Socket.IO SQL注入漏洞

Socket.IO is a JavaScript library for real-time web applications from Socket.IO. A security vulnerability exists in Socket.IO that stems from incorrect type validation when an attachment parses the Socket.io js library...

Keystone 授权问题漏洞

Keystone is a powerful CMS designed to help you build and scale faster than any other Cms or application framework. An authorization issue vulnerability exists in versions of Keystone prior to 2.3.1, which stems from the fact that users who use field-level access controls are vulnerable to not...

Cisco Identity Services Engine 跨站脚本漏洞

Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users, and devices to develop and implement policies to monitor the network. A cross-site scripting vulnerability exists in th...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel. An attacker exploiting this vulnerability could cause a memory leak...

Istio 资源管理错误漏洞

Istio is a set of open platforms for connecting, managing, and securing microservices. Istio suffers from a resource management error vulnerability that stems from susceptibility to request handling errors, which can be exploited by an attacker to send specially crafted or oversized messages that...

lighttpd 安全漏洞

lighttpd is an open source web server developed by Jan Kneschke in Germany. A security vulnerability exists in lighttpd that originates from a denial-of-service attack that can be triggered via CLOSEWAIT / CONSTATEREADPOST...

NLnet Labs Routinator 安全漏洞

NLnet Labs Routinator is an RPKI Resource Public Key Infrastructure validator from NLnet Labs in the Netherlands written in the Rust language. A security vulnerability exists in NLnet Labs Routinator versions 0.9.0 through 0.11.2, which stems from an error in error handling, where data in RRDP...

Pagekit 跨站脚本漏洞

Pagekit is a modular, lightweight CMS Content Management System. A security vulnerability exists in Pagekit CMS v1.0.18. An attacker can exploit this vulnerability to execute arbitrary web script or HTML by injecting a specially crafted payload into the Markdown text box under /blog/post/edit...

SQUIRREL 缓冲区错误漏洞

SQUIRREL is a stable version of the programming language SQUIRREL 3.2. A buffer error vulnerability exists in SQUIRREL 2.2.5 and earlier and 3.1 and earlier 3.x. The vulnerability stems from sqclass.cpp allowing out-of-bounds reads in the kernel interpreter, which can lead to code execution that,...

Honeywell Saia Burgess PG5 PCD 授权问题漏洞

Honeywell Saia Burgess PG5 PCD is a Honeywell USA solution that includes SBC Instrumentation, Control and Automation ICA devices for implementation and operational automation. A security vulnerability exists in all versions of the Honeywell Saia Burgess PG5 PCD, which stems from the use of the...

Adobe InCopy 安全漏洞

Adobe Incopy 2021 is a powerful document article editing software. A heap overflow vulnerability exists in Adobe InCopy Font parsing, which can be exploited by a remote attacker to submit a special file request and trick the user into parsing it, which can crash the application or execute arbitra...

git-clone 参数注入漏洞

git-clone is a repository for cloning git repositories developed by Jason Frame in the UK. A parameter injection vulnerability exists in git-clone, which stems from an unsafe use of git's --upload-pack feature, which makes all versions of the package git-clone vulnerable to command injection...

Jenkins Plugin RocketChat Notifier 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.An information disclosure vulnerability...

WordPress plugin Google Maps 跨站请求伪造漏洞

WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin Google Maps 1.2.1 and previous versions have a cross-site request forgery vulnerability, which can be exploited by attacke...

Xen 安全漏洞

Xen is an open source virtual machine monitor product from the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. A security vulnerability exists in all...

Google Android 缓冲区错误漏洞

Google Android is a Linux-based open source operating system from Google, Inc. An out-of-bounds read vulnerability exists in Google Android, which originates in hmeaddnewnodetoasortedarray in hmeutils.c, due to a heap buffer Overflow, an out-of-bounds read may exist, and an attacker could exploit...

elitecms SQL注入漏洞

Elitecms is a web content management from elitecms India. elitecms version 1.01 is vulnerable to SQL injection, which originates from admin/editsidebar.php?page=2 & sidebar The page sidebar parameter lacks validation for external input SQL statements, and an attacker could exploit the vulnerabili...

Delta Controls enteliTOUCH 跨站脚本漏洞

Delta Controls enteliTOUCH is a touchscreen building controller from Delta Controls Canada. A security vulnerability exists in Delta Controls enteliTOUCH versions 3.40.3935, 3.40.3706, and 3.33.4005, which stems from a cross-site scripting vulnerability discovered via the Username parameter. The...

