OpenMRS 跨站脚本漏洞

OpenMRS is an open source electronic medical record system from OpenMRS, Inc. in the United States. OpenMRS version 1.17.0 before the security vulnerability , the vulnerability stems from the component Notes Handler in the...

Apiman 安全漏洞

Apiman is Apiman Open Source, a flexible open source API management platform for enterprise users. A security vulnerability exists in Apiman versions 1.5.7 through 2.2.3.Final, which stems from insufficient checking of read permissions in the Apiman Manager REST API...

Socket.IO SQL注入漏洞

Socket.IO is a JavaScript library for real-time web applications from Socket.IO. A security vulnerability exists in Socket.IO that stems from incorrect type validation when an attachment parses the Socket.io js library...

lighttpd 安全漏洞

lighttpd is an open source web server developed by Jan Kneschke in Germany. A security vulnerability exists in lighttpd that originates from a denial-of-service attack that can be triggered via CLOSEWAIT / CONSTATEREADPOST...

Rocket.Chat SQL注入漏洞

Rocket.Chat, an open source team chat software, is vulnerable to SQL injection, which stems from the application's lack of validation of externally entered SQL statements. An attacker could exploit the vulnerability to retrieve a reset password token via 2fa secret or 2fa secret...

Google TensorFlow 安全漏洞

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google, Inc. in the United States. A security vulnerability exists in Google TensorFlow, which stems from an assertion failure in the GPU kernel when MaxPool receives a window-sized input array ksize with a...

NLnet Labs Routinator 安全漏洞

NLnet Labs Routinator is an RPKI Resource Public Key Infrastructure validator from NLnet Labs in the Netherlands written in the Rust language. A security vulnerability exists in NLnet Labs Routinator versions 0.9.0 through 0.11.2, which stems from an error in error handling, where data in RRDP...

Matrix matrix-appservice-irc 资源管理错误漏洞

matrix-appservice-irc is a bridge for Matrix. This bridge passes all IRC messages to Matrix and all Matrix messages to IRC. A resource management error vulnerability exists in Matrix matrix-appservice-irc prior to version 0.35.0, which stems from an error in the underlying matrix-org/node-irc...

NodeBB Forum Software 跨站请求伪造漏洞

NodeBB is a forum system from the Design Create Play team built using Node.js, a web application platform built on top of Google's V8 JavaScript engine. A cross-site request forgery vulnerability exists in NodeBB Forum Software versions prior to 1.17.1, which stems from an unwanted condition in t...

Microsoft Windows Local Security Authority Subsystem Service 安全漏洞

The Microsoft Windows Local Security Authority Subsystem Service is an internal Microsoft program that runs Windows system security policies. It authenticates users when they log on to a computer standalone or server, manages user password changes, and generates access characters. It also leaves...

Arm Mali GPU Kernel Driver 安全漏洞

The Arm Mali GPU Kernel Driver is a driver for a graphics processor unit from Arm UK. A security vulnerability exists in the Arm Mali GPU Kernel Driver Valhall versions r29p0 through r38p0, which arises from incorrect processing operations on the GPU...

SQUIRREL 缓冲区错误漏洞

SQUIRREL is a stable version of the programming language SQUIRREL 3.2. A buffer error vulnerability exists in SQUIRREL 2.2.5 and earlier and 3.1 and earlier 3.x. The vulnerability stems from sqclass.cpp allowing out-of-bounds reads in the kernel interpreter, which can lead to code execution that,...

Honeywell Saia Burgess PG5 PCD 授权问题漏洞

Honeywell Saia Burgess PG5 PCD is a Honeywell USA solution that includes SBC Instrumentation, Control and Automation ICA devices for implementation and operational automation. A security vulnerability exists in all versions of the Honeywell Saia Burgess PG5 PCD, which stems from the use of the...

Drupal 安全漏洞

Drupal is an open source content management system developed in PHP by the Drupal community. A security vulnerability exists in Drupal versions prior to 7.91, prior to 9.3.19, and prior to 9.4.3, which stems from the image module not properly checking for image files that are not stored in the...

Moodle 跨站脚本漏洞

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment. a cross-site scripting vulnerability exists in the LTI module of Moodle, which stems from a lack of data validation filtering of...

Jenkins Plugin RocketChat Notifier 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.An information disclosure vulnerability...

WordPress plugin WP Ultimate CSV Importer 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A server cross-site request...

elitecms SQL注入漏洞

Elitecms is a web content management from elitecms India. elitecms version 1.01 is vulnerable to SQL injection, which originates from admin/editsidebar.php?page=2 & sidebar The page sidebar parameter lacks validation for external input SQL statements, and an attacker could exploit the vulnerabili...

