Laminas Project: Environmental Issues and Vulnerabilities

Laminas Project diactoros is a PSR HTTP message implementation of Laminas Project. An environment issue vulnerability exists in Laminas Project diactoros, which can be exploited by an attacker to add a new header to laminas-dictoros via Security/x Forwarded Header...

Wire cross-site scripting vulnerabilities

Wire is a chat software from the German company Wire. The software supports Web, WindowsiOS, Android, and OS X platforms, has group functionality, can make voice calls, send photos, and its original greeting method, PING. Wire has a cross-site scripting vulnerability that stems from insufficient...

SAP NetWeaver Application Server security vulnerabilities

SAP NetWeaver Application Server is an application server from SAP, Germany. A security vulnerability exists in SAP NetWeaver Application Server ABAP, Application Server Java, ABAP Platform, HANA Database from SAP startservice. An attacker exploited the vulnerability to escalate privileges, which...

Dell BSAFE Micro Edition Suite buffer error vulnerability

Dell BSAFE Micro Edition Suite is a development kit that provides encryption, certificate, and transport layer security for c/c applications, devices, and systems.Dell BSAFE Micro Edition Suite is vulnerable to a buffer overflow vulnerability that could be exploited by remote attackers to submit ...

flask-session-captcha code issue vulnerability

flask-session-captcha is a captcha implementation of flask by the individual developer Joakim Uddholm in Germany. A security vulnerability exists in versions of flask-session-captcha prior to 1.2.1, which stems from the fact that the captcha.validate function returns None if no value is passed, a...

Mattermost security vulnerabilities

Mattermost is an open source collaboration platform from Mattermost, Inc. An authorization issue vulnerability exists in Mattermost 6.4.1 and earlier versions, which stems from an API that fails to properly protect permissions and can be exploited by an authenticated attacker to bypass restrictio...

Elementor security vulnerability

Elementor is a website builder from Israeli company Elementor that allows WordPress users to create and edit websites. There is a security vulnerability in Elementor versions 3.6.0 to 3.6.2. There is no information about the vulnerability at this time, so please stay tuned to CNNVD or the vendor'...

Jenkins Dashboard View Plugin: Cross-site Scripting Vulnerabilities

Jenkins and Jenkins Plugin are both products of Jenkins, an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. Jenkins Dashboard View Plugin version 2.18 and earlier is vulnerable to a cross-site scripting...

Google Android Buffer Overflow Vulnerability

Google Android is a Linux-based open source operating system from Google, Inc. A buffer overflow vulnerability exists in Google Android due to an out-of-bounds read in cdParseMsg of cdcodec.c caused by a boundary check error, which could be exploited to cause remote information disclosure...

Mezzanine cross-site scripting vulnerabilities

Github Mezzanine, a content management platform, is vulnerable to a cross-site scripting vulnerability that originates from a cross-site scripting XSS vulnerability in Mezzanine v4.3.1. The vulnerability can be exploited to execute arbitrary code via the "Description" field of...

Parse Server authorization issue vulnerability

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. An authorization issue vulnerability exists in versions of Parse Server prior to 4.5.1 that stems from the server incorrectly creating a session when an anonymous user registers with REST for t...

Quassel security vulnerabilities

Quassel Quassel IRC is a graphical, distributed, cross-platform IRC client. A security vulnerability exists in Quassel 0.13.1, which stems from launching without SSL or TLS support when --require-ssl is enabled, if an available X.509 certificate cannot be found on the local system...

ThroughTek P2P SDK information leakage vulnerability

ThroughTek P2P SDK is a software application from Throughtek for video surveillance products and large "audio/video" file transfers. An information disclosure vulnerability exists in the ThroughTek P2P SDK. The vulnerability can be exploited by an attacker to access sensitive information...

Epic Games Rocket League buffer error vulnerability

Epic Games Rocket League is an application software from Epic Games, Inc. a game software. A buffer error vulnerability exists in Epic Games/Psyonix Rocket League version 1.95 and earlier, which stems from a stack-based buffer overflow that occurs when Rocket League processes UPK object files,...

Sensorweb ScadaBR code-related vulnerabilities

Sensorweb ScadaBR is a suite of open source software for developing automated data acquisition and monitoring applications from Sensorweb, Inc. A code issue vulnerability exists in ScadaBR 1.0 / 1.1CE. The vulnerability stems from a lack of effective privilege licensing and access control measure...

Envoy input validation vulnerability

Envoy is an open source distributed proxy server. versions prior to Envoy 1.71.1 are vulnerable to integer overflow, which can be exploited by an attacker with an excessive grpc-timeout value to cause an unexpected timeout calculation...

CyberArk Idira Endpoint Privilege Manager security vulnerability

CyberArk Idira Endpoint Privilege Manager is a terminal privilege management agent developed by the American company CyberArk. Vulnerabilities existed in versions of CyberArk Idira Endpoint Privilege Manager prior to version 26.5. These vulnerabilities stemmed from improper access control in the...