Avast Antivirus和AVG Antivirus 资源管理错误漏洞

Avast Antivirus is a suite of antivirus software from the Czech company Avast. A vulnerability exists in Avast Antivirus prior to version 22.1 and AVG Antivirus prior to version 22.1 due to a security restriction not being properly applied by the application in the "Anti Rootkit" driver in...

ZoneMinder 路径遍历漏洞

ZoneMinder is an open source video surveillance software system. The system supports IP, USB and analog cameras, etc. A remote code execution vulnerability exists in versions prior to ZoneMinder 1.36.13, which can be exploited by attackers to cause arbitrary code execution...

VMware Cloud Director 输入验证错误漏洞

VMware Cloud Director is a cloud service delivery platform from VMware. The platform supports virtual datacenter creation, multi-site management, datacenter scaling and cloud migration, and cloud-native application development. A security vulnerability exists in VMware Cloud Director that...

WordPress和WordPress plugin 跨站脚本漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. WordPress SpiderCalendar plugin is vulnerable to a cross-site scripting vulnerability that stems from the...

SAFARI Montage 跨站脚本漏洞

SAFARI Montage is a formative assessment tool from safarimontage that enables teachers to check students' understanding of topics or concepts during the course. A cross-site scripting vulnerability exists in SAFARI Montage versions 8.3 and 8.5, which can be exploited by an attacker to execute...

Rust actix-web crate 缓冲区错误漏洞

Rust actix-web crate is a Rust web framework. security vulnerability exists in Mozilla Rust actix-web crate versions prior to 0.7.15, which can be exploited by attackers to cause memory corruption...

Autodesk Navisworks 缓冲区错误漏洞

Autodesk Navisworks is a 3D model review software for architecture, engineering and construction from Autodesk, Inc. Autodesk Navisworks is vulnerable to a buffer overflow vulnerability that could be exploited by attackers to execute arbitrary code...

WordPress 插件 访问控制错误漏洞

WordPress Plugin is an open source application plugin for WordPress. A security vulnerability exists in the WordPress plugin PostX, which stems from Gutenberg Blocks in the Post Grid WordPress plugin prior to PostX - version 2.4.10 allows any logged in user to perform error checking before...

Http4s访问控制错误漏洞

http4s is an open source streaming HTTP server for Scala. An access control error vulnerability exists in Http4s that stems from the default CORS configuration being vulnerable to source reflection attacks. The following products and versions are affected: 0.21.26 and earlier, 0.22.0 through...

Solarwinds Orion Platform SQL注入漏洞

SolarWinds Orion Platform is a network fault and network performance management platform from SolarWinds, Inc. The platform provides real-time monitoring and profiling of network devices and supports custom web interfaces, multiple user opinions, and map-based browsing of the entire network. The...

PowerISO 缓冲区错误漏洞

PowerISO is a powerful CD/DVD/BD image file processing tool from PowerISO that can open, extract, burn, create, edit, compress, encrypt, split and convert ISO files, and mount ISO files using internal virtual drives. PowerISO suffers from a buffer overflow vulnerability that originates from a...

Pivotal Software RabbitMQ 跨站脚本漏洞

RabbitMQ is a multi-protocol message broker. A cross-site scripting vulnerability exists in RabbitMQ versions prior to RabbitMQ 3.8.18 for rabbitmq-server. The vulnerability stems from the program not properly filtering the tag. An attacker can exploit this vulnerability to execute JavaScript cod...

Quassel 安全漏洞

Quassel Quassel IRC is a graphical, distributed, cross-platform IRC client. A security vulnerability exists in Quassel 0.13.1, which stems from launching without SSL or TLS support when --require-ssl is enabled, if an available X.509 certificate cannot be found on the local system...

CLICK PLC CPU Modules 安全漏洞

CLICK PLC CPU Modules are Automation Direct's network devices A single CLICK CPU Module can be connected to up to eight I/O modules to expand the amount of system I/O and meet the needs of a specific application. Automation Direct CLICK PLC CPU Modules have a security vulnerability that allows an...

TianoCore EDK2 加密问题漏洞

EDK2 is a set of cross-platform firmware development environments from the TianoCore Tianocore community based on the UEFI and PI specifications. EDK2 suffers from a cryptographic issue vulnerability that stems from a potential security risk in the example EDK2 encrypted private key in IpSecDxe.e...

McAfee Agent代码问题漏洞

The McAfee McAfee Agent MA is a set of client components from McAfee, Inc. that provides secure communications between ePolicy Orchestrator the antivirus management platform and managed products. A security vulnerability exists in McAfee Agent in versions prior to 5.7.3. The vulnerability stems...

