Wazuh Security Breach

Wazuh is a Wazuh open source application. It is used to collect, aggregate, index and analyze security data to help organizations detect intrusions, threats and behavioral anomalies. A security vulnerability exists in Wazuh versions prior to 4.5.3 that stems from the presence of a stack overflow...

Siemens JT2GO code issue vulnerabilities

JT2Go is a JT file viewer.Teamcenter Visualization is a software that provides teamwork capabilities for designing 2D and 3D scenarios. A null pointer dereference vulnerability exists in Siemens JT2Go and Teamcenter Visualization, which can be exploited by an attacker to cause the application to...

HashiCorp Vault security vulnerability

HashiCorp Vault is a private key access management tool from the US-based HashiCorp. HashiCorp Vault suffers from a security vulnerability that stems from vulnerability to a cache timing attack, where an attacker who is able to observe a large number of unblocking operations on a host through a...

ASUS ASMB8-iKVM command injection vulnerability

ASUS ASMB8-iKVM is an effective remote server management chip from Asus China. A security vulnerability exists in ASUS ASMB8-iKVM version 1.14.51 and earlier, which originated from a vulnerability that allows remote attackers to execute arbitrary code by creating an extension using SNMP...

Jenkins Plugin TestQuality Updater has a security vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

WordPress plugin ShiftNav has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

Cisco Small Business RV340 and RV345 operating system command injection vulnerabilities

The Cisco Small Business RV340 and the Cisco Small Business RV345 are both products of Cisco, Inc.The Cisco Small Business RV340 is a router. The Cisco Small Business RV340 is a router, a hardware device that connects two or more networks and acts as a gateway between them.The Cisco Small Busines...

Apache Kylin security vulnerabilities

Apache Kylin is an open source distributed analytic data warehouse from the Apache Foundation. The product mainly provides Hadoop/Spark on top of the SQL query interface and multidimensional analysis OLAP and other functions. kylin has a command injection vulnerability, the vulnerability stems fr...

Bank Management System SQL Injection Vulnerability

Bank Management System is a bank management system. A SQL injection vulnerability exists in Blood Bank Management System version 1.0, which stems from several unknown handlers in the login.php file that manipulate the parameters username/password allowing an attacker to implement SQL injection. N...

WordPress plugin GetYourGuide Ticketing has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Yauaa security vulnerabilities

Yauaa is a java library from the personal developer Niels Basjes. It is used for UserAgent analysis. A security vulnerability exists in Yauaa, which stems from its introduction of a client-side hint analysis feature that causes applications to crash when the Yauaa library throws an...

Digital Alert Systems DASDEC EAS Cross-site Scripting Vulnerabilities

Digital Alert Systems DASDEC EAS is a digital alert system from Digital Alert Systems in the United States. A cross-site scripting vulnerability exists in all current versions of Digital Alert Systems DASDEC, which stems from a lack of effective filtering and escaping of user-supplied data on an...

Wiesemann & Theis Com-Server Family Security Feature Issues

The Wiesemann & Theis Com-Server Family is a series of serial device servers from the German company Wiesemann & Theis. A security signature issue vulnerability exists in Wiesemann & Theis Com-Server Family. An attacker could exploit this vulnerability to brute force a session id and access...

Microsoft Azure Operating System Command Injection Vulnerability

Microsoft Azure is a suite of open, enterprise-grade cloud computing platforms from Microsoft Corporation USA. An operating system command injection vulnerability exists in Microsoft Azure CLI versions prior to 2.40.0, which originates from a host running Azure CLI commands where the parameter...

BoxBilling code-related vulnerabilities

BoxBilling is open source billing and customer management software from the individual developers of BoxBilling. A security vulnerability exists in BoxBilling versions prior to 0.0.1 that stems from not restricting the upload of dangerous types of files...

Apache Pinot security vulnerabilities

Apache Pinot is the U.S. Apache Apache Foundation, a real-time distributed OLAP data store. It is designed to provide ultra-low latency analytics. A security vulnerability exists in Apache Pinot 0.11.0 and earlier versions, which stems from a vulnerability in the groovy feature support...

TestLink Cross-Site Request Forgery Vulnerability

TestLink is a suite of open source software from the TestLink team for managing the software testing process and providing statistical analysis. A security vulnerability exists in TestLink v1.9.20, which was discovered via /lib/plan/planView.php to contain a cross-site request forgery vulnerabili...

Google TensorFlow input validation error vulnerability

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google, Inc. in the United States. Google TensorFlow suffers from an input validation error vulnerability that stems from a segmentation error that can be used to trigger a denial-of-service attack if...