Axios resource management error vulnerability

Axios is an open-source HTTP client developed by Axios, based on Promise a solution for asynchronous programming. Versions of Axios prior to 0.32.0 and 1.16.0 have a resource management vulnerability. This vulnerability arises from failing to escape regular expression characters when constructing...

Thai Palliative SQL Injection Vulnerability

Thai Palliative is a modified version of the PHP framework developed by DAMASAC KKU. Versions of Thai Palliative 3.0 and earlier have a SQL injection vulnerability. This vulnerability arises from the lack of cleaning or parameterization of the idFormMain parameter and the id parameter, which may...

QNAP file station buffer error vulnerability

QNAP Systems File Station 5 is a file management system developed by QNAP Systems, a company based in Taiwan, China. QNAP Systems File Station 5 has a security vulnerability that stems from a buffer overflow issue. This vulnerability could allow remote attackers to modify memory after obtaining...

WordPress CleanTalk Anti Cross-Site Script Vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

Lenovo Android Application security vulnerabilities

Lenovo Android Application is an application developed by Lenovo Corporation, designed for managing Lenovo devices. There is a security vulnerability in Lenovo Android Application, which stems from websites accessed via the built-in browser potentially overwriting system clipboard contents...

Roxy-WI input validation vulnerability

Roxy-WI is an open-source web interface designed for managing Haproxy, Nginx, and Keepalived servers. Versions of Roxy-WI 8.2.6.4 and earlier contain a vulnerability related to input validation errors. This vulnerability arises from the next URL validation in the login process not considering the...

Palo Alto Networks PAN-OS cross-site scripting vulnerability

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks for its firewall devices. Palo Alto Networks PAN-OS has a cross-site scripting vulnerability. This vulnerability stems from cross-site scripting, and it could allow malicious authenticated administrators to use the w...

AMD uProf security vulnerability

AMD uProf is a cross-platform performance analysis tool developed by AMD, a company specializing in semiconductors. AMD uProf has a security vulnerability that stems from improper access control. This vulnerability could allow local attackers with user privileges to write to the kernel’s shared...

Microsoft Windows Storage Permission and Access Control Vulnerabilities

Microsoft Windows Storage is a data storage solution provided by the American company Microsoft. There are code-related vulnerabilities in Microsoft Windows Storage. Attackers can exploit these vulnerabilities to gain elevated privileges. The following products and versions are affected: Windows ...

Hermes Web UI security vulnerabilities

Hermes Web UI is a lightweight, dark-themed web interface developed by Nathan Esquenazi. Versions of Hermes Web UI prior to 0.51.303 contained security vulnerabilities, which were caused by a TOCTOU race condition in the gitdiscard function. This vulnerability could allow attackers to delete file...

SecureAge CatchPulse access control vulnerability

SecureAge CatchPulse is a terminal security protection platform developed by SecureAge in Singapore, based on artificial intelligence and application white-list technology. Versions of SecureAge CatchPulse 10.9.1 and earlier contain an access control vulnerability. This vulnerability stems from...

Cpanel::JSON::XS security vulnerability

Cpanel::JSON::XS is a tool developed by RURBAN personal developers that converts Perl data structures into JSON format. Versions of Cpanel::JSON::XS prior to version 4.41 contained security vulnerabilities. These vulnerabilities stemmed from exceptions thrown during the decoding filter callback,...

Google Chrome Resource Management Error Vulnerability

Google Chrome is a web browser developed by Google Inc. Versions of Google Chrome prior to 149.0.7827.53 contained a resource management vulnerability. This vulnerability stemmed from the reuse of GFX components after their release, which could allow remote attackers to exploit heap corruption...

GPAC security vulnerabilities

GPAC is an open-source multimedia framework developed by GPAC. Versions of GPAC prior to 26.02.0 contained security vulnerabilities; these vulnerabilities stemmed from the use of the dasherprocess function, which allowed reusing of memory after heap deallocation, potentially leading to...

BentoML code injection vulnerability

BentoML is an open-source model service library developed by BentoML. It is used to build high-performance and scalable artificial intelligence applications using Python. Prior to BentoML 1.4.39, there was a code injection vulnerability. This vulnerability stemmed from the envs.name value...

Pear Archive_Tar security vulnerability

Pear ArchiveTar is a PHP-based software developed by the PEAR team that allows for creating and extracting tar packages. Prior to version 3.08, Pear ArchiveTar had a security vulnerability. This vulnerability stemmed from the makespecialfile function, which passed the linkname of the tar header t...

view_component security vulnerability

viewcomponent is an open-source framework developed by ViewComponent, designed for building reusable and testable view components. There are security vulnerabilities in the viewcomponent version 3.0.0 to 4.9.0. These vulnerabilities arise from the system’s testing entry point using File.realpath ...

