Microsoft Windows Update Stack Access Control Vulnerability

Microsoft Windows Update Stack is part of Microsoft Corporation USA for managing updates. An access control error vulnerability exists in Microsoft Windows Update Stack. An attacker could exploit this vulnerability to elevate privileges. The following products and versions are affected:Windows...

IPWorks SSH Security Vulnerability

IPWorks SSH is a library from nsoftware that integrates SSH Secure Shell security features, allowing developers to easily integrate SSH security into Internet applications. A security vulnerability exists in IPWorks SSH that stems from the possibility of being induced to issue unintended file...

Adobe Acrobat Reader resource management error vulnerability

Adobe Acrobat Reader is a PDF viewer from the American company Audobee Adobe. The software is used to print, sign and annotate PDFs. A resource management error vulnerability exists in Adobe Acrobat Reader versions 20.005.30574 and 24.002.20736, which stems from being affected by a...

WordPress plugin iPanorama 360 – WordPress Virtual Tour Builder has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Microsoft OLE DB Provider for SQL Server security vulnerabilities

Microsoft OLE DB Driver for SQL Server is a standalone data access application programming interface API for OLE DB. A remote code execution vulnerability exists in Microsoft OLE DB Driver for SQL Server, which can be exploited by an attacker to execute arbitrary code on the system...

Apache Zeppelin code injection vulnerability

Apache Zeppelin is a Web-based open source laptop application from the Apache USA Foundation. The program supports interactive data analysis and collaborative documentation. Apache Zeppelin suffers from a code injection vulnerability that stems from the application's failure to properly filter...

WordPress plugin Shareaholic security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Cisco Firepower Threat Defense Security Vulnerability

Cisco Firepower Threat Defense FTD is a suite of unified software from Cisco that provides next-generation firewall services. A security vulnerability exists in the Cisco Adaptive Security Appliance and Cisco Firepower Threat Defense that stems from a vulnerability in the Remote Access VPN featur...

QPDF Command Injection Vulnerability

QPDF is a software application. A C++ library and a set of programs to inspect and manipulate the structure of PDF files. A security vulnerability exists in all versions of QPDF, which stems from the inability of the encrypt method to filter parameters, resulting in a command injection...

GitPython path traversal vulnerability

GitPython is a Python library open-sourced by gitpython-developers for interacting with Git repositories. A path traversal vulnerability exists in GitPython 3.1.32 and earlier versions, which stems from the fact that in order to resolve some git references, GitPython reads the file .git from a...

Apache Airflow input validation vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An information disclosure vulnerability exists in Apache Airflow Spark Provider...

Microsoft Visual Studio Security Vulnerability

Microsoft Visual Studio is a family of development tool suites and a fundamentally complete set of development tools from Microsoft Corporation USA that includes most of the tools needed throughout the software lifecycle. A security vulnerability exists in Microsoft Visual Studio. An attacker cou...

Joomla! Input validation error vulnerability

Joomla! is a set of forum components used in the Joomla! content management system. A security vulnerability exists in Joomla! versions 4.2.0 through 4.3.1, which stems from a lack of input validation and can lead to open redirects and cross-site scripting XSS...

XPdf security vulnerabilities

Glyph & Cog Xpdf is an open source PDF file viewer from Glyph & Cog. A security vulnerability exists in Xpdf 4.04 and earlier versions, which stems from a loop of PDF objects embedded in the file tree that can lead to infinite recursion and a stack overflow...

VISAM VBASE Automation Base code issues and vulnerabilities

VISAM VBASE is a data acquisition and monitoring system from VISAM Germany. A security vulnerability exists in VISAM VBASE Automation Base versions prior to 11.7.5. An attacker who exploits this vulnerability could disclose sensitive information...

imgproxy Cross-Site Script Vulnerability

imgproxy is imgproxy individual developer's fast and secure standalone server for tweaking and converting remote mirrors. A cross-site scripting vulnerability exists in imgproxy versions prior to 3.14.0, which stems from the presence of reflected cross-site scripting XSS...

