HTSlib input validation vulnerability

HTSlib is a C-language library file developed by samtools. Versions of HTSlib prior to 1.23.1, 1.22.2, and 1.21.1 contained a vulnerability related to input validation errors. This vulnerability stemmed from the lack of verification of the paired reference ID field in the cramdecodeSlice function...

WordPress plugin ExactMetrics – Security vulnerabilities in the Google Analytics dashboard for WordPress

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...

Microsoft Graphics Component code-related vulnerabilities

The Microsoft Graphics Component is a graphics driver component developed by Microsoft Corporation. There are code-related vulnerabilities in the Microsoft Graphics Component. Attackers can exploit these vulnerabilities to cause system denial-of-service attacks. The following products and version...

SAP GUI for Windows code-related vulnerabilities

SAP GUI for Windows is an interface graphical software for Windows developed by the German company SAP. SAP GUI for Windows has a code vulnerability that stems from allowing DLL files to be loaded from any directory within the application. This vulnerability may allow malicious commands to be...

Microsoft Windows SMB Server Authorization Issue Vulnerability

Microsoft Windows SMB Server is a network file sharing protocol developed by Microsoft Corporation. It allows applications on computers to read and write files, as well as to request services from server programs on a computer network. There is an authorization vulnerability in Microsoft Windows...

International Datacasting SFX2100 SuperFlex Satellite Receiver has security vulnerabilities

The International Datacasting SFX2100 SuperFlex Satellite Receiver is a professional broadcast-grade satellite signal receiving device developed by the International Datacasting company. The SFX2100 SuperFlex Satellite Receiver has a security vulnerability, which stems from the globally readable...

WordPress Plugin JS Help Desk – AI-Powered Support & Ticket Tracking System SQL Injection Vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

Tenda AC6 security vulnerabilities

Tenda AC6 is a wireless router produced by the Chinese company Tenda. The Tenda AC6V2.0 V15.03.06.23multi version has a security vulnerability. This vulnerability stems from the lack of size checking in the/goform/WifiWpsStart component, which may lead to a stack overflow issue...

Wren code issue vulnerabilities

Wren is a concurrent scripting language developed by Wren OpenSource. Versions of Wren 0.4.0 and earlier had code-related vulnerabilities. These vulnerabilities stemmed from a null pointer dereferencing issue in the function getByteCountForArguments located in the file src/vm/wrencompiler.c...

SQUIRREL security vulnerabilities

SQUIRREL is a programming language developed by Alberto Demichelis. It is the stable version of SQUIRREL 3.2. Versions of SQUIRREL 3.2 and earlier had security vulnerabilities, which stemmed from uncontrolled recursion in the file squirrel/sqcompiler.cpp...

Johnson Controls Frick Controls Quantum HD security vulnerability

Johnson Controls Frick Controls Quantum HD is a high-end microprocessor control panel designed specifically for industrial refrigeration systems by Johnson Controls. Versions of Johnson Controls Frick Controls Quantum HD prior to 10.22 contain security vulnerabilities. These vulnerabilities stem...

Tenda F453 security vulnerabilities

The Tenda F453 is a wireless router produced by the Chinese company Tenda. Version 1.0.0.3 of the Tenda F453 contains a security vulnerability. This vulnerability stems from the improper handling of the page parameter in the fromSafeEmailFilter function within the httpd component or the...

Mozilla Firefox and Mozilla Thunderbird security vulnerabilities

Mozilla Firefox and Mozilla Thunderbird are both products of the American Mozilla Foundation. Mozilla Firefox is an open-source web browser. Mozilla Thunderbird is an email client software that emerged independently from the Mozilla Application Suite. This software supports IMAP and POP email...

DotCMS security vulnerabilities

DotCMS is an open-source content management system developed by DotCMS Inc., written in Java. It is used to manage content and content-driven websites and applications. DotCMS has a security vulnerability that stems from a sandbox escape issue in the Velocity scripting engine. This vulnerability...

UTT HiPER 520: Operating System Command Injection Vulnerability

UTT HiPER 520 is a high-performance router produced by UTT Corporation. The version 1.7.7-160105 of UTT HiPER 520 contains a vulnerability related to operating system command injection. This vulnerability stems from an error in the handling of the parameter policyNames in the function sub44D264 o...

uTLS security vulnerability

uTLS is an open-source Go language codebase developed by Refraction Networking. Versions 1.6.0 to 1.8.0 of uTLS contain security vulnerabilities. These vulnerabilities stem from inconsistent password selection logic when using GREASE ECH, which may lead to fingerprint mismatches...

