyper versions prior to 0.3.10 that stems from allowing ecrecover to return undefined data for invalid signatures...

mx-chain-go 安全漏洞

mx-chain-go is a go implementation of the MultiversX protocol open sourced by MultiversX. A security vulnerability exists in mx-chain-go versions prior to 1.4.16, which arises from an invalid transaction caused by using the wrong username that is not properly processed by the Metachain transactio...

Apache OpenMeetings 授权问题漏洞

Apache OpenMeetings is a multilingual, customizable video conferencing and collaboration system from the Apache Foundation. The product supports audio, video and allows users to view each participant's desktop and more. An authorization issue vulnerability exists in Apache OpenMeetings versions...

AWS SDK for Rust 日志信息泄露漏洞

Amazon AWS SDK for Rust is an AWS SDK for Rust from Amazon.com, USA. AWS SDK for Rust suffers from a log message disclosure vulnerability that originates from including a user's access key, secret key, and security token in plaintext...

Microsoft .NET Core 安全漏洞

Microsoft .NET Core is a free open source development platform from Microsoft USA. The platform features multi-language support and cross-platform. NET has a DLL hijacking remote code execution vulnerability that can be exploited by an attacker to remotely execute code...

WordPress plugin Watu Quiz 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

F-Secure SAFE 安全漏洞

F-Secure SAFE is a suite of antivirus software from Finnish company Fen Secure F-Secure. A security vulnerability exists in F-Secure SAFE Browser 19.1 for Android prior to version 19.2, which stems from vulnerability to IDN synonym attacks...

Apache BookKeeper 信任管理问题漏洞

Apache BookKeeper is a scalable, fault-tolerant, and low-latency storage service optimized for real-time workloads from the Apache Foundation USA. A trust management issue vulnerability exists in the Apache Bookkeeper Java Client versions prior to 4.14.6 and prior to 4.15.0, which stems from a...

PrestaShop 信息泄露漏洞

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, short message alerts and product image scaling. An information disclosure vulnerability exists in PrestaShop versions prior to 1.7.8.8. The vulnerability...

IBAX go-ibax SQL注入漏洞

IBAX go-ibax is a blockchain system platform from IBAX Corporation. IBAX go-ibax suffers from a SQL injection vulnerability that stems from some unknown functionality in file/api/v2/open/rowsInfo, where manipulation of the parameter order leads to SQL injection...

Adobe InCopy 缓冲区错误漏洞

Adobe InCopy is an application produced by Adobe for professional word processing. Adobe InCopy 17.3 and 16.4.2 and prior versions contain an out-of-bounds read vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the current user...

BlueCMS SQL注入漏洞

BlueCMS is a PHP and MySQL based content management system CMS. a security vulnerability exists in BlueCMS version 1.6, which stems from an SQL injection in line 55 of admin/model.php. No details of the vulnerability are currently available...

Teledyne FLIR AX8 操作系统命令注入漏洞

Teledyne FLIR AX8 is a series of thermal surveillance cameras from Teledyne FLIR USA. Teledyne FLIR AX8 1.46.16 and earlier versions suffer from an operating system command injection vulnerability that originates from an attacker being able to use root privileges to execute arbitrary commands on...

ForkCMS 跨站脚本漏洞

ForkCMS is a software application. An easy-to-use open source CMS using Symfony components. A security vulnerability exists in ForkCMS version 5.9.3. A remote attacker can exploit this vulnerability to inject JavaScript via the "enddate" parameter...

GNU SASL 缓冲区错误漏洞

GNU SASL is a GNU community implementation of the Simple Authentication and Security Layer SASL framework and some common SASL mechanisms. A security vulnerability exists in GNU SASL versions prior to 2.0.1 that stems from. Server-side out-of-bounds reads to maliciously authenticated GSS-API...

rpc.py 代码问题漏洞

rpc.py is a fast and powerful ASGI/WSGI-based RPC framework for individual developers in Aber, China. A security vulnerability exists in rpc.py version 0.6.0 and earlier. An attacker exploited the vulnerability to process data using unpickle...