WordPress Plugin Rextheme WP VR – 360 Panorama and Virtual Tour: Vulnerability Due to Cross-Site Request Forgery

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. WordPress Plugin Rextheme ...

Microsoft Excel security vulnerabilities

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. A code execution vulnerability exists in Microsoft Excel, which can be exploited by an attacker to execute arbitrary code on a system...

WordPress Plugin Adapted for WooCommerce: Cross-Site Script Vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress Plugin Extensions for CF7: Cross-Site Request Forgery Vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

Concourse security vulnerabilities

Concourse is an automated system written in Go by Concourse Open Source. A security vulnerability exists in Concourse versions prior to 7.x.y through 7.8.3 and versions prior to 6.x.y through 6.7.9, which stems from the ability of its users to send a request with a request body...

F5 BIG-IP Command Injection Vulnerability

F5 BIG-IP is an application delivery platform that integrates network traffic management, application security management, load balancing, and other features from F5 USA. A security vulnerability exists in F5 BIG-IP. An attacker can bypass the restrictions of F5 BIG-IP via iControl REST to elevat...

Socket.IO SQL Injection Vulnerability

Socket.IO is a JavaScript library for real-time web applications from Socket.IO. A security vulnerability exists in Socket.IO that stems from incorrect type validation when an attachment parses the Socket.io js library...

Softmotions IOWOW buffer error vulnerability

Softmotions IOWOW is a C11 persistent key/value store based on a jump table data structure from Softmotions. A security vulnerability exists in Softmotions IOWOW version 1.4.15 and prior versions, which stems from a contained stack buffer overflow vulnerability. An attacker could exploit this...

Cisco Identity Services Engine cross-site scripting vulnerability

Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users, and devices to develop and implement policies to monitor the network. A cross-site scripting vulnerability exists in th...

Rocket.Chat SQL Injection Vulnerability

Rocket.Chat, an open source team chat software, is vulnerable to SQL injection, which stems from the application's lack of validation of externally entered SQL statements. An attacker could exploit the vulnerability to retrieve a reset password token via 2fa secret or 2fa secret...

Google TensorFlow security vulnerabilities

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google, Inc. in the United States. A security vulnerability exists in Google TensorFlow that stems from TensorListScatter and TensorListScatterV2 failing to give an assertion when they receive an elementsha...

OpenEMR cross-site scripting vulnerability

OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A cross-site scripting vulnerability exists in OpenEMR versions prior to 7.0.0.1,...

Jenkins CLIF Performance Testing Plugin has a path traversal vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A path traversal...

Rails cross-site scripting vulnerabilities

Rails is a set of Rails team based on the Ruby language open source web application framework. Rails suffers from a cross-site scripting vulnerability that stems from the program's lack of data validation filtering of user-supplied data and output. An attacker can exploit the vulnerability to...

HashiCorp go-getter command injection vulnerability

HashiCorp go-getter is a library for HashiCorp's Go golang for downloading files or directories from various sources using URLs as the primary form of input. A command injection vulnerability exists in HashiCorp go-getter version 2.0.2 and prior versions, which stems from the presence of a comman...

WordPress plugin Tatsu has a access control error vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A file upload vulnerability...

git-interface operating system command injection vulnerability

git-interface is an interface for using git repositories in node.js by the Russian individual developer Yarkeev Denis. A security vulnerability exists in yarkeev git-interface versions prior to 2.1.1, which stems from a lack of filtering of the git clone and git --upload-pack command line...

ZOHO ManageEngine ADSelfService Plus has vulnerabilities related to trust management.

ZOHO ManageEngine ADSelfService Plus is an integrated self-service password management and single sign-on solution for Active Directory and cloud applications from ZOHO, Inc. version 6122, a remote code execution vulnerability exists that can be exploited by remote and partially authenticated...

PKP Open Journals System Cross-site Scripting Vulnerabilities

PKP Open Journals System is a journal system. A security vulnerability exists in PKP Open Journals System versions prior to 3.3 to 2.4.8, which allows an attacker to inject arbitrary code via the X-Forwarded-Host header...

