InSAT MasterSCADA BUK-TS operating system command injection vulnerability

InSAT MasterSCADA BUK-TS is an industrial automation control component developed by the Russian company InSAT. InSAT MasterSCADA BUK-TS has a vulnerability related to OS command injection. This vulnerability stems from the presence of OS command injection in the MMadmServ Web interface fields,...

MajorDoMo security vulnerability

MajorDoMo is an open-source DIY smart home automation platform developed by the MajorDoMo community. There is a security vulnerability in MajorDoMo. This vulnerability stems from the saverestore module, which exposes its admin method through the /objects/?module=saverestore endpoint without...

QNAP Qsync Central security vulnerability

QNAP Qsync Central is a cloud-based file synchronization service for NAS devices provided by QNAP Technology Co., Ltd. Versions of QNAP Qsync Central prior to 5.0.0.4 contained security vulnerabilities. These vulnerabilities stemmed from unlimited resource allocation or throttling, which could le...

Y Soft SafeQ security vulnerabilities

Y Soft SafeQ is a print management software from the Czech company Y Soft. A security vulnerability exists in versions prior to Y Soft SafeQ 6 MU106, which stems from the presentation of the Workflow Connector password field in a way that allows administrators with UI access to view the password...

Microsoft Windows Kerberos security vulnerabilities

Microsoft Windows Kerberos is a software for authentication in network clusters from Microsoft Corporation.Kerberos also serves as a network authentication protocol designed to provide strong authentication services to client/server applications via a key system. A security vulnerability exists i...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the release of resources after an initstream failure, which could lead to post-release reuse...

SOCA Access Control System security vulnerabilities

SOCA Access Control System is an access control system from China's Sunchem SOCA. A security vulnerability exists in SOCA Access Control System version 180612, which stems from an unvalidated POST parameter and could lead to a SQL injection attack...

WordPress plugin TempTool has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site...

Aqara’s various products have security vulnerabilities

Aqara Camera Hub G3 and others are a smart surveillance camera from Aqara USA. A security vulnerability exists in various Aqara products, which stems from a malicious domain name that results in command injection, which could lead to the execution of arbitrary commands. The following products and...

Synology DiskStation Manager and Synology Unified Controller buffer error vulnerabilities

Synology DiskStation Manager DSM and Synology Unified Controller are both products of China-based Synology, Inc.Synology DiskStation Manager is an operating system for use on networked storage servers NAS. Synology DiskStation Manager is an operating system used on network storage servers NAS to...

Windu CMS security vulnerabilities

Windu CMS Windu CMS is a lightweight web content management system CMS from Windu. A security vulnerability exists in Windu CMS version 4.1, which stems from insufficient client-side brute force protection and could lead to brute force attacks...

FiberHome GPON ONU HG6145F1 security vulnerability

The FiberHome GPON ONU HG6145F1 is a router from FiberHome China. A security vulnerability exists in the FiberHome GPON ONU HG6145F1 RP4423, which stems from the device's use of a deterministic algorithm to generate a default WiFi password, which could lead an attacker to predict the password...

Unisoc Chipsets security vulnerabilities

UNISOC Chipsets is a chipset from China's Purple Spreadtrum UNISOC. A security vulnerability exists in Unisoc Chipsets that stems from a memory consistency issue in the TEE EcDSA algorithm that could lead to the generation of incorrect signature results...

Advantech WebAccess/VPN security vulnerabilities

Advantech WebAccess/VPN is a virtual private network feature integrated in Advantech WebAccess/SCADA software, designed to provide a secure and reliable network connectivity solution for industrial automation and remote monitoring systems. Advantech WebAccess/VPN suffers from a SQL injection...

Liferay Portal and Liferay DXP have cross-site scripting vulnerabilities

Liferay Portal and Liferay DXP are both products of Liferay, Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from not properly releasing the kobject reference count when device registration fails, which could lead to a memory...

OpenSynergy BlueSDK security vulnerabilities

OpenSynergy BlueSDK is a Bluetooth stack from OpenSynergy, Germany. A security vulnerability exists in OpenSynergy BlueSDK 6.x and prior versions, which stems from the lack of proper return control flow after an exception condition is detected in the BlueSDK Bluetooth stack, which could lead to...