NesterSoft WorkTime security vulnerability

NesterSoft WorkTime is a project tracking software developed by the Canadian company NesterSoft. NesterSoft WorkTime has a security vulnerability, which stems from a flaw in the monitoring of the daemon’s update behavior, potentially leading to an increase in local privileges...

WordPress plugin Popup Builder – Create highly converting, mobile-friendly marketing popups security vulnerabilities

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

Go-Etherium security vulnerabilities

go-ethereum is an open-source Ethereum protocol library developed by ethereum. Versions of go-ethereum prior to 1.17.0 contained security vulnerabilities; these vulnerabilities allowed attackers to cause high memory usage by sending specially crafted P2P messages...

NesterSoft WorkTime security vulnerability

NesterSoft WorkTime is a project tracking software developed by the Canadian company NesterSoft. NesterSoft WorkTime has a security vulnerability that stems from unauthorized inspections, which may lead to the resetting of database configurations...

JeecgBoot code issues and vulnerabilities

JeecgBoot is a Java low-code platform developed by Jeecg Corporation, designed for enterprise web applications. Version 3.9.1 of JeecgBoot contains a code vulnerability. This vulnerability stems from a deserialization issue in the importDocumentFromZip function of the component in the file...

Dassault Systèmes SOLIDWORKS eDrawings security vulnerabilities

Dassault Systèmes SOLIDWORKS eDrawings is a collaboration tool provided by Dassault Systèmes, a French company, for viewing, sharing, and annotating 2D/3D design files. There are security vulnerabilities in the SOLIDWORKS eDrawings SOLIDWORKS Desktop 2025 version up to the SOLIDWORKS Desktop 2026...

SAP AS ABAP and SAP NetWeaver ABAP Platform data falsification vulnerabilities

SAP AS ABAP and SAP NetWeaver ABAP Platform are both products of the German company SAP. SAP AS ABAP is a development tool for SAP software. SAP NetWeaver ABAP Platform is an integrated technology platform. Both SAP AS ABAP and SAP NetWeaver ABAP Platform have vulnerabilities related to data...

Tenda TX9 security vulnerabilities

The Tenda TX9 is a wireless router produced by the Chinese company Tenda. The Tenda TX9 versions 22.03.02.10multi and earlier has a security vulnerability. This vulnerability stems from incorrect handling of the deviceList parameter in the function sub4223E0 located in the...

Tanium Client security vulnerabilities

Tanium Client is a terminal proxy software developed by the American company Tanium. Tanium Client has a security vulnerability, which stems from a denial-of-service vulnerability...

Zyxel’s various products have vulnerabilities related to operating system command injection.

Zyxel USG FLEX, among others, are products of the Chinese company Zyxel. Zyxel USG FLEX is a firewall. Zyxel ATP is also a firewall. Zyxel USG FLEX 50W/USG20W-VPN is a series of firewalls. Several Zyxel products have vulnerabilities related to operating system command injection. These...

AList path traversal vulnerability

AList is a file list program developed by Xhofe, a developer from China. Versions of AList prior to 3.57.0 had a path traversal vulnerability. This vulnerability stemmed from vulnerabilities in multiple file operation handlers, which could lead to unauthorized file operations...

Nature Easy Soft Network Technology ZenTao code-related vulnerabilities

Nature Easy Soft Network Technology ZenTao is an open-source project management software developed by Nature Easy Soft Network Technology. This software includes functions such as product management, project management, quality management, and document management. The version 21.7.6-85642 and...

Victor CMS SQL injection vulnerability

Victor CMS is an open-source content management system developed by Victor Alagwu in Nigeria. Version 1.0 of Victor CMS has a SQL injection vulnerability. This vulnerability stems from the post parameter on the post.php file, which can be exploited by SQL injection attacks, potentially leading to...

BigProf Online Inventory Manager Cross-site Scripting Vulnerability

BigProf Online Inventory Manager is an online inventory management system developed by BigProf Corporation. Version 3.2 of BigProf Online Inventory Manager contains a cross-site scripting vulnerability. This vulnerability arises from the group description fields edited by administrators, which ha...

SIGB PMB SQL Injection Vulnerability

SIGB PMB is an open-source integrated library management system developed by SIGB Corporation. Version 5.6 of SIGB PMB contains a SQL injection vulnerability. This vulnerability stems from the logid parameter in the management download script, which allows for SQL injections. As a result,...

Malcontent security vulnerabilities

Malcontent is a supply chain attack detection tool developed by Chainguard. Versions prior to 1.20.3 of Malcontent contain security vulnerabilities. These vulnerabilities arise from the possibility of exposing Docker registry credentials during the scanning of specially crafted OCI image referenc...