Flux2 path traversal vulnerability

Flux2 is a tool from the Cloud Native Computing Foundation that keeps Kubernetes clusters synchronized with their configuration sources. A path traversal vulnerability exists in Flux2 versions v0.21.0 through v0.31.0, which stems from mishandling of user-supplied input and can be exploited by an...

CoreDNS security vulnerabilities

CoreDNS is a DNS server for the CoreDNS community. A security vulnerability exists in CoreDNS that stems from DNS redirection of internal services...

Foxit PDF Reader resource management error vulnerability

Foxit PDF Reader is a PDF reader from Foxit China.A remote code execution vulnerability exists in Foxit PDF Reader Annotation, which can be exploited by attackers to execute code in the context of the current process...

Ruby ruby-mysql security vulnerability

Ruby ruby-mysql is a pure Ruby version of the MySQL connector from the Ruby community.An access control error vulnerability exists in Ruby ruby-mysql Gem versions prior to 2.10.0, which stems from the fact that a malicious MySQL server can request local file content from a client without explicit...

Motorola Solutions ACE1000 Authorization Issue Vulnerability

The Motorola Solutions ACE1000 is a Remote Terminal Unit RTU from Motorola USA. The Motorola Solutions ACE1000 RTU version suffers from an authorization issue vulnerability that stems from the fact that the affected product's SSH service is controlled by five pre-configured accounts, all of which...

CODESYS Gateway Server security vulnerabilities

CODESYS Gateway Server is an extended CODESYS Gateway from CODESYS Corporation that connects a CODESYS Automation Server to a CODESYS PLC in a local network. A security vulnerability exists in versions prior to CODESYS Gateway Server V2 V2.3.9.38 that stems from comparing only a portion of a...

ArgoCD security vulnerabilities

ArgoCD is a software application. A declarative GitOps continuous delivery tool for Kubernetes. It continuously monitors running applications and compares the current live state with the desired target state e.g., configuration in a Git repository, automatically synchronizing and deploying...

Vulnerabilities in product codes of various Siemens products

Desigo DXR2 controllers are programmable automation stations to support the standard control needs of end HVAC equipment and TRA Total Room Automation applications. the Desigo PXC3 series of automation stations can be used in buildings where functionality and flexibility are more demanding. Use...

SchedMD Slurm security vulnerability

SchedMD Slurm is an open source and highly scalable cluster management and job scheduling system for large and small Linux clusters from SchedMD, Inc. SchedMD Slurm versions 21.08.x through 21.08.8 A security vulnerability exists in versions 20.11.x through 20.11.9, which stems from incorrect...

Shopware authorization issue vulnerabilities

Shopware is a suite of open source e-commerce software from the German company Shopware. There is a security vulnerability in Shopware, there is no information about the vulnerability at the moment, please stay tuned to CNNVD or the vendor's announcement...

Veeam Backup&Replication access control error vulnerability

Veeam Backup & Replication is a suite of data protection software from the Swiss company Veeam. The software provides backup, replication and recovery for VMware and Hyper-V VMs, physical and cloud environments. Veeam Backup&Replication is vulnerable to an Access Control Error vulnerability, no...

WordPress plugin: WooCommerce SQL injection vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blogging sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. SQL injection vulnerability exists in versions of...

TokTok c-toxcore buffer error vulnerability

c-toxcore is a peer-to-peer serverless instant messenger designed to make security and privacy easier for the average user. A buffer error vulnerability in TokTok c-toxcore, which stems from a stack-based buffer overflow in the handlerequest function in DHT.c caused by improperly calculating the...

WordPress cross-site scripting vulnerabilities

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on PHP and MySQL servers. A security vulnerability exists in WordPress Autoptimize plugin versions prior to 2.7.8, which allows an...

Moodle input validation vulnerability

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment. Moodle suffers from an input validation error vulnerability that stems from insufficient innocent handling of user-supplied data in th...

Apple’s various products have vulnerabilities related to access control.

Apple iOS, among others, are products of the American company Apple. Apple iOS is an operating system developed for mobile devices. Apple macOS is a specialized operating system designed for Mac computers. Apple iPadOS is an operating system for iPad tablets. Several of Apple’s products have...

Hermes Web UI Access Control Vulnerability

Hermes Web UI is a lightweight, dark-themed web interface developed by Nathan Esquenazi. Versions of Hermes Web UI prior to 0.51.358 contained an access control vulnerability. This vulnerability stemmed from improper access control measures, allowing unauthorized remote attackers to initial...

