Django cross-site scripting vulnerabilities

Django is the Django Foundation's set of open source web application framework based on the Python language. The framework includes an object-oriented mapper, view system, template system, etc. Django's Unicorn framework in version 0.35.3 and earlier has a cross-site scripting vulnerability that...

Cisco Expressway Series and Cisco TelePresence Video Communication Server have vulnerabilities related to data spoofing.

Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS are both products of Cisco, Inc.Cisco Expressway Series is software for accessing devices outside the firewall. The software provides simple, highly secure access for users outside the firewall, helping telecommuters wo...

TotoLink A720R security vulnerabilities

The Totolink A720R is a wireless router from Taiwan, China's Gion Electronics Totolink. The TOTOLINK A720R suffers from a command execution vulnerability that stems from improper design or implementation during code development of the network system. The vulnerability can be exploited by an...

Elements-IT HTTP Commander Cross-Site Script Vulnerability

Elements-IT HTTP Commander is a server-hosted, web-based file management solution from Elements-IT Germany. It provides basic functionality for working with files creating, copying, deleting, etc. and many other additional features, such as integration with cloud services, online editing of Offic...

Microsoft Exchange Server Authorization Vulnerability

Microsoft Exchange Server is the United States Microsoft Microsoft company's set of e-mail service program. It provides email access, storage, forwarding, voice mail, email filtering and screening, and other features. An authorization issue vulnerability exists in Microsoft Exchange Server. The...

VMware ESXi Authorization Issues and Vulnerabilities

Vmware VMware ESXi is a server virtualization platform from Vmware that can be installed directly on physical servers. An authorization issue vulnerability exists in VMware ESXi, which stems from a vulnerability in the product's SFCB authentication feature, which allows an attacker to bypass SFCB...

Autodesk Design Review buffer error vulnerability

Autodesk Design Review ADR is a suite of AutoCAD drawing software assist software from Autodesk, Inc. The software supports viewing, marking, measuring, printing, and tracking changes to 2D and 3D design files.Autodesk Design Review is vulnerable to a buffer overflow vulnerability, which could be...

reg-suit Operating System Command Injection Vulnerability

Reg-viz reg-suit is an open source command line interface for reg-viz. Reg-viz reg-suit suffers from a code injection vulnerability that can be exploited by an attacker to execute arbitrary commands...

Foxit PhantomPDF security vulnerabilities

Foxit PhantomPDF is a PDF document reader from the Chinese company Foxit. A security vulnerability exists in Foxit PhantomPDF that stems from a lack of proper validation of user-supplied data, which could allow a remote attacker to execute arbitrary code...

Google Android code vulnerabilities

Google Android is a Linux-based open source operating system from the Google Open Handheld Consortium Google. A denial of service vulnerability exists in Google Android 11. The vulnerability is caused due to a denial of service due to a missing null check in the RenderStruct of...

NVIDIA GPU Display Driver security vulnerabilities

NVIDIA GPU Display Driver is an American NVIDIA driver for interactive support of graphics card display modules in operating systems. A security vulnerability exists in the NVIDIA GPU Display Driver for Windows and Linux, R450 and R460 driver branch, which stems from the use of reference counting...

Apache Solr code issues and vulnerabilities

Apache Solr is a standalone enterprise-class search application server. The Apache Solr server-side request forgery vulnerability can be exploited by an attacker to gain access to an intranet by constructing a request containing a malicious URL...

Aleksa Sarai umoci modifies Open Container images – Input validation error vulnerability

Aleksa Sarai umoci modifies Open Container images is an open source application from Aleksa Sarai, a reference implementation of the OCI image specification that provides users with the ability to create, manipulate, and interact with container images. A security vulnerability exists in Open...

Aruba Access Points: Input validation vulnerability

Aruba Instant is a cloud-hosted controller-less wireless access point. Aruba Instant suffers from an arbitrary file modification vulnerability that can be exploited by an attacker via the Web UI to overwrite arbitrary files with content under their control...

Red Hat Resilient Cross-Site Scripting Vulnerabilities

Red Hat Resteasy is the United States Red Hat Red Hat, a JAX-RS a Java programming language API specification implementation. A cross-site scripting vulnerability exists in Red Hat RESTEasy. An attacker can exploit the vulnerability to launch a reflected XSS attack...

Michael Stepankin OpenID-Connect-Java-Spring-Server code issues and vulnerabilities

Michael Stepankin OpenID-Connect-Java-Spring-Server is a GlobalMichael Stepankin open source application system provides OpenID Connect identity provider and generic OAuth 2.0 authorization server Michael Stepankin OpenID-Connect-Java-Spring-Server suffers from a server-side request forgery...

