SmartVista SVFE2 SQL injection vulnerability

SmartVista SVFE2 is a subsystem of SmartVista, Inc. A security vulnerability exists in SmartVista SVFE2 version v2.2.22, which originates via the UserForm:jid88, UserForm:jid90, and UserForm:jid92 parameters in /SVFE2/pages/feegroups/servicegroup.jsf contain multiple SQL injection vulnerabilities...

Intel Ethernet Controllers security vulnerabilities

Intel Ethernet Controllers is an Ethernet controller from Intel Corporation USA. A security vulnerability exists in IntelR E810 Ethernet Controllers versions prior to 1.6.2.9, which stems from incorrect access control. An attacker could exploit this vulnerability to perform a denial of service...

F5 BIG-IP injection vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. An elevation of privilege vulnerability exists in the F5 BIG-IP health check configuration, which can be exploited by an...

Foxit PDF Reader resource management error vulnerability

Foxit PDF Reader is a PDF reader from Foxit China.A remote code execution vulnerability exists in Foxit PDF Reader Annotation, which can be exploited by attackers to execute code in the context of the current process...

Delta Controls enteliTOUCH cross-site scripting vulnerability

Delta Controls enteliTOUCH is a touchscreen building controller from Delta Controls Canada. A security vulnerability exists in Delta Controls enteliTOUCH versions 3.40.3935, 3.40.3706, and 3.33.4005, which stems from a cross-site scripting vulnerability discovered via the Username parameter. The...

WordPress plugin with Amazon Link – Cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Amazon Link plugin 3.2.10 and earlier versions have a cross-site scripting vulnerability th...

Microweber security vulnerabilities

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A security vulnerability exists in Microweber versions prior to 1.2.15 that stems from a...

Sqlite3 security vulnerabilities

Sqlite is a lightweight database and ACID-compliant relational database management system. A security vulnerability exists in Sqlite3 versions prior to 5.0.3, which can be exploited by attackers to cause a denial of service DoS attack...

Pimcore SQL injection vulnerability

Pimcore is an open source Web content management platform for creating and managing Web applications from the Austrian company Pimcore. The platform integrates Web content management, e-commerce frameworks and product information management applications.A SQL injection vulnerability exists in...

WordPress plugin security vulnerabilities

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on PHP and MySQL servers. WordPress WPS Hide Login plugin has an authorization issue vulnerability in versions prior to 1.9.1, which ste...

Rails encryption issue vulnerabilities

Rails is a set of open source web application frameworks based on the Ruby language from the Rails team. A cryptographic issue vulnerability exists in Rails multisite, where an attacker may be able to reuse cookies on different sites in multiple Rails applications...

WordPress plugin cross-site scripting vulnerability

WordPress plugin is a WordPress open source application plugin . A cross-site scripting vulnerability exists in WordPress PDF Flipbook, 3D Flipbook, DearFlip plugin versions prior to 1.7.10, which stems from not bypassing the class attribute of its shortcode before outputting back to the attribut...

Intel HAXM resource management error vulnerability

Intel HAXM Intel Hardware Accelerated Execution Manager is a cross-platform hardware-assisted virtualization engine hypervisor from Intel Corporation that is widely used as a gas pedal for Android Emulator and QEMU. Intel HAXM suffers from a resource management error vulnerability, which arises...

PHPMailer code issue vulnerabilities

PHPMailer is a PHP class library for sending e-mail. A security vulnerability exists in PHPMailer that originates from untrusted data in a path with a UNC pathname, which can be exploited by an attacker to remotely execute code...

Greensock Gsap Security Vulnerability

Greensock Gsap is a Javascript-based toolkit from the Greensock team for quickly creating animated effects in the browser. A security vulnerability exists in gsap before 3.6.0, no information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor's announceme...

Terramaster TOS Security Vulnerability

Terramaster TOS is a Linux-based operating system from Shenzhen, China-based Tumi Electronic Technology Terramaster dedicated to the erraMaster Cloud Storage NAS server. A security vulnerability exists in TerraMaster TOS version 4.2.06 and earlier versions, which can be exploited by an attacker t...

PostgreSQL Anonymizer SQL Injection Vulnerability

PostgreSQL Anonymizer is an open-source extension developed by DALIBO in France, designed to mask or replace personally identifiable information PII or commercially sensitive data in PostgreSQL databases. PostgreSQL Anonymizer has a SQL injection vulnerability. This vulnerability arises from...

