Google Chrome security vulnerabilities

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a heap buffer overflow vulnerability that is caused by incorrect boundary checking in ANGLE. An attacker can exploit this vulnerability to execute arbitrary code on the system or cause the application to...

quiche security breach

quiche is a Cloudflare open source implementation of the IETF-designated QUIC transport protocol and HTTP/3. A security vulnerability exists in quiche versions v0.15.0 through 0.19.0, which stems from a QUIC path authentication requirement that the recipient of a PATHCHALLENGE frame responds by...

Apache Tiles Path Traversal Vulnerability

Apache Tiles is a page layout framework for JavaEE applications from the Apache Foundation. A path traversal vulnerability exists in Apache Tiles prior to version 2.0.0, which stems from failing to validate the value of the DefaultLocaleResolver.LOCALEKEY attribute set on a session when parsing a...

Adobe Acrobat Reader security vulnerability

Adobe Acrobat Reader is a PDF viewer from the American company Audobee Adobe. The software is used to print, sign and annotate PDF. A security vulnerability exists in Adobe Acrobat Reader version 23.006.20360 and earlier and version 20.005.30524 and earlier, which can be exploited by an attacker ...

Apache Traffic Server information leakage vulnerability

Apache Traffic Server ATS is the United States Apache Apache Foundation's set of scalable HTTP proxy and caching server. Apache Traffic Server suffers from an information disclosure vulnerability that stems from the application exposing sensitive information and is vulnerable to HTTP/2 and s3...

Microsoft ODBC Driver Security Vulnerability

Microsoft ODBC Driver is a driver from Microsoft. It allows applications to access data in a database management system DBMS using SQL as the standard for accessing data. A security vulnerability exists in Microsoft ODBC Driver. An attacker could exploit the vulnerability to remotely execute code...

WordPress plugin WP SMS has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

Mattermost Security Vulnerabilities

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a security vulnerability that arises from the deletion of a message in a thread without the attachment being deleted, allowing normal users to still access and download the...

EJBCA Authorization Issues Vulnerability

EJBCA is an open source Public Key Infrastructure PKI and Certificate Authority CA software from Keyfactor Open Source. A security vulnerability exists in Keyfactor EJBCA versions prior to 8.0.0 that stems from the presence of an authentication issue that results in the disclosure of CA...

Apache Airflow path traversal vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A path traversal vulnerability exists in Apache Airflow versions prior to 2.6.3,...

Milesight UR32L: Operating System Command Injection Vulnerability

The Milesight UR32L is a 4G industrial router from China's Milesight. The Milesight UR32L vtyshubus toolshexcute.constprop.1 feature suffers from a command injection vulnerability that can be exploited by an attacker to execute arbitrary commands on the system...

WordPress plugin with WP ERP SQL injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

WordPress plugin Visual CSS Style Editor has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

jsreport code injection vulnerability

jsreport is a report server that allows developers to define reports using javascript template engines such as handlebars. A code injection vulnerability exists in jsreport versions prior to 3.11.3. An attacker could exploit this vulnerability to perform a code injection attack...

Spring Framework security vulnerabilities

Spring Framework is the U.S. Spring team of a set of open source Java, JavaEE application framework. The framework helps developers build high-quality applications. Spring Boot has a security vulnerability that stems from a security bypass using wildcard pattern matching...

Adobe Substance 3D Designer buffer error vulnerability

Adobe Substance 3D Designer is a 3D design software from Adobe. A security vulnerability exists in Adobe Substance 3D Designer version 12.4.0 and prior versions, which stems from a buffer overflow vulnerability that could lead to the execution of arbitrary code in the context of the current user...

Siemens SICAM A8000 command injection vulnerability

The Siemens SICAM A8000 is a protection and interval control unit device for relay protection and substation environments from Siemens, Germany. A command injection vulnerability exists in the Siemens SICAM A8000. The vulnerability stems from the device's failure to properly filter constructed...

Cisco SD-WAN vManage Software Cross-site Request Forgery Vulnerability

Cisco SD-WAN vManage Software is a management software for SD-WAN Software Defined Wide Area Network solutions from Cisco. A security vulnerability exists in Cisco SD-WAN vManage Software due to insufficient CSRF protection in the web-based management interface on affected systems...

