WordPress plugin: Complianz SQL injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on PHP and MySQL servers.WordPress plugin is an...

WordPress plugin: Importing any XML or CSV file into WordPress – Code injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code injection vulnerability exists in th...

Jenkins Compuware Topaz Utilities Plugin security vulnerabilities

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

Wazuh security vulnerabilities

Wazuh is an Wazuh open source application. Wazuh 3.6.1 and later, 3.13.5 and earlier, 4.0.0 and later, 4.2.7 and earlier, and 4.3.0 and later, 4.3.7 and earlier are vulnerable to a code execution vulnerability that stems from Active Response endpoint fails to properly filter the special elements ...

Kubernetes security vulnerabilities

Kubernetes K8s is an open source system from the Cloud Native Computing Foundation for automating the deployment, scaling, and management of containerized applications. A security vulnerability exists in Kubernetes. No information about this vulnerability is available at this time, so stay tuned ...

Microsoft Windows Common Log File System Driver buffer error vulnerability

The Microsoft Windows Common Log File System Driver is Microsoft's Common Log File System CLFS API that provides a high-performance, general-purpose log file subsystem that can be used by specialized client applications and shared by multiple clients to optimize logging and access. access. A...

Microsoft Windows DPAPI security vulnerabilities

Microsoft Windows is a suite of operating systems for personal devices from the U.S.-based Microsoft Corporation. A security vulnerability exists in Microsoft Windows DPAPI Data Protection Application Programming Interface. The following products and versions are affected: Windows 11 for x64-base...

Flux2 Resource Management Error Vulnerability

Flux2 is a tool from the Cloud Native Computing Foundation that keeps Kubernetes clusters synchronized with their configuration sources. A resource management error vulnerability exists in Flux2 versions prior to v0.0.17 through v0.32.0 and helm-controller versions prior to v0.0.4 through v0.23.0...

WordPress plugin Beaver Builder – Vulnerability in cross-site scripting of the WordPress page builder

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Beaver Builder - A...

MediaWiki resource management error vulnerability

MediaWiki is a suite of free and freely available web-based Wiki engines from the MediaWiki Foundation. The product can be used to deploy internal knowledge management and content management systems. A resource management error vulnerability exists in MediaWiki version 1.38.2, which stems from th...

Mermaid code injection vulnerability

Mermaid is a software application. Create charts and visualizations using text and code. A code injection vulnerability exists in Mermaid versions prior to 1.3.0, prior to 2.0.0-rc1, which can be exploited by an attacker to modify any mermaid block of code with arbitrary code, which will be...

Contiki-NG security vulnerabilities

Contiki-NG is an open source cross-platform operating system for next-generation IoT Internet of Things devices. A security vulnerability exists in Contiki-NG 4.7 and earlier versions, which stems from a buffer overflow that could be caused when an attacker copies an IPv6 address prefix in the...

F5 BIG-IP Code Issue Vulnerabilities

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A denial-of-service vulnerability exists in the F5 BIG-IP DNS TMUI, which can be exploited by an authenticated attacker with ...

GitLab CE/EE security vulnerabilities

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. A security vulnerability exists in GitLab CE/EE that originates from an email...

vm2 security vulnerabilities

vm2 is an advanced virtual machine/sandbox for Node.js by individual developer Patrik Simek in the Czech Republic. to run untrusted code using whitelisted Node built-in modules. A security vulnerability exists in vm2 prior to 3.6.11, which stems from reaching the stack call limit via infinite...

WordPress plugin Sharebar has a cross-site request forgeing vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The WordPress plugin is an application plugin. versions of the WordPress Sharebar plugin prior to 1.4.1 are vulnerable to cross-site request...

Advantech iView SQL injection vulnerability

Advantech Iview is a Simple Network Protocol SNMP based software from Advantech, China, for managing B B SmartWorx devices. information...

Microsoft Windows Local Security Authority Subsystem Service security vulnerability

The Microsoft Windows Local Security Authority Subsystem Service is an internal Microsoft program that runs Windows system security policies. It authenticates users when they log on to a computer standalone or server, manages user password changes, and generates access characters. It also leaves...

WordPress plugin One Click Plugin Updater has a cross-site request forgeing vulnerability.