Robustel R1510 操作系统命令注入漏洞

The Robustel R1510 is an industrial VPN router from Robustel China.The Robustel R1510 is vulnerable to an operating system command injection vulnerability, which stems from the fact that specially crafted network packets can be subject to a command injection vulnerability in the...

Wire 跨站脚本漏洞

Wire is a chat software from the German company Wire. The software supports Web, WindowsiOS, Android, and OS X platforms, has group functionality, can make voice calls, send photos, and its original greeting method, PING. Wire has a cross-site scripting vulnerability that stems from insufficient...

Electron 输入验证错误漏洞

Electron is a personal developer of a user to write cross-platform desktop application JavaScript framework. The framework is based on nodejs and Chromium can use HTML, CSS to achieve cross-platform desktop application writing. An input validation error vulnerability exists in Electron versions...

Das U-Boot 缓冲区错误漏洞

Das U-Boot is a boot loader program mainly for embedded systems. The program supports many different computer system architectures such as PPC, ARM, AVR32, MIPS, x86, 68k, Nios and MicroBlaze. A security vulnerability exists in Das U-Boot versions prior to 2022.01, which stems from U-Boot's...

多款Siemens产品代码问题漏洞

Desigo DXR2 controllers are programmable automation stations to support the standard control needs of end HVAC equipment and TRA Total Room Automation applications. the Desigo PXC3 series of automation stations can be used in buildings where functionality and flexibility are more demanding. Use...

Microweber 安全漏洞

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A security vulnerability exists in Microweber versions prior to 1.2.15 that stems from a...

WordPress plugin MapPress Maps代码问题漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WordPress plugin is a WordPress open source application plugin. WordPress MapPress Maps plugin has an authorization problem vulnerability that stems from a lack of authentication measures or...

IdeaRe SpA IdeaRE RefTree 路径遍历漏洞

IdeaRe SpA IdeaRE RefTree is a web application for managing complex real estate situations from IdeaRe SpA, Italy. path traversal vulnerability exists in versions of IdeaRe SpA IdeaRE RefTree prior to 2021.09.17. The vulnerability stems from the failure of a web system or product to properly filt...

Veeam Backup&Replication 访问控制错误漏洞

Veeam Backup & Replication is a suite of data protection software from the Swiss company Veeam. The software provides backup, replication and recovery for VMware and Hyper-V VMs, physical and cloud environments. Veeam Backup&Replication is vulnerable to an Access Control Error vulnerability, no...

WordPress plugin WooCommerce SQL注入漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blogging sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. SQL injection vulnerability exists in versions of...

Calibre-Web 代码问题漏洞

Calibre-Web is a web application for browsing, reading and downloading eBooks from the Calibre database. Calibre-Web suffers from a server-side cross-site request forgery vulnerability, no detailed vulnerability details are available at this time...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability in WordPress Crazy Bone plugin 0.6.0 and earlier versions, which stems fr...

Jenkins 插件 权限许可和访问控制问题漏洞

Jenkins plug-ins are plug-ins that provide functionality for Jenkins. The Jenkins SWAMP Plugin Access Control Error vulnerability can be exploited by an attacker to connect to the attacker's specified web server using the attacker's specified credentials...

Ivanti Endpoint Manager 代码注入漏洞

Ivanti Endpoint Manager EPM is a suite of endpoint security managers from Ivanti Corporation, USA. A security vulnerability exists in Ivanti Endpoint Manager EPM that originates in Ivanti EPM that allows an unauthenticated user with limited privileges to execute arbitrary code...

WordPress 插件跨站脚本漏洞

WordPress plugin is a WordPress open source application plugin . A cross-site scripting vulnerability exists in WordPress PDF Flipbook, 3D Flipbook, DearFlip plugin versions prior to 1.7.10, which stems from not bypassing the class attribute of its shortcode before outputting back to the attribut...

Fission 安全漏洞

Fission is an open-source function deployment framework based on Kubernetes. Versions of Fission prior to 1.24.0 contained security vulnerabilities. These vulnerabilities stemmed from tenants with permissions to execute privileged/allowed-privileged/hazardous containers, under the account with hi...

