WordPress plugin WP Data Access has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

Microsoft SQL Server security vulnerabilities

Microsoft SQL Server is a large commercial database system from Microsoft that is used under Microsoft Windows. A security vulnerability exists in Microsoft SQL Server. The following products and editions are affected: Microsoft SQL Server 2008 for 32-bit Systems Service Pack 4 QFE, Microsoft SQL...

Discourse security vulnerabilities

Discourse is an open source community discussion platform. The platform includes features such as communities, email and chat rooms. A security vulnerability exists in Discourse. An attacker logged in as an administrator could make multiple requests for backups, which would exhaust all connection...

GitLab security vulnerabilities

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab that stems from unhidden Google IAP...

Simple Food Ordering System Cross-Site Scripting Vulnerability

Simple Food Ordering System is a simple food ordering system by the individual developer Carlo Montero. A cross-site scripting vulnerability exists in Simple Food Ordering System version 1.0, which stems from cross-site scripting due to misuse of the parameter order...

Intel QATzip software security vulnerability

Intel QATzip is a userspace library from Intel Corporation USA. Built on top of the Intel QuickAssist Technology userspace library, it provides extended accelerated compression. A security vulnerability exists in IntelR QATzip softwar versions prior to 1.0.9, which stems from incorrect access...

modoboa security vulnerability

modoboa is an email hosting and management platform for individual developers. A security vulnerability exists in versions prior to modoboa 2.0.4, which stems from improperly limiting excessive authentication attempts...

react-admin cross-site scripting vulnerability

react-admin is a front-end framework for building data-driven applications that run in the browser on top of a REST/GraphQL API, using ES6, React, and Material Design. A security vulnerability exists in react-admin versions 3.x prior to 3.19.12 and 4.x prior to 4.7.6, which stems from the presenc...

WebFinance SQL Injection Vulnerability

WebFinance is a web application for managing invoices and handling customer contacts. A SQL injection vulnerability exists in fanzila WebFinance version 0.5, which stems from a problem with an unknown function in the file htdocs/admin/saveroles.php, where manipulation of the parameter id can lead...

Contiki-NG buffer error vulnerability

Contiki-NG is an open source cross-platform operating system for next-generation IoT Internet of Things devices. A buffer error vulnerability exists in Contiki-NG version 4.8 and prior versions, which stems from an out-of-bounds write in the BLE-L2CAP module...

SCS Library Client security vulnerabilities

SCS Library Client is a Golang client for Singularity Container Services SCS. A security vulnerability exists in SCS Library Client. An attacker can exploit the vulnerability to perform a multi-part concurrent download...

Cisco TelePresence Collaboration Endpoint Software security vulnerabilities

Cisco TelePresence Collaboration Endpoint Software is a suite of collaboration endpoint software from Cisco USA. A security vulnerability exists in Cisco TelePresence Collaboration Endpoint and RoomOS Software. An attacker could exploit the vulnerability to overwrite arbitrary files on the system...

vSwitch buffer error vulnerability

Open vSwitch is an open source virtual switch. Open vSwitch suffers from a buffer error vulnerability that stems from allowing an attacker to achieve integer underflow in its specific TLV...

FlatPress security vulnerability

FlatPress is a Php-based blog building system from the FlatPress community that does not require database support. flatpressblog/flatpress has a security vulnerability that stems from PHP remote file inclusion. No details of the vulnerability are currently available...

OpenKM security vulnerabilities

OpenKM is a document management system from OpenKM Spain. The system provides features such as version control, file history and file sharing. A security vulnerability exists in OpenKM versions prior to 6.3.11, which originates from an unknown function getFileExtension in the...

VMware Workspace ONE Assist Cross-site Scripting Vulnerability

VMware Workspace ONE Assist is a real-time remote support solution from VMware, Inc. Allows VMware Workspace ONE UEM administrators to remotely access and troubleshoot devices in real-time while respecting end-user privacy. A security vulnerability exists in VMware Workspace ONE Assist prior to...

Microsoft Word security vulnerabilities

Microsoft Word is a word processing software in the Office suite of the U.S. company Microsoft Microsoft. An information disclosure vulnerability exists in Microsoft Word, which can be exploited by attackers to obtain sensitive information...

Oracle Virtualization and Oracle VM VirtualBox security vulnerabilities

Oracle Virtualization and Oracle VM VirtualBox are both products of Oracle Corporation.Oracle Virtualization is a suite of virtualization solutions. The product is used to unify the management of the entire hardware and software architecture from applications to disks, enabling virtualization fro...