SAFARI Montage Cross-site Scripting Vulnerability

SAFARI Montage is a formative assessment tool from safarimontage that enables teachers to check students' understanding of topics or concepts during the course. A cross-site scripting vulnerability exists in SAFARI Montage versions 8.3 and 8.5, which can be exploited by an attacker to execute...

Microsoft Defender code injection vulnerability

Microsoft Defender for IoT is an asset discovery, vulnerability management, and threat monitoring solution for IoT/OT environments.Microsoft Defender for IoT suffers from a remote code execution vulnerability. An attacker could exploit this vulnerability to execute code on the target host...

Autodesk Navisworks buffer error vulnerability

Autodesk Navisworks is a 3D model review software for architecture, engineering and construction from Autodesk, Inc. Autodesk Navisworks is vulnerable to a buffer overflow vulnerability that could be exploited by attackers to execute arbitrary code...

Http4s Access Control Vulnerability

http4s is an open source streaming HTTP server for Scala. An access control error vulnerability exists in Http4s that stems from the default CORS configuration being vulnerable to source reflection attacks. The following products and versions are affected: 0.21.26 and earlier, 0.22.0 through...

ThroughTek Kalay Platform Access Control Vulnerability

throughtek ThroughTek Kalay Platform is an application from China IOT Intelligence Corporation throughtek Inc. The Kalay Cloud Platform service is enabled using P2P technology. An Access Control Error vulnerability exists in ThroughTek Kalay Platform that originates in the product network that...

Google TensorFlow security vulnerabilities

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A security vulnerability exists in Google TensorFlow, which could be exploited by an attacker to cause a denial of service in "boostedtreescreatequantilestream resource" using the negation parameter...

IBM Engineering Test Management Cross-site Scripting Vulnerability

IBM Engineering Test Management is a collaborative quality management solution that provides end-to-end test planning and test asset management, with broad coverage of all aspects from requirements to defects. A cross-site scripting vulnerability exists in IBM Engineering Test Management version...

Ubuntu Apport backend link vulnerability

Apport is a toolkit for collecting and giving feedback on error messages information that the operating system finds useful when an application crashes. A security vulnerability exists in Ubuntu Apport that stems from incorrect handling of certain information gathering operations, which can be...

Ubuntu Apport backend link vulnerability

Canonical Ubuntu is a GNU/Linux operating system from the British company Canonical that focuses on desktop applications. A security vulnerability exists in Ubuntu Apport that stems from the incorrect handling of certain information gathering operations, which can be exploited by an attacker who...

Envoy security vulnerabilities

Envoy is an open source distributed proxy server. Envoy suffers from a security vulnerability that can be exploited by attackers to cause a denial of service due to null references...

Microsoft Office code injection vulnerability

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. Commonly used components of this product include Word, Excel, Access, Powerpoint, FrontPage, and so on. A code injection vulnerability exists in Microsoft Office. The following products and edition...

Grav security vulnerabilities

Grav is a scalable CMS Content Management System for personal blogs, small content publishing platforms, and one-page product displays. A security vulnerability exists in Grav that stems from the fact that an unauthenticated user can execute some methods of the administrator controller without...

MongoDB Authorization Issues Vulnerability

MongoDB is a document-oriented database management system from the U.S.-based MongoDB, Inc. An authorization issue vulnerability exists in MongoDB that allows an unauthenticated client to trigger a denial of service by issuing a specially crafted wired protocol message, which could cause the...

IBM Security QRadar EDR security vulnerabilities

IBM Security QRadar EDR is a terminal detection and response software developed by the American multinational company IBM. There are security vulnerabilities in versions 3.12 to 3.12.24 of IBM Security QRadar EDR. These vulnerabilities stem from the storage of user credentials in plain text, whic...

CyberArk Idira Endpoint Privilege Manager Trust Management Vulnerability

CyberArk Idira Endpoint Privilege Manager is a terminal privilege management agent developed by the American company CyberArk. Versions of CyberArk Idira Endpoint Privilege Manager prior to version 26.5 contained vulnerabilities related to trust management. These vulnerabilities stemmed from...