Jenkins 安全漏洞

Jenkins is an open-source application developed by Jenkins Project. The open-source automation server Jenkins offers hundreds of plugins to support building, deploying, and automating any project. Versions 2.483 to 2.567, as well as LTS versions 2.492.1 to 2.555.2, have security vulnerabilities...

Ivanti EPMM 操作系统命令注入漏洞

Ivanti EPMM is a product developed by the American company Ivanti. It enables IT departments to create policies for mobile devices, applications, and content. Versions of Ivanti EPMM prior to 12.9.0.1, 12.8.0.3, and 12.7.0.2 contained a vulnerability related to operating system command injection...

SecureAge CatchPulse 访问控制错误漏洞

SecureAge CatchPulse is a terminal security protection platform developed by SecureAge in Singapore, based on artificial intelligence and application white-list technology. Versions of SecureAge CatchPulse 10.9.1 and earlier contain an access control vulnerability. This vulnerability stems from...

End-to-End Encryption App 安全漏洞

End-to-End Encryption App is an open-source end-to-end encryption client implementation by Nextcloud. Vulnerabilities exist in versions of End-to-End Encryption App between 1.15.0 and 1.15.4, 1.16.0 and 1.16.3, 1.17.0 and 1.17.1, and 1.18.0 and 1.18.1. These vulnerabilities stem from improper...

Assimp 安全漏洞

Assimp is an open-source library developed by Assimp. It is used for importing and exporting various 3D model formats. Versions of Assimp 6.0.4 and earlier contained security vulnerabilities. These vulnerabilities stemmed from a function in the 4x4 Matrix Parser component called...

New API SQL注入漏洞

The New API is an interface software developed by QuantumNous. Versions of the New API prior to 0.12.1 have a SQL injection vulnerability. This vulnerability originates from the SearchUserTopUps/SearchAllTopUps function in the model/topup.go file of the self Endpoint component, which may lead to...

Linux kernel 安全漏洞

The Linux kernel is the kernel used by the Linux operating system developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the adxl380 interrupt handler’s failure to round down when reading FIFO entries. This could lead to...

IOBit IObit Advanced SystemCare 后置链接漏洞

IOBit Advanced SystemCare is a system management utility developed by IOBit Corporation. This program is primarily used for scanning, repairing, and optimizing systems. Version 19 of IOBit Advanced SystemCare contained a post-installation vulnerability, which was caused by a issue with the Servic...

NEMU 安全漏洞

NEMU is an open-source teaching system simulator developed by XiangShan. NEMU has a security vulnerability. This vulnerability arises when Smstateen is enabled, and the clearing of mstateen0.ENVCFG fails to properly restrict access to henvcfg and senvcfg. This may allow low-privilege code to bypa...

Seafile Server 安全漏洞

Seafile Server is an open-source cloud storage server software developed by Seafile, offering features for file synchronization, sharing, and collaboration management. Versions of Seafile Server such as 13.0.15, 13.0.16-pro, 12.0.14, and earlier have security vulnerabilities. These vulnerabilitie...

wvp-GB28181-pro SQL注入漏洞

WVP-GB28181-pro is a video monitoring platform developed by individual developer 648540858. Versions of WVP-GB28181-pro 2.7.4 and earlier have a SQL injection vulnerability. This vulnerability stems from a SQL injection vulnerability in the selectAll function within the Stream Proxy Query Handler...

Markdown Preview Enhanced 安全漏洞

Markdown Preview Enhanced is a highly powerful markup extension developed by Yiyi Wang. Version 0.8.18 of Markdown Preview Enhanced contains a security vulnerability; this vulnerability arises from uploading specially crafted .md files, potentially allowing for the execution of arbitrary code...

nginxWebUI 代码注入漏洞

nginxWebUI is a nginx web configuration tool developed by cym1102 as an individual developer. Versions of nginxWebUI 4.3.7 and earlier contained a code injection vulnerability. This vulnerability stemmed from incorrect handling of the parameter nginxDir in the file adminPage/conf/conf, which coul...

pypdf 资源管理错误漏洞

pypdf is py-pdf open source a free open source pure python PDF library . Able to split , merge , crop and convert pages of PDF files . pypdf versions prior to 6.6.0 has a resource management error vulnerability , the vulnerability stems from the processing of missing Root objects and large Size...