Avast Antivirus和AVG Antivirus 资源管理错误漏洞

Avast Antivirus is a suite of antivirus software from the Czech company Avast. A vulnerability exists in Avast Antivirus prior to version 22.1 and AVG Antivirus prior to version 22.1 due to a security restriction not being properly applied by the application in the "Anti Rootkit" driver in...

Fortinet FortiOS 信息泄露漏洞

Fortinet FortiOS is a security operating system dedicated to the FortiGate network security platform from Fortinet, Inc. Fortinet FortiOS is vulnerable to an information leakage vulnerability that results from excessive data output in server-generated error messages, which can be exploited by...

WordPress plugin 跨站请求伪造漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress eRoom-Zoom Meetings & Webinar plugin 1.3.7 an...

zbzcms代码问题漏洞

zbzcms station helper CMS is a content management website of China station helper CMS zbzcms company. zbzcms version 1.0 has an arbitrary file upload vulnerability, which can be exploited by attackers to execute arbitrary code via specially crafted PHP files...

Shopware 代码问题漏洞

Shopware is a German Shopware company's open source e-commerce software. A code issue vulnerability exists in Shopware that stems from the fact that in the affected version, a user session is not logged off if the password is reset via password recovery. An attacker could exploit the vulnerabilit...

Autodesk AutoCAD 缓冲区错误漏洞

Autodesk AutoCAD is a suite of professional 3D drawing software from Autodesk, Inc. A buffer error vulnerability exists in Autodesk AutoCAD because the product does not fully check the security of a DWF file during parsing. The vulnerability can be exploited to cause memory corruption and code...

atftp 缓冲区错误漏洞

atftp is a client-side implementation of the TFTP protocol. A security vulnerability exists in atftp, which stems from the fact that options.c in atftp reads to the end of an array, thus exposing server-side /etc/group data to a remote client...

NumPy 安全漏洞

NumPy is a Python scientific computing package. The product supports a large number of dimensional array and matrix calculations, as well as providing a large library of mathematical functions for data operations. A security vulnerability exists in NumPy prior to 1.19, which stems from a buffer...

ARM mbed TLS 资源管理错误漏洞

ARM mbed TLS is a product from ARM UK that provides secure communication and encryption capabilities for mbed products. A resource management error vulnerability exists in mbed TLS, which can be exploited by a remote attacker to send a specially crafted request to an application to trigger a doub...

Microsoft Defender 代码注入漏洞

Microsoft Defender for IoT is an asset discovery, vulnerability management, and threat monitoring solution for IoT/OT environments.Microsoft Defender for IoT suffers from a remote code execution vulnerability. An attacker could exploit this vulnerability to execute code on the target host...

Bentley Systems Bentley View 缓冲区错误漏洞

Bentley View is a free viewer from Bentley Systems, Inc. A security vulnerability exists in Bentley View JP2 file parsing, which could be exploited by attackers to obtain sensitive information about affected Bentley View installations...

Distributed Data Systems WebHmi 代码问题漏洞

Distributed Data Systems WebHmi is a Scada system with a built-in web server from Distributed Data Systems, Ukraine. It is used for monitoring and controlling any automation system on the local network as well as over the Internet from computers and mobile devices. A file upload vulnerability...

Microsoft Exchange Server 权限许可和访问控制问题漏洞

Microsoft Exchange Server is the United States Microsoft Microsoft company's set of e-mail service program. It provides email access, storage, forwarding, voice mail, email filtering and screening. A vulnerability exists in Microsoft Exchange Server with privilege permission and access control...

WordPress 插件 访问控制错误漏洞

WordPress Plugin is an open source application plugin for WordPress. A security vulnerability exists in the WordPress plugin PostX, which stems from Gutenberg Blocks in the Post Grid WordPress plugin prior to PostX - version 2.4.10 allows any logged in user to perform error checking before...

PowerISO 缓冲区错误漏洞

PowerISO is a powerful CD/DVD/BD image file processing tool from PowerISO that can open, extract, burn, create, edit, compress, encrypt, split and convert ISO files, and mount ISO files using internal virtual drives. PowerISO suffers from a buffer overflow vulnerability that originates from a...

McAfee Agent代码问题漏洞

The McAfee McAfee Agent MA is a set of client components from McAfee, Inc. that provides secure communications between ePolicy Orchestrator the antivirus management platform and managed products. A security vulnerability exists in McAfee Agent in versions prior to 5.7.3. The vulnerability stems...

Ubuntu Apport 后置链接漏洞

Apport is a toolkit for collecting and feeding back error messages information that the operating system finds useful when an application crashes. A security vulnerability exists in Ubuntu Apport that stems from incorrect handling of certain information gathering operations, which can be exploite...