Ubuntu Apport 后置链接漏洞

Apport is a toolkit for collecting and feeding back error messages information that the operating system finds useful when an application crashes. A security vulnerability exists in Ubuntu Apport that stems from Apport incorrectly handling certain information-gathering operations, which can be...

Wordpress插件 代码问题漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. A security vulnerability exists in a number o...

geojsonkml Command Injection Vulnerability

geojsonkml is an open source node.js module for converting geojson to kml. A command injection vulnerability exists in geojson2kml, which stems from vulnerability to command injection attacks via the index.js file...

Terramaster TOS Security Vulnerability

Terramaster TOS is a Linux-based operating system from Shenzhen, China-based Tumi Electronic Technology Terramaster dedicated to the erraMaster Cloud Storage NAS server. A security vulnerability exists in TerraMaster TOS version 4.2.06 and earlier versions, which can be exploited by an attacker t...

Thai Palliative SQL注入漏洞

Thai Palliative is a modified version of the PHP framework developed by DAMASAC KKU. Versions of Thai Palliative 3.0 and earlier have a SQL injection vulnerability. This vulnerability arises from the lack of cleaning or parameterization of the idFormMain parameter and the id parameter, which may...

QNAP file station 缓冲区错误漏洞

QNAP Systems File Station 5 is a file management system developed by QNAP Systems, a company based in Taiwan, China. QNAP Systems File Station 5 has a security vulnerability that stems from a buffer overflow issue. This vulnerability could allow remote attackers to modify memory after obtaining...

VMware Spring Data Commons 资源管理错误漏洞

VMware Spring Data Commons is a data access abstraction framework developed by VMware Corporation. There is a resource management vulnerability in VMware Spring Data Commons, which may lead to a StackOverflowException during the parsing of Sort parameters, resulting in a denial-of-service attack...

Microsoft Office Word 缓冲区错误漏洞

Microsoft Office Word is a word processing software developed by Microsoft. There is a security vulnerability in Microsoft Office Word, which stems from an unreliable pointer dereferencing. This vulnerability may allow unauthorized attackers to execute code locally...

Tenda G0 缓冲区错误漏洞

Tenda G0 is a router produced by the Chinese company Tenda. The version 15.11.0.5 of Tenda G0 contains a security vulnerability. This vulnerability stems from a buffer overflow in the portalAuth parameter of the formPortalAuth function, which could allow attackers to cause denial-of-service attac...

Microsoft Windows DHCP Server 输入验证错误漏洞

Microsoft Windows DHCP Server is a core service of the American company Microsoft, used for automatically retrieving network configuration information. There are security vulnerabilities in Microsoft Windows DHCP Server. The following products and versions are affected: Windows 10 Version 22H2 fo...

NVIDIA DALI 安全漏洞

NVIDIA DALI is an open-source library for data loading and preprocessing, primarily used to accelerate image and video processing in deep learning workflows. NVIDIA DALI has a heap buffer overflow vulnerability. This vulnerability stems from improper handling of input data within certain...

Adobe Experience Manager 跨站脚本漏洞

Adobe Experience Manager is a content management solution developed by Adobe Inc. in the United States. It can be used to build websites, mobile applications, and forms. This solution supports mobile content management, marketing and sales activity management, and multi-site management, among oth...

HAX 安全漏洞

HAX is an open-source microsite managed using HAX+CMS with a PHP backend. There were security vulnerabilities in HAX CMS PHP versions prior to 26.0.0. These vulnerabilities stemmed from a combination of stored XSS attacks and the exposure of dynamic tokens at the /system/api/connectionSettings...

GNCC GP5 信任管理问题漏洞

GNCC GP5 is a 2K indoor security camera produced by GNCC Corporation. The GNCC GP5 v7.1.76 version contains a security vulnerability. This vulnerability stems from the practice of storing sensitive wireless network information as plain text in the serial console during regular operations, which m...

D-Link DWR-X1820 安全漏洞

The D-Link DWR-X1820 is a wireless router produced by D-Link Corporation. The D-Link DWR-X1820 has a security vulnerability. This vulnerability stems from the use of weak default passwords generated from the IMEI number, and no requirement is placed on users to change them. As a result, attackers...

Google Chrome 安全漏洞

Google Chrome is a web browser developed by Google Inc. Versions of Google Chrome prior to 148.0.7778.216 contained a security vulnerability caused by an ANGLE component heap buffer overflow. This vulnerability could allow remote attackers to exploit a compromised rendering process through a...