Microsoft Windows DNS Server Security Vulnerabilities

Microsoft Windows DNS is a domain name resolution service from Microsoft. The Domain Name System DNS is one of the industry-standard suite of protocols that encompasses TCP/IP, and together, DNS clients and DNS servers provide name resolution services for computers and users that map computer nam...

Privoxy input validation vulnerability

privoxy is a web proxy with advanced filtering features. A denial of service vulnerability exists in privoxy versions prior to 3.0.32. An attacker can exploit this vulnerability to crash a program via a specially crafted CGI request...

Prestashop operating system command injection vulnerability

PrestaShop is a full-featured, cross-platform, free and open source e-commerce solution designed for web 2.0. A CSV injection vulnerability exists in PrestaShop versions prior to 1.7.2. An attacker can exploit this vulnerability by using the store search keyword in the admin panel to conduct a CS...

eWeLink mobile application encryption issue vulnerability

IFTTT eWeLink is an IFTTT open source application. It provides remote switching of fans and lights, control of wind speed and dimming of lights. A security vulnerability exists in the eWeLink mobile application, which stems from weak encryption in fast pairing mode, and can be exploited by an...

OpenWrt Security Vulnerabilities

OpenWrt is a Linux operating system for embedded devices. A security vulnerability exists in OpenWrt 19.07.x before 19.07.7, which stems from the fact that when IPv6 is used, a routing loop may be created that generates excessive network traffic between an affected device and the router of its...

Multiple Cisco products have buffer error vulnerabilities

The Cisco RV110W is a Wireless-N VPN firewall, the Cisco RV130 is a multifunction VPN router, the Cisco RV130W is a Wireless-N multifunction VPN router, and the Cisco RV215W is a Wireless-N VPN router. A remote command execution and denial of service vulnerability exists in the Web management...

Beetel router 777VR1 cross-site scripting vulnerability

Beetel 777VR1 is a router from Beetel. A cross-site scripting vulnerability exists in the Beetel router 777VR1, which is caused by an NTP server name in system time and a "keyword" in the URL filter...

Genivia gSOAP code issue vulnerabilities

Genivia gSOAP is a C/C++ software development kit with automatic coding capabilities. A security vulnerability exists in the Genivia gSOAP WS-Security plugin functionality, which allows remote attackers to exploit the vulnerability by submitting a special request, which can be used for...

MediaWiki security vulnerabilities

MediaWiki is a set of free and freely available web-based Wiki engines from the MediaWiki Wikimedia Foundation in the United States. It can be used to deploy in-house knowledge management and content management systems. A security vulnerability exists in MediaWiki version 1.35.1 and prior version...

fastadmin SQL Injection Vulnerability

fastadmin is a set of website backend development framework based on ThinkPHP and Bootstrap. A SQL injection vulnerability exists in fastadmin V1.0.0.20191212 beta, which stems from a malicious parameter that can be passed in the URL admin ajax for SQL injection when a user with administrator...

Google Firebase Js SDK security vulnerabilities

Google Firebase Js Sdk is a client-side code base for connecting to the Firebase backend service from Google. firebase/util versions prior to 0.3.4 contain a prototype contamination vulnerability that originates from the deepExtend function in DeepCopy.ts. An attacker could exploit this...

Axios information leakage vulnerability

Axios is an open-source HTTP client developed by Axios. Versions of Axios prior to 0.32.0 and 1.16.0 have a vulnerability known as information leakage. This vulnerability arises from the Node.js HTTP adapter, which may disclose proxy credentials during redirection, potentially leading to these...

Google Chrome Resource Management Error Vulnerability

Google Chrome is a web browser developed by Google Inc. Versions of Google Chrome prior to 149.0.7827.115 contained a resource management vulnerability. This vulnerability stemmed from a reuse issue within the WebMIDI component, which could allow remote attackers to execute a sandbox escape throu...

Google Chrome Resource Management Error Vulnerability

Google Chrome is a web browser developed by Google. Its main features include providing a fast, secure, and stable browsing experience. Google Chrome has a resource management vulnerability. This vulnerability stems from the Views component failing to properly handle the object lifecycle when...

FPDI Resource Management Vulnerability

FPDI is an open-source PDF reading software developed by Setasign GmbH & Co. KG. Versions of FPDI prior to 2.6.7 contained a resource management vulnerability. This vulnerability allowed attackers to upload malicious PDF files, causing server-side scripts to crash due to memory exhaustion or scri...

Cerebrate input validation vulnerability

Cerebrate is an open-source platform developed by Cerebrate. It serves as an interconnected coordinator for trusted contact information providers and other security tools. Prior to version 1.37 of Cerebrate, there was a vulnerability related to input validation errors. This vulnerability stemmed...