Gitea parameter injection vulnerability

Gitea is a lightweight Go-based git service developed by the Gitea community. A security vulnerability exists in versions of Gitea prior to 1.17.3, which stems from its failure to clean up and escape references in the git backend resulting in incorrectly handled arguments to git commands...

Bytebase security vulnerabilities

Bytebase is an open source web-based, zero-configuration, dependency-free database schema change and version control management tool for DevOps teams.Bytebase versions 0.1.0 through 1.0.4 are vulnerable to an access control error that stems from unrestricted low privilege user access, which can b...

Democritus Project security vulnerabilities

Democritus Project is a collection of simple, effective, modular, well-tested and well-documented features from Democritus. A security vulnerability exists in Democritus Project d8s-mpeg version 0.1.0 that originates from a potential code execution backdoor inserted by a third party...

WordPress plugin Migration, Backup, Staging: Path traversal vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A path traversal vulnerability exists in th...

IBM Cognos Analytics Cross-site Request Forgery Vulnerability

IBM Cognos Analytics is a suite of business intelligence software from IBM Corporation of the United States. IBM Cognos Analytics versions 11.1.7, 11.2.0 and 11.2.1 contain a security vulnerability that allows an attacker to perform malicious and unauthorized actions transmitted from a trusted us...

Microsoft Visual Studio code injection vulnerability

Microsoft Visual Studio is a family of development tool suites and a fundamentally complete set of development tools from Microsoft Corporation USA that includes most of the tools needed throughout the software life cycle. A code injection vulnerability exists in Microsoft Visual Studio. The...

Contiki-NG security vulnerabilities

Contiki-NG is an open source cross-platform operating system for next-generation IoT Internet of Things devices. A security vulnerability exists in Contiki-NG 4.7 and earlier versions, which stems from a buffer overflow that could be caused when an attacker copies an IPv6 address prefix in the...

F5 BIG-IP Code Issue Vulnerabilities

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A denial-of-service vulnerability exists in the F5 BIG-IP DNS TMUI, which can be exploited by an authenticated attacker with ...

Google Android competition conditions bug

Google Android is a Linux-based open source operating system from the American company Google Google. A security vulnerability exists in Google Android 10, 11, 12, 12L. An attacker exploiting the vulnerability could result in local elevation of privilege...

Microsoft Windows code-related vulnerabilities

Microsoft Windows is a suite of operating systems for use on personal devices from Microsoft Corporation USA. A code issue vulnerability exists in the Microsoft Windows Client/Server Runtime Subsystem. The following products and editions are affected:Windows 10 Version 1809 for 32-bit...

Known XSS vulnerabilities

Known is a social publishing platform open-sourced by Known in the United States. A security vulnerability exists in Known v1.3.1 and below, which stems from an issue with the isSVG function that allows an attacker to execute arbitrary code via a crafted SVG file...

UltraJSON resource management error vulnerability

UltraJSON is an open source, ultra-fast JSON encoder and decoder written in pure C and bundled with Python 3.7+. A resource management error vulnerability exists in versions of UltraJSON prior to 5.4.0, which stems from an error when reallocating a buffer for string decoding, which could cause th...

jsrsasign Data Forgery Vulnerability

The jsrsasign package is an open source cryptographic library from the individual developer Kenji Urashima in Japan. A security vulnerability exists in jsrsasign versions prior to 10.5.25, which stems from a vulnerability to incorrect validation of cryptographic signatures when JWS or JWT...

Broadcom Symantec Messaging Gateway (SMG) information leakage vulnerability

Broadcom Symantec Messaging Gateway Broadcom SMG is an internal email security solution from Broadcom, Inc. An information disclosure vulnerability exists in Broadcom Symantec Messaging Gateway SMG version 10.7, which originates from an authenticated, malicious SMG administrator user being able t...

jmespath.rb security vulnerability

jmespath.rb is the Ruby implementation of JMESPath. A security vulnerability exists in jmespath.rb versions prior to 1.6.1. No information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor's announcement...

PlantUML code vulnerabilities

PlantUML is a component that allows rapid authoring. for generating diagrams from textual descriptions. A security vulnerability exists in PlantUML versions prior to 1.2022.5, which can be exploited by an attacker to bypass URL restrictions and enable server-side request forgery SSRF...