Ubuntu Apport 后置链接漏洞

Apport is a toolkit for collecting and feeding back error messages information that the operating system finds useful when an application crashes. A security vulnerability exists in Ubuntu Apport that stems from incorrect handling of certain information gathering operations, which can be exploite...

Ubuntu Apport 后置链接漏洞

Apport is a toolkit for collecting and feeding back error messages information that the operating system finds useful when an application crashes. A security vulnerability exists in Ubuntu Apport that stems from Apport incorrectly handling certain information-gathering operations, which can be...

Ubuntu Apport 后置链接漏洞

Apport is a toolkit for collecting and giving feedback on error messages information that the operating system finds useful when an application crashes. A security vulnerability exists in Ubuntu Apport that stems from Apport incorrectly handling certain information-gathering operations, which can...

Huawei 多款产品 注入漏洞

Huawei P30 is a smartphone from Huawei China.The Huawei P30 is vulnerable to JavaScript injection, which can be exploited by attackers to launch JavaScript injection by sending malicious application requests...

Google Android 缓冲区错误漏洞

Google Android is a Linux-based open source operating system from Google and the Open Handset Alliance OHA. Google Android 11 suffers from an elevation of privilege vulnerability. The vulnerability stems from an out-of-bounds read due to improper boundary checking in nciprocrfmanagementntf in...

OpenWrt Security Vulnerabilities

OpenWrt is a Linux operating system for embedded devices. A security vulnerability exists in OpenWrt 19.07.x before 19.07.7, which stems from the fact that when IPv6 is used, a routing loop may be created that generates excessive network traffic between an affected device and the router of its...

VMware Spring Web Services 安全漏洞

VMware Spring Web Services is a SOAP Web services development framework provided by the American company VMware. There are security vulnerabilities in versions 5.0.0 to 5.0.1, 4.1.0 to 4.1.3, 4.0.0 to 4.0.18, and 3.1.0 to 3.1.8 of VMware Spring Web Services. These vulnerabilities stem from...

VMware Spring Web Services 代码问题漏洞

VMware Spring Web Services is a SOAP Web services development framework provided by the American company VMware. There are code vulnerabilities in versions 5.0.0 to 5.0.1, 4.1.0 to 4.1.3, 4.0.0 to 4.0.18, and 3.1.0 to 3.1.8 of VMware Spring Web Services. These vulnerabilities stem from the use of...

Google Chrome 输入验证错误漏洞

Google Chrome is a cross-platform web browser developed by Google, primarily used for accessing internet content. Google Chrome has a vulnerability related to input validation. This vulnerability stems from the Accessibility module’s failure to properly validate untrusted inputs. Attackers can...

IBM Security QRadar EDR 安全漏洞

IBM Security QRadar EDR is a terminal detection and response software developed by the American multinational company IBM. There are security vulnerabilities in versions 3.12 to 3.12.24 of IBM Security QRadar EDR. These vulnerabilities stem from the storage of user credentials in plain text, whic...

VMware Spring Web Flow 安全漏洞

VMware Spring Web Flow is a web application flow management framework developed by the American company VMware. Versions 4.0.0, 3.0.0 to 3.0.1, and 2.5.0 to 2.5.1 of VMware Spring Web Flow contain security vulnerabilities. These vulnerabilities stem from the possibility of malicious Unified EL...

tmp 路径遍历漏洞

“tmp” is a temporary file and directory creator developed by KARASZI István for Node.js developers. Versions of “tmp” prior to 0.2.6 had a path traversal vulnerability; this vulnerability could lead to files being created outside of the intended temporary directories due to path traversal...

Google Chrome 竞争条件问题漏洞

Google Chrome is a web browser developed by Google Inc. Versions of Google Chrome prior to 149.0.7827.115 contained a vulnerability due to race conditions in the Safe Browsing component. This vulnerability could allow remote attackers to execute a sandbox escape through malicious files after...

Cloud hypervisor 资源管理错误漏洞

Cloud Hypervisor is a virtual machine monitor developed by Cloud Hypervisor Company, designed for modern cloud workloads. Versions of Cloud Hypervisor from 21.0 to 51.2 contained a resource management vulnerability. This vulnerability stemmed from submitting two virtio-block descriptors with the...

VMware Spring AMQP 信任管理问题漏洞

VMware Spring AMQP is a message queue integration framework developed by VMware, Inc. There is a vulnerability related to trust management in VMware Spring AMQP. This vulnerability arises when configuring a proxy connection using RabbitConnectionFactoryBean.setUriamqps://…, without calling...