Millenium MP3 Studio security vulnerability

Millenium MP3 Studio is a music playback software from Millenium. A security vulnerability exists in Millenium MP3 Studio 2.0 and prior versions, which originates from parsing a .pls file without validating the length of the File1 field, and could lead to a stack buffer overflow and execution of...

Claude Code Path Traversal Vulnerability

Claude Code is an open source proxy coding tool from Anthropic. A path traversal vulnerability exists in versions of Claude Code prior to 0.2.111, which stems from path validation using prefix matching instead of canonical path comparison, which could lead to directory restriction bypass...

Novel-plus security vulnerabilities

novel-plus is a novel reading software by xxy individual developer. A security vulnerability exists in novel-plus 5.1.3 and earlier versions, which stems from the mishandling of the parameter sort/order in the user management module, which may lead to an SQL injection attack...

Zyxel USG FLEX security vulnerabilities

Zyxel USG FLEX is a firewall from China Hopkins Zyxel. Offering flexible VPN options IPsec, SSL or L2TP, it provides flexible and secure remote access for remote work and management. A security vulnerability exists in Zyxel USG FLEX versions prior to V1.32, which stems from improper privilege...

Amazon tough security vulnerabilities

Amazon tough is a Rust client library for The Update Framework TUF repository from Amazon.com, USA. A security vulnerability exists in Amazon tough versions prior to 0.20.0 that stems from the client failing to detect a rollback of a delegated target during a target rollback, which could cause th...

Redis client for Go: Input validation error vulnerability

Redis client for Go is a Redis Go client for the Redis open source. An input validation error vulnerability exists in Redis client for Go, which stems from a CLIENT SETINFO timeout that can cause responses to be out of order, which can affect the response to connection and pipeline commands...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a deadlock in the sa1100settermios function...

AutomationDirect C-More EA9 Programming Software has security vulnerabilities

AutomationDirect C-More EA9 Programming Software is a programming software from AutomationDirect, Inc. A security vulnerability exists in AutomationDirect C-More EA9 Programming Software that stems from a lack of proper validation of the length of user-supplied data when parsing an EAP9 file,...

REDCap security vulnerabilities

REDCap is a data collection and management web application from REDCap Open Source. A security vulnerability exists in REDCap 15.0.0 and earlier versions, which stems from a lack of cross-site request forgery protection in the logout functionality, which allows an attacker to trigger a logout...

Astro Cross-Site Request Forgery Vulnerability

Astro is an Astro open source web framework for content-driven websites. A cross-site request forgery vulnerability exists in Astro version 4.16.16 and earlier, which stems from a flaw in the cross-site request forgery protection middleware that allows requests to bypass CSRF checks, leaving them...

Foxit PDF Reader resource management error vulnerability

Foxit PDF Reader is a PDF reader from the Chinese company Foxit. A resource management error vulnerability exists in Foxit PDF Reader, which stems from the Annotation feature that contains a reuse-after-release, leading to an information disclosure vulnerability...

AirTies Air4443 Cross-site Scripting Vulnerability

AirTies Air4443 is a firmware from AirTies, Inc. A cross-site scripting vulnerability exists in AirTies Air4443 that stems from improper input neutralization during web page generation, resulting in a cross-site scripting vulnerability...

Dozzle security vulnerability

Dozzle is a small, lightweight application by the individual developer Amir Raminfar. A security vulnerability exists in Dozzle versions prior to 8.5.3 that stems from the use of sha-256 as a password hash, which makes it vulnerable to rainbow table attacks...

Rocket.Chat security vulnerability

Rocket.Chat is a chat program from Rocket.Chat Inc. A security vulnerability exists in Rocket.Chat. An attacker exploiting this vulnerability is able to abuse the UpdateOTRAck method. The following versions are affected: version 6.12.0, version 6.11.2, version 6.10.5, version 6.9.6, version 6.8.6...