Siemens Desigo PXC4 security vulnerabilities

The Desigo PXC4 building automation controller is designed for HVAC system control. It is a compact device with built-in IOs that can be expanded to meet your needs with additional TX-IO modules.The Desigo PXC5 is a freely programmable controller for BACnet system-level functions such as alarm...

ThinkPHP code issues and vulnerabilities

Top Think Information Technology ThinkPHP is a PHP-based, open source, lightweight web application development framework from China's Top Think Information Technology Company. A security vulnerability exists in ThinkPHP framework versions prior to 6.0.12, which stems from unsafe deserialization i...

NVIDIA Omniverse security vulnerabilities

Nvidia Omniverse Nucleus is the database and collaboration engine for Nvidia's Omniverse. A security vulnerability exists in NVIDIA Omniverse Nucleus and Omniverse Cache that stems from a vulnerability contained in the OpenSSL configuration. An attacker could exploit this vulnerability to cause...

WordPress plugin Caldera Forms has a cross-site scripting vulnerability

WordPress is a blogging platform developed using the PHP language. cross-site scripting vulnerability exists in versions prior to WordPress plugin Caldera Forms 1.9.7. The vulnerability stems from the plugin's failure to validate and escape cf-api parameters before outputting them back to the...

Mattermost resource management error vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. A resource management error vulnerability exists in Mattermost 6.4.1 and earlier versions, which stems from an image proxy component that allocates memory for multiple copies of a proxy image and can be exploited by an...

ImpressCMS SQL injection vulnerability

A SQL injection vulnerability exists in ImpressCMS, a database MySQL-driven, modular content management system, which can be exploited by attackers to read and modify sensitive information from the database used by the application...

Joomla! Code Injection Vulnerabilities

Joomla! is a set of forum components used in the Joomla! content management system. A code injection vulnerability exists in versions 4.0.0 to 4.1.0 of Joomla!, which stems from an HTTP request parameter input validation error. No detailed vulnerability details are available at this time...

HP’s various products have cross-site scripting vulnerabilities

HP Color LaserJet Pro and others are products of Hewlett-Packard HP in the U.S. HP Color LaserJet Pro is a line of color printers.HP PageWide Pro is a line of multifunction printers.HP LaserJet Printers is a line of... A security vulnerability exists in multiple HP products that stems from a lack...

node-ipc security vulnerabilities

node-ipc is a node.js module from the individual developer Brandon Nozaki Miller in the United States. It is used for local and remote inter-process communication and fully supports Linux, Mac and Windows. A security vulnerability exists in node-ipc version 10.1.1 up to and including 10.1.3. The...

Tiny File Manager path traversal vulnerability

Tiny File Manager is a web-based open source file manager. A path traversal vulnerability in the tinyfilemanager.php file upload function in Tiny File Manager 2.4.1 allows remote attackers to upload malicious PHP files to the webroot using a valid user account and achieve code execution on the...

Yokogawa Exaopc Resource Management Error Vulnerability

Yokogawa Electric is a server of Yokogawa Electric Yokogawa, Japan. A security vulnerability exists in CAMS of the HIS Log Server in Yokogawa Electric. The vulnerability stems from uncontrolled consumption of resources by CAMS. The following products and versions are affected: CENTUM CS 3000...

Microweber cross-site scripting vulnerabilities

Microweber is a drag-and-drop online store management system from the Microweber community in the United States. The system includes modules for adding products, images, etc. A cross-site scripting vulnerability exists in Microweber 1.2.11 and earlier versions, which stems from a lack of filterin...

libcaca numerical error vulnerability

libcaca is an open source software library that converts images to color ASCII artwork. libcaca suffers from a denial of service vulnerability that stems from not properly handling incoming error messages, which can be exploited by remote attackers to cause a denial of service...

Autodesk AutoCAD resource management error vulnerability

Autodesk AutoCAD is a suite of professional 3D drawing software from Autodesk, Inc. Autodesk AutoCAD suffers from a Resource Management Error vulnerability that can be exploited by a remote attacker to execute arbitrary code on an affected Autodesk AutoCAD installation. Exploitation of the...

Schneider Electric’s multiple products have vulnerabilities related to information leakage

Schneider Electric Modicon Quantum is a large programmable logic controller PLC for process applications, high availability and safety solutions. Schneider Electric Modicon M340 is a medium-range PLC programmable logic controller for industrial processes and infrastructure. An information...

Google TensorFlow code issues and vulnerabilities

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow suffers from a code issue vulnerability that can be exploited by an attacker to cause a process to crash because it encounters an incorrect StatusOr value and force it to extra...