VISAM VBASE code-related vulnerabilities

VISAM VBASE is a data acquisition and monitoring system from VISAM Germany. A code issue vulnerability exists in VISAM VBASE Automation Base versions prior to 11.7.5 that stems from the presence of an information leak...

Cloudflare CloudFlare: Postback link vulnerability

Cloudflare cloudflared is a cloud server security management platform from American company Cloudflare. The platform provides firewall analysis, cache control, role-based access, and more. A security vulnerability exists in Cloudflare cloudflared Windows 32-bit version 2023.3.0 and earlier, which...

Multiple Tenda products have command injection vulnerabilities

Tenda CP7 and others are a smart camera from Tenda China. Tenda has a security vulnerability that stems from the susceptibility of certain products to command injection attacks, the following products and versions are affected: Tenda CP7 Tenda CP7 V11.10.00.2211041403 and prior versions, Tenda CP...

WAGO security vulnerabilities

WAGO is a 750-88x series programmable logic controller from WAGO, Germany. The device is an electronic system designed for the operation of digital algorithms for applications in industrial environments. A security vulnerability exists in WAGO Unmanaged Switch 852-111/000-001 firmware version 01,...

ArgoCD security vulnerabilities

ArgoCD is a software application. A declarative GitOps continuous delivery tool for Kubernetes. It continuously monitors running applications and compares the current live state with the desired target state e.g., configuration in a Git repository, automatically synchronizing and deploying...

ownCloud path traversal vulnerability

ownCloud is a personal cloud storage solution from the US-based company ownCloud. A security vulnerability exists in ownCloud Android versions prior to 3.0, which stems from an information leak when uploading internal files...

Siemens Teamcenter Visualization and JT2Go buffer error vulnerabilities

Siemens Teamcenter Visualization is a software that provides team collaboration capabilities for designing 2D and 3D scenes. Siemens JT2GO is a JT file viewer. Siemens Teamcenter Visualization and JT2Go are vulnerable to a heap buffer overflow vulnerability that could be exploited by an attacker ...

OpenMRS cross-site scripting vulnerability

OpenMRS is an open source electronic medical record system from OpenMRS, Inc. in the United States. OpenMRS version 1.17.0 before the security vulnerability , the vulnerability stems from the component Notes Handler in the...

TYPO3 code-related vulnerabilities

TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Association. A code issue vulnerability exists in TYPO3 Core, which can be exploited by an attacker to bypass TYPO3 Core restrictions via a password reset session expiration in order to gain user...

Xfce parameter injection vulnerability

Xfce is a desktop environment by the individual developer Olivier Fourdan for Unix and Unix-like operating systems such as Linux and FreeBSD. Xfce A parameter injection vulnerability exists in Xfce xfce4-settings versions prior to 4.16.4, 4.17.x through 4.17.1, which stems from escaping character...

Dell ELAN Miniport Touchpad Driver security vulnerabilities

Dell ELAN Miniport Touchpad Driver is a miniport touchpad driver from Dell USA. A security vulnerability exists in Dell ELAN Miniport Touchpad Driver versions prior to 24.21.51.2. An attacker could exploit this vulnerability to cause a system crash by sending a certain IOCTL request...

GitLab security vulnerabilities

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab CE/EE that stems from an incorrect...

Apache Airflow input validation vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An input validation error vulnerability exists in Apache Airflow versions prior to...

Advantech R-SeeNet buffer error vulnerability

Advantech R-SeeNet is an industrial monitoring software from Advantech China. The software is based on the snmp protocol for monitoring platforms and is available for Linux and Windows platforms.Advantech R-SeeNet 2.4.17 and previous versions have a security vulnerability that can be exploited to...

Canteen Management System SQL Injection Vulnerability

Canteen Management System is a cafeteria management system by Mayuri K. Individual developer. A security vulnerability exists in Canteen Management System version 1.0, which stems from unknown code in the file login.php is affected, and manipulation of the parameter business may result in sql...

Apache Dubbo code issues and vulnerabilities

Apache Dubbo is a microservice development framework that provides two key capabilities for RPC communication and microservice governance.Apache Dubbo Hession is vulnerable to deserialization, which can be exploited by attackers to execute arbitrary code on the target server...