Jirafeau cross-site scripting vulnerability

Jirafeau is a simple method for uploading files developed by Jérôme Jutteau. Jirafeau has a cross-site scripting vulnerability; this vulnerability arises from the ability to bypass preview restrictions by sending HTTP requests with invalid MIME types, potentially leading to cross-site scripting...

Google Chrome security vulnerabilities

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from an information disclosure vulnerability, which is caused due to improper implementation in the backend fetch AP. An attacker can exploit the vulnerability to disclose cross-origin data...

Orval security vulnerabilities

Orval is an open-source interface development tool developed by Orval. Versions of Orval from 7.10.0 to 8.0.2 contained security vulnerabilities. These vulnerabilities were caused by the x-enumDescriptions field not being properly escaped and embedded, which could allow arbitrary code to execute...

LigeroSmart code injection vulnerability

LigeroSmart is an open-source management platform developed by LigeroSmart. Versions of LigeroSmart 6.1.26 and earlier contained a code injection vulnerability. This vulnerability stemmed from incorrect handling of the parameter “TicketID” in the file /otrs/index.pl?Action=AgentTicketZoom, which...

Microsoft Windows Virtualization-Based Security Enclave Security Vulnerabilities

Microsoft Windows Virtualization-Based Security Enclave Microsoft Windows VBS Enclave is a software-based trusted execution environment in the address space of host applications from Microsoft Corporation USA. A security vulnerability exists in Microsoft Windows Virtualization-Based Security...

TYPO3 CMS security vulnerabilities

TYPO3 CMS is a content management system from TYPO3 open source. A security vulnerability exists in TYPO3 CMS that stems from the utilization of the defVals parameter that can bypass field-level access checks and may result in the insertion of arbitrary data into exclusion fields prohibited by a...

CTCMS code injection vulnerability

CTCMS Chibi CMS is a video content management system from China Chibi CMS CTCMS company. A code injection vulnerability exists in CTCMS 2.1.2 and earlier versions, which stems from the improper handling of the parameter CjAdd/CjEdit by the unknown function in the file /ctcms/libs/CtConfig.php,...

iPrint&Scan Brother security vulnerability

Brother iPrint&Scan is a free application from Brother that allows you to print and scan from your Android device. A security vulnerability exists in Brother iPrint&Scan version 6.13.7 and earlier, which stems from improper use of the external cache directory and could result in files being...

Open-Xchange OX App Suite security vulnerabilities

Open-Xchange OX App Suite is a productivity application suite from Open-Xchange Germany. A security vulnerability exists in Open-Xchange OX App Suite that originates from malicious email content executable script code that could lead to the disclosure of sensitive information...

WordPress plugin “Enable SVG, WebP, and ICO Upload” has code vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which provides the ability to host personal blogs on PHP and MySQL-based servers. A co...

Ubiquiti UniFi Access Application security vulnerabilities

Ubiquiti UniFi Access Application is an access control system from Ubiquiti, Inc. A security vulnerability exists in the Ubiquiti UniFi Access Application versions 3.3.22 through 3.4.31, which stems from an exposed management API and lack of proper authentication, which could lead to unauthorized...

Eclipse ThreadX NetX Duo security vulnerabilities

Eclipse ThreadX NetX Duo is an IPv4 and IPv6 dual network stack for Eclipse ThreadX open source. A security vulnerability exists in Eclipse ThreadX NetX Duo versions prior to 6.4.4, which stems from the processing of IPv4 packets with a timestamp option that can lead to out-of-bounds reads...

QuickJS security vulnerabilities

QuickJS is a small and embeddable Javascript engine open-sourced by QuickJS. A security vulnerability exists in QuickJS, which stems from the jsprintobject function not properly handling array size changes during callbacks when printing arrays and collection objects, potentially leading to reuse...

WordPress plugin: Importing any XML, CSV, or Excel file into WordPress – Code-related vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in the...

ELADMIN Authorization Issue Vulnerability

ELADMIN is a backend management system for elunez individual developers. An authorization issue vulnerability exists in ELADMIN 2.7 and earlier versions, which stems from an improper authorization issue in the /api/logs/error/1 file...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an unrestricted id mapping change that could lead to elevation of privilege...

Google Pixel security vulnerabilities

Google Pixel is a smartphone from the American company Google Google. Google Pixel has a security vulnerability that can be exploited by an attacker that may lead to physical elevation of privileges...

Agiloft security vulnerabilities

Agiloft is a contract management platform from Agiloft Corporation in the United States. A security vulnerability exists in Agiloft Release 28 that stems from the use of default credentials by multiple accounts, which could lead to local elevation of privilege...