TOTOLINK A8000RU: Operating System Command Injection Vulnerability

The TOTOLINK A8000RU is a wireless router from China's Gion Electronics TOTOLINK. The Totolink A8000RU version 7.1cu.643b20200521 suffers from an OS command injection vulnerability that originates from the function setParentalRules in the Web Management Interface component file /cgi-bin/cstecgi.c...

Sunshine Trust Management Vulnerability

Sunshine is an Open Source Moonlight-based autonomous gaming streaming host developed by LizardByte. Earlier versions of Sunshine, such as 2026.516.143833, had vulnerabilities related to trust management. These vulnerabilities stemmed from improper handling of OpenSSL verification results. Custom...

PostgreSQL security vulnerabilities

PostgreSQL is a set of free object-relational database management systems developed by the PostgreSQL organization. This system supports most SQL standards and offers many other features, such as foreign keys, triggers, views, etc. Security vulnerabilities existed in versions prior to PostgreSQL...

SQUIRREL buffer error vulnerability

SQUIRREL is a programming language developed by Alberto Demichelis. It is the stable version of SQUIRREL 3.2. Versions of SQUIRREL 3.2 and earlier had a buffer error vulnerability, which stemmed from a stack buffer overflow in the validateformat function within the sqstdlib/sqstdstring.cpp librar...

Linux Kernel Security Vulnerabilities

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the use of devm in SDCA for handling IRQs. This can lead to the persistence of IRQs after the sou...

rust-openssl buffer error vulnerability

rust-openssl is an open-source library in the rust ecosystem that allows for interaction with the OpenSSL library. In versions 0.9.0 to 0.10.78 of rust-openssl, there was a buffer error vulnerability. This vulnerability stemmed from the frompemcallback API not verifying the length returned by use...

CyberPanel cross-site scripting vulnerabilities

CyberPanel is a virtual hosting control panel developed by Usman Nasir, which includes DNS and email servers. Versions of CyberPanel prior to 2.4.4 had a cross-site scripting vulnerability. This vulnerability originated from a storage-based cross-site scripting vulnerability in the AI Scanner...

NVIDIA KAI Scheduler security vulnerability

NVIDIA KAI Scheduler is an AI-based computing task scheduling system developed by NVIDIA Corporation. There is a security vulnerability in NVIDIA KAI Scheduler, which stems from cross-namespace Pod references leading to improper authorization, potentially resulting in data tampering...

dify security vulnerabilities

dify is an open-source LLM application development platform developed by LangGenius. Versions of dify prior to 1.13.3 have security vulnerabilities. These vulnerabilities stem from improper handling of parameters in the parseopenaipluginjsontotoolbundle function of the ApiBasedToolSchemaParser...

Amazon Athena ODBC driver security vulnerability

The Amazon Athena ODBC driver is a database connection driver developed by the American company Amazon. Versions of the Amazon Athena ODBC driver prior to 2.1.0.0 contained security vulnerabilities. These vulnerabilities stemmed from insufficient security controls in the browser-based...

iccDEV code-related vulnerabilities

iccDEV is an open-source color configuration code library developed by the International Color Consortium. Versions of iccDEV prior to 2.3.1.6 contained code-related vulnerabilities. These vulnerabilities stemmed from specially crafted ICC configuration files that could trigger calls to null...

OpenWrt LuCI Cross-Site Script Vulnerability

OpenWrt LuCI is a graphical configuration interface for OpenWRT, an open-source operating system. Versions of OpenWrt LuCI prior to 24.10.5 and 25.12.0 had a cross-site scripting vulnerability. This vulnerability stemmed from a storage-based cross-site scripting issue in the wireless scanning...

Thermalright TR-VISION HOME security vulnerabilities

Thermalright TR-VISION HOME is a hardware monitoring and display software developed by Thermalright Corporation. Versions of Thermalright TR-VISION HOME 2.0.5 and earlier contained security vulnerabilities. These vulnerabilities were caused by DLL loading order hijacking, which could allow local...

TypiCMS cross-site scripting vulnerabilities

TypiCMS is an open-source content management system developed by TypiCMS. Versions of TypiCMS prior to 16.1.7 had a cross-site scripting vulnerability. This vulnerability stemmed from the file upload module not clearing the content of SVG files, which could lead to storage-based cross-site...

SourceCodester Modern Image Gallery App Code Injection Vulnerability

SourceCodester Modern Image Gallery App is an open-source modern image gallery application developed by SourceCodester. Version 1.0 of the SourceCodester Modern Image Gallery App contains a code injection vulnerability, which stems from incorrect handling of the parameter filename in the upload.p...

Arduino App Lab: Operating System Command Injection Vulnerability

Arduino App Lab is an integrated development environment for developing Arduino applications, based on the open-source Arduino framework. Versions of Arduino App Lab prior to 0.4.0 contained a vulnerability related to operating system command injection. This vulnerability stemmed from insufficien...