SAP Customer Data Cloud encryption vulnerabilities

SAP Customer Data Cloud is a tool from SAP Germany that provides digital customer identity and access management. It enables companies to collect, aggregate and manage customer data across multiple touch points and applications. An encryption issue vulnerability exists in SAP Customer Data Cloud...

Google TensorFlow security vulnerabilities

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google, Inc. in the United States. Google TensorFlow suffers from a security vulnerability that stems from FractionalMaxPoolGrad validating its inputs by asserting a failure instead of returning an error. T...

Mermaid code injection vulnerability

Mermaid is a software application. Create charts and visualizations using text and code. A code injection vulnerability exists in Mermaid versions prior to 1.3.0, prior to 2.0.0-rc1, which can be exploited by an attacker to modify any mermaid block of code with arbitrary code, which will be...

Automation Broker apb security vulnerabilities

apb is an Automation Broker open source CLI tool for listing and deploying service packs. A security vulnerability exists in Automation Broker apb container version 2.0.4-1, which stems from the container granting sudoer privileges to all users, allowing unauthorized users with access to the...

Apache Airflow security vulnerabilities

Apache Airflow is an open source platform for creating, managing and monitoring workflows from the Apache Foundation. The platform is scalable and dynamically monitored, etc. A remote code execution vulnerability exists in versions of Apache Airflow prior to 3.0.0. The vulnerability stems from th...

OpenZeppelin security vulnerabilities

OpenZeppelin is a software application. A standard for secure blockchain applications. A security vulnerability exists in OpenZeppelin Contracts 4.1.0 and earlier versions, which stems from the function ECDSA.recover and vulnerability to a type of signature extensibility...

Node.js security vulnerabilities

Node.js is an open source, cross-platform JavaScript runtime environment. A security vulnerability exists in Node.js version 16.5.4 and versions prior to 17.1.3 in the 17.x series, which stems from the fact that an incorrectly formatted MKV file may cause the file type detector to fall into an...

Microsoft Windows code-related vulnerabilities

Microsoft Windows is a suite of operating systems for use on personal devices from Microsoft Corporation USA. A code issue vulnerability exists in the Microsoft Windows Client/Server Runtime Subsystem. The following products and editions are affected:Windows 10 Version 1809 for 32-bit...

Nucleus CMS code-related vulnerabilities

Nucleus CMS is a website builder. A security vulnerability exists in Nucleus CMS version v3.71, which stems from the presence of a file upload vulnerability. An attacker can exploit this vulnerability to obtain sensitive information from a website...

Jenkins Plugin ThreadFix: Cross-Site Request Forgery Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins Plugin is an application software. An authorization issue...

Google TensorFlow input validation error vulnerability

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. An input validation error vulnerability exists in TensorFlow versions prior to 2.9.0, 2.8.1, 2.7.2, and 2.6.4, which stems from the fact that tf.rawops.SparseTensorToCSRSparseMatrix does not ful...

Cisco Common Services Platform Collector Cross-Site Script Vulnerability

Cisco Common Services Platform Collector CSPC is a common services platform data collector from Cisco USA. The product analyzes network performance and identifies risks and vulnerabilities by polling basic inventory and configuration data from Cisco devices.Cisco Common Services Platform Collecto...

PlantUML code vulnerabilities

PlantUML is a component that allows rapid authoring. for generating diagrams from textual descriptions. A security vulnerability exists in PlantUML versions prior to 1.2022.5, which can be exploited by an attacker to bypass URL restrictions and enable server-side request forgery SSRF...

InHand Networks InRouter302 has a vulnerability related to input validation errors.

InHand Networks InRouter Series is a series of routers from InHand Networks, Inc. InHand Networks InRouter302 version V3.5.4 is vulnerable to an input validation error that originates in the libnvram.so nvramimport function userdefineinit function in the userdefinetimeoutnvram variable has...

Siemens Teamcenter code-related vulnerabilities

Siemens Teamcenter is a product lifecycle management computer software application from Siemens, Germany. Siemens Teamcenter contains a security vulnerability that could be exploited by attackers to view files on the application server file system...

Adobe InDesign buffer error vulnerability

Adobe InDesign is a set of layout and editing applications from the American company Audobee Adobe. A code execution vulnerability exists in Adobe InDesign. The vulnerability arises from a networked system or product that does not properly validate data boundaries when performing operations in...