Vim buffer error vulnerability

Vim is an open-source, cross-platform text editor developed by Vim. Versions of Vim prior to 9.2.0565 contained a buffer error vulnerability. This vulnerability stemmed from the updatesnapshot function, which performed a copy of the visible terminal screen into the scroll buffer. During this...

Quest Bot security vulnerabilities

Quest Bot is a multi-functional Discord community management robot developed by Duck Organization. Versions of Quest Bot prior to 1.0.5 contained security vulnerabilities. These vulnerabilities stemmed from the AutoMod deletion process not verifying the server to which the rules belong, potential...

Google Chrome security vulnerabilities

Google Chrome is a web browser developed by the American company Google. Versions of Google Chrome prior to 149.0.7827.115 contained a security vulnerability, which was caused by improper implementation of the password function. This vulnerability could allow remote attackers to bypass site...

MariaDB Server command injection vulnerability

MariaDB Server is an open-source relational database system developed by MariaDB. Versions 10.6.1 to 10.6.26, 10.11.1 to 10.11.17, 11.4.1 to 11.4.11, 11.8.1 to 11.8.7, and 12.3.1 of MariaDB Server have a vulnerability related to operating system command injection. This vulnerability arises from...

WordPress plugin WpEvently has a cross-site request forgeing vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

GitLab authorization issue vulnerabilities

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of the American company GitLab. GitLab Enterprise Edition is a content management system. GitLab Community Edition is a community version of GitLab. Versions of GitLab CE/EE prior to 15.10, 18.10.8, 18.11.5, and 19.0.2...

Weblate code-related vulnerabilities

Weblate is an open-source, copyleft, web-based free software system for continuous localization. Versions of Weblate prior to 2026.6 had code-related vulnerabilities. These vulnerabilities stemmed from the improper handling of some transition IPv6 ranges, multicast addresses, and partially...

Erlang/OTP security vulnerabilities

Erlang/OTP is an open-source JavaScript library for handling exceptions, developed by Erlang/OTP. This library can catch exceptions caused by Node.js’s built-in APIs. Erlang/OTP ssh versions prior to 6.0.0 had a security vulnerability. This vulnerability stemmed from the sshauth module’s use of...

VMware Spring Data REST security vulnerabilities

VMware Spring Data REST is a data interface provided by the American company VMware. It is used to build HTTP resources that drive hypermedia, based on Spring Data repositories. These resources are designed to manage domain models of applications and provide hypermedia-driven services for...

WordPress plugin Easy Image Collage has a cross-site scripting vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...

QNAP QTS improper exception handling vulnerabilities

QNAP Systems QTS and QNAP Systems QuTS hero are software products with data storage and management functions developed by QNAP Systems, a company based in Taiwan, China. There are code-related vulnerabilities in QNAP Systems QTS and QNAP Systems QuTS hero, which stem from null pointer...

ImageMagick buffer error vulnerability

ImageMagick is a set of open-source image processing software developed by the ImageMagick project. It allows for reading, converting, and writing images in various formats. Versions of ImageMagick prior to 6.9.13-48 and 7.1.2-22 contained a buffer error vulnerability. This vulnerability stemmed...

QNAP QTS: Input validation error vulnerability

QNAP Systems QuTScloud is a product of QNAP Systems. It is a cloud-optimized version of the QNAP NAS operating system. QNAP Systems QTS is software with data storage and management capabilities. QNAP Systems QuTS Hero is also software with data storage and management capabilities. Several product...

Fission path traversal vulnerability

Fission is an open-source function deployment framework based on Kubernetes. Versions of Fission prior to 1.25.0 contained a path traversal vulnerability. This vulnerability stemmed from the Unarchive function using filepath.Join to concatenate the archive entry name with the target directory,...

Dulwich path traversal vulnerability

Dulwich is a Python-based Git repository management interface developed by Jelmer Vernooij. Versions of Dulwich from 0.10.0 to 1.2.5 contained a path traversal vulnerability. This vulnerability stemmed from the fact that the path element verifier on Windows allowed filenames that were interpreted...

Plane security vulnerabilities

Plane is an open-source, self-hosted project planning tool developed by Plane OpenSource. Versions of Plane prior to 1.3.1 contained a security vulnerability. This vulnerability stemmed from an oversight in asset authorization across workpaces, allowing any authenticated user to read, copy, delet...

NSA Ghidra Parameter Injection Vulnerability

NSA Ghidra is an open-source reverse-engineering tool developed by the National Security Agency National Security Agency of the United States. Prior to version 12.1 of NSA Ghidra, there was a parameter injection vulnerability. This vulnerability stemmed from improper escaping of the ‘cmd.exe’...

WordPress plugin Simple Link Directory has a cross-site scripting vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...