Summary of code issues and vulnerabilities

Summarize is a multi-source rapid summarization tool developed by Peter Steinberger. Versions of Summarize prior to 0.17.0 contained code vulnerabilities. These vulnerabilities were caused by server-side request forgeing attacks. Attackers could exploit these vulnerabilities by providing maliciou...

Summary: Security vulnerabilities

Summarize is a multi-source rapid summarization tool developed by Peter Steinberger. Versions of Summarize prior to 0.17.0 contain security vulnerabilities. These vulnerabilities stem from resource exhaustion. A remote attacker can exploit these vulnerabilities by bypassing the mandatory size lim...

Google Chrome: Input validation error vulnerability

Google Chrome is a cross-platform web browser developed by Google, primarily used for accessing internet content. Google Chrome has a vulnerability related to input validation. This vulnerability stems from the Accessibility module’s failure to properly validate untrusted inputs. Attackers can...

IBM Langflow security vulnerabilities

IBM Langflow is a visual process orchestration tool developed by the American multinational company International Business Machines IBM. Versions 1.0.0 to 1.9.1 of IBM Langflow contain security vulnerabilities. These vulnerabilities stem from insecure direct object references, which could allow...

S2OPC OPC UA Toolkit Trust Management Vulnerability

S2OPC OPC UA Toolkit is an open-source development toolkit for OPC UA communication, developed by Systerel. The S2OPC OPC UA Toolkit has a trust management vulnerability, which stems from improper comparison with a list of trusted certificates. This vulnerability may cause well-formatted, untrust...

VMware Spring Data MongoDB security vulnerabilities

VMware Spring Data MongoDB is a MongoDB data access framework developed by the American company VMware. There are security vulnerabilities in VMware Spring Data MongoDB versions 5.0.0 and earlier, as well as versions 4.5.0 and earlier, 4.4.0 and earlier, 4.3.0 and earlier, 4.2.0 and earlier, 4.1....

Splunk SOAR security vulnerabilities

Splunk SOAR is a security orchestration, automation, and response platform provided by Splunk Inc. Versions of Splunk SOAR prior to 8.5.0 contained a security vulnerability. This vulnerability stemmed from SOAR failing to strip control characters from the HTTP request path before writing...

Microsoft BitLocker authorization issue vulnerability

Microsoft Windows BitLocker is a security feature provided by Microsoft that ensures the recovery key is backed up and secure before it is activated. There is an access control vulnerability in Microsoft Windows BitLocker. Attackers can exploit this vulnerability to bypass certain features. The...

Linux Kernel Security Vulnerabilities

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel. This vulnerability stems from the tcfctflowtableget function in actct, which releases the RCU read lock within the...

WordPress plugin “Product Filter Widget” for Elementor: Cross-site scripting vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be added to a...

Microsoft Windows DHCP Server input validation error vulnerability

Microsoft Windows DHCP Server is a core service of the American company Microsoft, used for automatically retrieving network configuration information. There are security vulnerabilities in Microsoft Windows DHCP Server. The following products and versions are affected: Windows 10 Version 22H2 fo...

Acer Wave 7 router security vulnerability

The Acer Wave 7 router is a three-band wireless router from Acer, a company based in Taiwan, China. The Acer Wave 7 router has a security vulnerability. This vulnerability allows attackers to decrypt, modify, and re-encrypt system backups, enabling persistent backdoors attacks...

Avro resource management error vulnerability

Avro is a fast Go Avro decoder developed by hamba. Versions prior to 2.33.0 contained a resource management vulnerability. This vulnerability stemmed from the Avro array and mapping decoders’ tendency to loop through a counter controlled by the attacker without checking the error status of the...

Linux Kernel Security Vulnerabilities

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the AppArmor module failing to handle cases where sock and sock-sk might be NULL during socket...

Collectric CMU SQL injection vulnerability

The Collectric CMU is a smart meter device from Collectric in the Netherlands that supports power metering with supporting communication extensions. A SQL injection vulnerability exists in Collectric CMU version 1.0, which stems from the presence of Boolean-based blind SQL injection in the lang...

Grav security vulnerabilities

Grav is a scalable content management system CMS developed by the Grav open-source community, suitable for use in personal blogs, small content publishing platforms, and single-page product displays. Versions of Grav prior to 2.0.0-beta.2 contained security vulnerabilities. These vulnerabilities...

Wireshark resource management error vulnerability

Wireshark is a set of network packet analysis tools developed by the Wireshark team. The software’s function is to capture network packets and display detailed data for analysis. Versions of Wireshark from 4.6.0 to 4.6.4 contained a resource management vulnerability, which was caused by a crash i...