GitLab Enterprise Edition (EE) and GitLab Community Edition (CE) code-related vulnerabilities

GitLab Enterprise Edition EE and GitLab Community Edition CE are products of the American company GitLab. GitLab Enterprise Edition is a content management system. GitLab Community Edition is a community version of GitLab. There were code vulnerabilities in versions prior to 18.10 through 18.10.8...

SolidInvoice security vulnerabilities

SolidInvoice is an open-source invoice processing application developed by SolidInvoice. Versions of SolidInvoice prior to 2.3.17 contained a security vulnerability. This vulnerability stemmed from API tokens being stored in the apitokens database table in plain text, which could allow attackers...

Pipecat path traversal vulnerability

Pipecat is an open-source development framework developed by Pipecat that supports real-time audio and video stream processing as well as AI-powered dialogue interactions. Versions of Pipecat from 0.0.90 to 1.2.0 contained a path traversal vulnerability. This vulnerability stemmed from path...

NETGEAR Routers has a vulnerability related to input validation

NETGEAR Routers are a series of routers produced by NETGEAR, a company in the United States. NETGEAR Routers have a vulnerability related to input validation. This vulnerability stems from insufficient input validation, which may allow administrators who have passed authentication to make...

Microsoft Windows Push Notifications Information Leakage Vulnerability

Microsoft Windows Push Notifications is a push notification service provided by Microsoft Corporation. It provides a reliable way to deliver new updates. Microsoft Windows Push Notifications has information leakage vulnerabilities. The following products and versions are affected: Windows 10...

Microsoft Windows Ancillary Function Driver for WinSock: Race Condition Vulnerability

The Microsoft Windows Ancillary Function Driver for WinSock is a accessibility driver for Winsock developed by Microsoft Corporation. There are vulnerabilities related to race conditions in the Microsoft Windows Ancillary Function Driver for WinSock. Attackers can exploit these vulnerabilities to...

Apptha Slider Gallery path traversal vulnerability

Apptha Slider Gallery is a website image carousel and gallery display plugin provided by Apptha Corporation. Version 1.0 of Apptha Slider Gallery contains a path traversal vulnerability. This vulnerability stems from improper handling of the imgname parameter, which may allow unauthenticated...

Google Chrome Resource Management Error Vulnerability

Google Chrome is a web browser developed by the American company Google. Google Chrome has a resource management vulnerability that stems from the reusing of resources after they are released...

Moonshot AI Kimi AI Cross-site Scripting Vulnerability

Moonshot AI Kimi AI is an artificial intelligence assistant developed by the company Moonshot AI. It features long-text comprehension, multi-modal interaction, intelligent search capabilities, and agent functions. Version 1.0 of Moonshot AI Kimi AI contains a security vulnerability. This...

End-to-End Encryption App Security Vulnerabilities

End-to-End Encryption App is an open-source end-to-end encryption client implementation by Nextcloud. Vulnerabilities exist in versions of End-to-End Encryption App between 1.15.0 and 1.15.4, 1.16.0 and 1.16.3, 1.17.0 and 1.17.1, and 1.18.0 and 1.18.1. These vulnerabilities stem from improper...

Janet buffer error vulnerability

Janet is a functional and imperative programming language and bytecode interpreter developed by Janet Language. Versions of Janet prior to 1.41.0 have a buffer error vulnerability, which stems from incorrect operations in the doframe function found in the file src/core/debug.c. This vulnerability...

Portainer security vulnerabilities

Portainer is a lightweight user management interface developed by Portainer Foundation for managing Docker environments and Docker hosts. There were security vulnerabilities in versions of Portainer Community Edition from 2.33.0 to 2.33.8, as well as in versions prior to 2.39.2 and 2.41.0. These...

Music Player Daemon security vulnerability

Music Player Daemon is an open-source music playback daemon. Versions of Music Player Daemon prior to 0.24.11 contained a security vulnerability. This vulnerability stemmed from a server-side request forgeing issue in CurlInputPlugin. When the CURLOPTFOLLOWLOCATION option was set, the...

Traefik Access Control Vulnerability

Traefik is an open-source reverse proxy and load balancing tool developed by Traefik. Versions prior to Traefik 2.11.46, 3.6.17, and 3.7.1 contained a access control vulnerability. This vulnerability stemmed from the Kubernetes Gateway API provider, which allowed tenants with permission to create...

Open WebUI input validation error vulnerability

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted WebUI under open source. Prior to Open WebUI 0.9.3, there was a vulnerability related to input validation errors. This vulnerability stemmed from the image upload feature’s cross-site request forgeing mechanism, which could...