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

Fastjson code-related vulnerabilities

Fastjson is a Java-based fast JSON parser/generator. versions prior to Fastjson 1.2.83 have a security vulnerability that stems from the ease of bypassing the default autoType off restriction to deserialize untrusted data, which is exploited by attackers to cause code execution...

jmespath.rb security vulnerability

jmespath.rb is the Ruby implementation of JMESPath. A security vulnerability exists in jmespath.rb versions prior to 1.6.1. No information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor's announcement...

Illumina Local Run Manager Access Control Vulnerability

Illumina Local Run Manager is an integrated solution from Illumina, Inc. Designed to create sequencing runs, monitor run status, analyze sequencing data, and view results, Illumina Local Run Manager is vulnerable to an access control error that could be exploited by remote attackers to gain...

SPIP code injection vulnerability

SPIP is a Web-based content publishing system used primarily for online collaboration. A remote code execution vulnerability exists in versions of SPIP prior to 3.2.8, which are primarily used for online collaboration. The vulnerability stems from the oups parameter of /ecrire not properly...

SPIP Cross-Site Scripting Vulnerabilities

SPIP is a web-based content publishing system. A cross-site scripting vulnerability exists in SPIP version 3.1.13 and prior versions, which originates in /spip.php. The vulnerability stems from the program's lack of data validation filtering of user-supplied data and output. An attacker could use...

Siemens Desigo PXC4 security vulnerabilities

The Desigo PXC4 building automation controller is designed for HVAC system control. It is a compact device with built-in IOs that can be expanded to meet your needs with additional TX-IO modules.The Desigo PXC5 is a freely programmable controller for BACnet system-level functions such as alarm...

Gitea security vulnerabilities

Gitea is a lightweight Go-based git service developed by the Gitea community. A security vulnerability exists in Gitea version 1.16.3 that originates from a denial of service DoS via deletion of a configuration file. An attacker can exploit the vulnerability to delete arbitrary files...

FANUC ROBOGUIDE Access Control Vulnerability

FANUC ROBOGUIDE is a robot simulation software from FANUC Japan.ROBOGUIDE v9.40083.00.05 and earlier versions have an access control error vulnerability that stems from not limiting or incorrectly restricting access to resources by unauthorized participants. An attacker could use this vulnerabili...

WordPress plugin Caldera Forms has a cross-site scripting vulnerability

WordPress is a blogging platform developed using the PHP language. cross-site scripting vulnerability exists in versions prior to WordPress plugin Caldera Forms 1.9.7. The vulnerability stems from the plugin's failure to validate and escape cf-api parameters before outputting them back to the...

Laurent Rineau’s CGAL input validation vulnerability

Laurent Rineau CGAL is a Laurent Rineau open source application. Provides access to geometric algorithms in the form of C ++ libraries. A code execution vulnerability exists in Laurent Rineau CGAL, which can be exploited by an attacker to cause out-of-scope reads and type obfuscation via a...

Mattermost resource management error vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. A resource management error vulnerability exists in Mattermost 6.4.1 and earlier versions, which stems from an image proxy component that allocates memory for multiple copies of a proxy image and can be exploited by an...

Delta Electronics DIAEnergie SQL injection vulnerability

Delta Electronics DIAEnergie is an industrial energy management system used to monitor and analyze energy consumption in real time, calculate energy consumption and load characteristics, optimize equipment performance, improve production processes, and maximize energy efficiency.Delta Electronics...

WordPress plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. WordPress plugin is a WordPress application plugin. cross-site scripting vulnerability exists in versions of the WordPress ARI Fancy Lightbox plugin prior to 1.3.9, which stems from a...

SPIP security vulnerabilities

SPIP is a Web-based content publishing system. The system is primarily used for online collaboration. A security vulnerability exists in SPIP versions prior to 3.2.14 and 4.x through 4.0.5 that could allow an attacker to remotely execute arbitrary code...

Luocms SQL Injection Vulnerability

Luocms is an article management system. A SQL injection vulnerability exists in Luocms v2.0, which stems from a lack of validation of external input SQL statements in /admin/link/linkok.php. An attacker could use this vulnerability to execute illegal SQL commands to steal sensitive database data...