D-Link’s various products have security vulnerabilities

D-Link DNS-327L is a product of the Chinese company D-Link. The D-Link DNS-327L is a NAS Network Attached Storage device. The D-Link DNS-340L is also a NAS device. The D-Link DNS-120 is a network storage adapter. Several D-Link products have security vulnerabilities, which stem from incorrect...

STB security vulnerabilities

STB is a publicly available library for C/C++ developed by Sean Barrett. Versions of STB prior to 2.30 contained security vulnerabilities, which stemmed from incorrect operations on the stbigifloadnext function in the stbimage.h file, potentially leading to heap buffer overflows...

OpenSC security vulnerabilities

OpenSC is an open-source smart card tool and middleware developed by OpenSC. Versions of OpenSC prior to 0.27.0 contained security vulnerabilities. These vulnerabilities were caused by stack buffer overflow attacks within the card-oberthur component, which could lead to the execution of arbitrary...

Nginx UI security vulnerabilities

Nginx UI is a web interface for Nginx developed by Jacky. Versions of Nginx UI 2.3.5 and earlier contained security vulnerabilities. These vulnerabilities stemmed from the MCP integration, where the /mcmessage endpoint only applied an IP white list, and the default white list was empty. This...

WVP-GB28181-pro code issue and vulnerabilities

WVP-GB28181-Pro is a video monitoring platform developed by individual developer 648540858. Versions of WVP-GB28181-Pro 2.7.4 and earlier have code vulnerabilities. These vulnerabilities stem from a deserialization issue in the function GenericFastJsonRedisSerializer within the component API...

WordPress plugin KiviCare has a security vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

Cisco IOS XR Permission Authorization and Access Control Vulnerabilities

Cisco IOS XR is an operating system developed by the American company Cisco for its network devices. Cisco IOS XR has vulnerabilities related to permission licensing and access control. These vulnerabilities stem from errors in the mapping of commands to task groups in the source code, which can...

OpenClaw security vulnerabilities

OpenClaw is an open source framework for data acquisition. A denial of service vulnerability exists in OpenClaw. An attacker can exploit this vulnerability by triggering a memory exhaustion via an oversized response with no content-length, resulting in service unavailability...

hex_core security vulnerability

hexcore is a hexadecimal implementation library developed by Hex Open Source. Vulnerabilities exist in versions of hexcore prior to 0.12.1, hex prior to 2.3.2, and rebar3 prior to 3.27.0. These vulnerabilities stem from uncontrolled resource consumption and insecure data deserialization, which ma...

libvips security vulnerabilities

libvips is an open-source fast image processing library with low memory requirements. Versions of libvips 8.19.0 and earlier contain security vulnerabilities, which stem from a heap buffer overflow vulnerability in the vipssourcereadtomemory function...

SAIL security vulnerabilities

SAIL is an open-source image decoding library developed by SAIL. SAIL has a security vulnerability that stems from the XWD parser’s use of the bytesperline value. This value is read directly from the file and used as the reading size, but it is not compared with the actual size of the target...

Rongzhitong Visual Integrated Command and Dispatch Platform Access Control Vulnerability

Rongzhitong Visual Integrated Command and Dispatch Platform is an integrated command system for emergency management and public safety developed by Rongzhitong Corporation. The Rongzhitong Visual Integrated Command and Dispatch Platform versions 20260206 and earlier contained a access control...

WordPress plugin EmailKit – Email Customizer for WooCommerce & WordPress

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be added to a...

Huawei EMUI and Huawei HarmonyOS security vulnerabilities

Huawei EMUI is a mobile operating system developed based on Android.Huawei HarmonyOS is an operating system. Provides a full-scene distributed operating system based on a microkernel. An address reading vulnerability exists in the Huawei EMUI and Huawei HarmonyOS communication module, which can b...

nTools Office Reader - PDF, Word, Excel security vulnerabilities

nTools Office Reader – PDF, Word, Excel is a document reading application developed by nTools Corporation. The version 4.5.7 of nTools Office Reader – PDF, Word, Excel contains a security vulnerability. This vulnerability stems from path traversal vulnerabilities, which may lead to...

jsPDF security vulnerability

jsPDF is a JavaScript-based PDF document generation library developed by Parallax. Versions of jsPDF prior to 4.1.0 contained security vulnerabilities. These vulnerabilities stemmed from the properties and methods of the Acroform module, which allowed users to inject arbitrary PDF objects, such a...