Next.js security vulnerabilities

Next.js is a React framework open-sourced by Vercel. A security vulnerability exists in Next.js versions 13.5.1 through 14.2.10 and earlier. An attacker exploits the vulnerability to poison the caches of non-dynamic server-side rendering routes in the page router by sending specially crafted HTTP...

H2O code issue vulnerabilities

H2O is an in-memory platform for distributed, scalable machine learning open-sourced by H2O.ai. A code issue vulnerability exists in H2O-3 version 3.46.0.4, which stems from the fact that incorrect manipulation of the parameter query can lead to deserialization...

Tenda AX1806 security vulnerabilities

The Tenda AX1806 is a WiFi6 wireless router from Tenda, a Chinese company. The Tenda AX1806 suffers from a stack overflow vulnerability that originates from the iptv.stb.mode parameter in the function formGetIptv that contains a stack overflow, and no detailed vulnerability details are provided a...

WordPress plugin ComboBlocks has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin Smush security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in...

Pytorch-Lightning Security Vulnerability

Pytorch-Lightning is an open source lightweight PyTorch wrapper. It is used for high performance Ai research. A security vulnerability exists in Pytorch-Lightning version 2.2.1, which stems from mishandling of deserialized user input and mismanagement of the dunder attribute, leading to a remote...

WordPress plugin WPZOOM Addons for Elementor has security vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

1Panel command injection vulnerability

1Panel is an open source Linux server operations and management panel for the Chinese 1panel community. A command injection vulnerability exists in versions prior to 1Panel v1.10.3-lts. The vulnerability stems from the presence of a command injection issue that can lead to arbitrary file writing...

Apollo Router security vulnerabilities

Apollo Router is a configurable, high-performance graphical router written in Rust. A security vulnerability exists in Apollo Router versions prior to 1.45.1, which stems from an error in the cache retrieval logic and could result in the execution of unexpected operations...

Cisco IP Phone security vulnerabilities

The Cisco IP Phone is a hardware device from the American company Cisco, Inc. IP Phone that provides calling capabilities. A security vulnerability exists in the Cisco IP Phone that stems from a lack of authentication to a specific endpoint, which could allow an unauthenticated remote attacker to...

PyTorch security vulnerabilities

PyTorch is a Python package open-sourced by PyTorch. A security vulnerability exists in PyTorch versions prior to v2.2.0 that stems from the inclusion of a heap buffer overflow vulnerability that allows an attacker to cause a denial of service DoS via crafted input...

SolidWorks security vulnerabilities

SolidWorks is a 3D CAD software from SolidWorks that runs on the Microsoft Windows platform. A security vulnerability exists in SolidWorks version 2024 that originates from a vulnerability that allows an attacker to execute arbitrary code when opening a specially crafted CATPART, DWG, DXF, IPT, J...

RiteCMS cross-site scripting vulnerabilities

RiteCMS is an open source content management system based on PHP and SQLite. RiteCMS suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the component mainmenu/editsection, which can be exploited by an attacker to...

ArgoCD Security Vulnerabilities

ArgoCD is a software application. A declarative GitOps continuous delivery tool for Kubernetes. It continuously monitors running applications and compares the current live state with the desired target state e.g., configuration in a Git repository, automatically synchronizing and deploying...

CouchAuth Security Breach

CouchAuth is an authentication API. A security vulnerability exists in CouchAuth version 0.20.0 and prior versions, which stems from a password reset link that can be sent to a user by sending a specially crafted host header in a forgotten password request, which, if clicked, could allow an...

WordPress Plugin GoCardless Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress Plugin flowpaper Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

JustSystems Ichitaro Buffer Error Vulnerability

JustSystems Ichitaro is a Japanese word processing software from JustSystems. A buffer error vulnerability exists in JustSystems Ichitaro version 2023 1.0.1.59372, which stems from an out-of-bounds write in the Ichitaro's DocumentViewStyles and DocumentEditStyles stream parsers, an out-of-bounds...

GitHub Enterprise Server security vulnerabilities

GitHub Enterprise Server is a U.S. GitHub open source application. It provides a platform for setting up your own GitHub instance as a virtual appliance, thus providing a scalable, easy-to-manage platform. A security vulnerability exists in GitHub Enterprise Server that stems from allowing commit...