Icinga Web 2 path traversal vulnerability

Icinga Web 2 is an application that supports Icinga 2, Icinga Core, and any other IDO database-compatible monitoring backend, developed by the Icinga Project as a next-generation open source monitoring web interface, framework, and command line interface. Icinga Web 2 suffers from a path traversa...

WordPress plugin “Duplicate Page or Post” has a security vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in the WordPress plugin Duplicate Page or Post, which stems from the plugin's...

Samsung Telecom security vulnerabilities

Samsung Telecom is a communication feature for Samsung Samsung mobile devices. Samsung Telecom suffers from an authorization issue vulnerability that stems from a lack of proper privileges for dynamic receivers in Telecom, which could be exploited by an attacker to launch arbitrary activity...

Google Android security vulnerabilities

Google Android is a Linux-based open source operating system from Google, Inc. A security vulnerability exists in Google Android, which stems from allowing untrusted applications to load arbitrary URLs and local files. No details of the vulnerability are currently available...

Swift-NIO-Http2: Input validation error vulnerability

swift-nio-http2 is a SwiftPM project that can be built and tested very easily. A security vulnerability exists in swift-nio-http2 that stems from the fact that programs using swift-nio-http2 are susceptible to a denial-of-service attack, which is caused by a network peer sending a specially craft...

WordPress plugin cross-site scripting vulnerability

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress WP HTML Mail plugin in version 3.0.9 and earlier is vulnerable to a cross-site scripting vulnerability tha...

Microsoft Office code injection vulnerability

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. Commonly used components of this product include Word, Excel, Access, Powerpoint, FrontPage, and so on. A code injection vulnerability exists in Microsoft Office. The following products and version...

WordPress plugin cross-site scripting vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress plugin LiteSpeed Cache versions prior to 4.4.4. The vulnerability stems from the program...

Elgg cross-site scripting vulnerabilities

Elgg is a set of open source social networking engine. The product blogs, file sharing, groups and other features. elgg has a cross-site scripting vulnerability, there are no details of the vulnerability provided...

Atlassian Jira authorization issue vulnerability

Atlassian Jira is a defect tracking system from Atlassian Australia. An access control error vulnerability exists in Atlassian Jira Server and Data Center, which stems from an authentication in the product's /plugins/servlet/project-config/PROJECT/roles endpoint. is corrupted, and an attacker cou...

Oracle MySQL Cluster input validation error vulnerability

MySQL Cluster is a write-scalable, real-time, ACID-compatible transactional database designed to guarantee 99.999% availability. A security vulnerability exists in the Cluster: General component of MySQL Cluster 7.4.33, 7.5.23, 7.6.19, 8.0.26 and earlier versions. An attacker could exploit this...

STB buffer error vulnerability

stb is a single-file public domain library for C/C ++. A buffer error vulnerability exists in stb version 2.26, which stems from a buffer overflow vulnerability in the stbiextendreceive function of the stbimage.h file in the software . An attacker can trigger the vulnerability via a crafted JPEG...

Siemens Ruggedcom Rox Mx5000 resource management error vulnerability

ROX-based VPN endpoints and firewall appliances are used to connect devices that operate in harsh environments, such as electric utility substations and transportation control cabinets. A denial of service vulnerability exists in the Siemens RUGGEDCOM ROX devices, which originates from a dump cra...

IR615 Router Cross-Site Scripting Vulnerability

The IR615 Router is a 4G industrial router from Rimu Technologies, China. IR615 Router has a cross-site scripting vulnerability that could be exploited to hijack user sessions connected to the system...

Django cross-site scripting vulnerabilities

Django is the Django Foundation's set of open source web application framework based on the Python language. The framework includes an object-oriented mapper, view system, template system, etc. Django's Unicorn framework in version 0.35.3 and earlier has a cross-site scripting vulnerability that...

Cisco Expressway Series and Cisco TelePresence Video Communication Server have vulnerabilities related to data spoofing.

Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS are both products of Cisco, Inc.Cisco Expressway Series is software for accessing devices outside the firewall. The software provides simple, highly secure access for users outside the firewall, helping telecommuters wo...