Automattic Mongoose 安全漏洞

Automattic Mongoose is a MongoDB object modeling tool for asynchronous environments. A security vulnerability exists in Automattic Mongoose versions prior to 6.4.6, which stems from the Schema.path function being susceptible to prototype contamination when setting up schema objects, which can be...

Jenkins Plugin Deployer Framework 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

IBM App Connect Enterprise 信任管理问题漏洞

IBM App Connect Enterprise is an operating system from IBM Corporation of the U.S.A. IBM App Connect Enterprise combines existing industry-trusted IBM Integration Bus technology with IBM App Connect Professional and new cloud-native technologies to IBM App Connect Enterprise combines existing...

UNISOC chipset 缓冲区错误漏洞

UNISOC chipset is an integrated circuit chipset from China's Zilight Spreadtrum UNISOC. A buffer error vulnerability exists in the UNISOC chipset. No information about this vulnerability is available at this time, so please stay tuned to CNNVD or the vendor's announcement...

IBM Spectrum Copy Data Management 授权问题漏洞

IBM Spectrum Copy Data Management, an IBM company that modernizes, simplifies, and automates data center copy management processes, has an access control error in IBM Spectrum Copy Data Management Admin versions 2.2.0.0 through 2.2.15.0. vulnerability, which stems from a lack of proper session...

Illumina Local Run Manager 访问控制错误漏洞

Illumina Local Run Manager is an integrated solution from Illumina, Inc. Designed to create sequencing runs, monitor run status, analyze sequencing data, and view results, Illumina Local Run Manager is vulnerable to an access control error that could be exploited by remote attackers to gain...

elitecms SQL注入漏洞

Elitecms is a web content management by elitecms India. elitecms version 1.01 has a SQL injection vulnerability, which originates from the /admin/editsidebar.php page page parameter lack of validation of external input SQL statements, an attacker can use this vulnerability to execute illegal SQL...

ZKEACMS 跨站脚本漏洞

ZKEACMS v3.5.2 is a cross-site scripting vulnerability that can be exploited by attackers to inject malicious JavaScript programs to steal other users' cookies, etc...

SPIP 跨站脚本漏洞

SPIP is a web-based content publishing system. A cross-site scripting vulnerability exists in SPIP version 3.1.13 and prior versions, which originates in /spip.php. The vulnerability stems from the program's lack of data validation filtering of user-supplied data and output. An attacker could use...

Hashicorp Vault 安全漏洞

Hashicorp HashiCorp Vault is a private key access management tool from Hashicorp USA. A security vulnerability exists in HashiCorp Vault and Vault Enterprise versions 1.10.0 through 1.10.2, which stems from a misconfiguration and a forced MFA login after a server reboot...

NVIDIA Jetson 缓冲区错误漏洞

NVIDIA Jetson is an embedded system development module from NVIDIA Corporation. The NVIDIA Jetson Linux Driver Package suffers from a buffer error vulnerability that stems from insufficient validation of untrusted data, which could be exploited by a local attacker to cause a memory buffer overflo...

OWASP ESAPI 路径遍历漏洞

OWASP ESAPI is a free, open source, web application security control library that makes it easier for programmers to write lower-risk applications. A path traversal vulnerability exists in ESAPI versions prior to 2.3.0.0, which stems from the default implementation of...

Maccms 跨站脚本漏洞

Maccms is a PHP-based film and television content management system CMS. v10 version of Maccms contains a cross-site scripting vulnerability, which originates from the lack of user-supplied data and output data validation filtering in the select and input parameters in...

Delta Electronics DIAEnergie SQL注入漏洞

Delta Electronics DIAEnergie is an industrial energy management system used to monitor and analyze energy consumption in real time, calculate energy consumption and load characteristics, optimize equipment performance, improve production processes, and maximize energy efficiency.Delta Electronics...

Yokogawa Electric 信任管理问题漏洞

Yokogawa Electric is a server of Yokogawa Electric Yokogawa, a Japanese company. A security vulnerability exists in Yokogawa Electric. The following products and versions are affected: CENTUM VP versions R5.01.00 through R5.04.20 and R6.01.00 through R6.08.00, Exaopc versions R3.72.00 through...

Stripe CLI 操作系统命令注入漏洞

Stripe CLI is a command line tool for the Stripe e-commerce platform from Stripe Ireland. Stripe CLI suffers from an operating system command injection vulnerability that can be exploited by an attacker to run arbitrary code in the current user's environment...

Autodesk AutoCAD 资源管理错误漏洞

Autodesk AutoCAD is a suite of professional 3D drawing software from Autodesk, Inc. Autodesk AutoCAD suffers from a Resource Management Error vulnerability that can be exploited by a remote attacker to execute arbitrary code on an affected Autodesk AutoCAD installation. Exploitation of the...

Kofax Printix Secure Cloud Print Management 代码注入漏洞

Kofax Printix Secure Cloud Print Management is a cloud-based print management software from Kofax USA that is flexible, scalable and easy to use. Manage and maintain complex print environments anytime, anywhere with all the modern printing features users and organizations need. A code injection...

microweber 安全漏洞

Microweber is an online store management system from the US Microweber community that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. Microweber has a security vulnerability, and no details of the vulnerability are available at this time...

Qualcomm 多款产品安全漏洞

A Qualcomm chip is a chip from Qualcomm Incorporated USA. A way of miniaturizing circuits mainly semiconductor devices, but also passive components, etc., and is manufactured from time to time on the surface of semiconductor wafers. A security vulnerability exists in a number of Qualcomm products...

Google TensorFlow 代码问题漏洞

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow suffers from a code issue vulnerability that can be exploited by an attacker to cause a process to crash because it encounters an incorrect StatusOr value and force it to extra...

vditor 跨站脚本漏洞

vditor is a browser-based Markdown editor that supports WYSIWYG, on-the-fly rendering similar to Typora, and split-screen preview modes. vditor suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data by the web application. An attacker...

WordPress plugin 跨站脚本漏洞

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress WP HTML Mail plugin in version 3.0.9 and earlier is vulnerable to a cross-site scripting vulnerability tha...

Huawei 多款产品缓冲区错误漏洞

The Huawei CloudEngine 12800 is a 12800 series data center switch, and the Huawei Cloudengine 5800 is a 5800 series data center switch. Buffer overflow vulnerability exists in several Huawei products. The vulnerability stems from insufficient validation of certain parameters in messages, which ca...

Microsoft Office 代码注入漏洞

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. Commonly used components of this product include Word, Excel, Access, Powerpoint, FrontPage, and so on. A code injection vulnerability exists in Microsoft Office. The following products and version...

WordPress plugin 跨站脚本漏洞

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress plugin LiteSpeed Cache versions prior to 4.4.4. The vulnerability stems from the program...

Microsoft Windows Codecs Library 代码注入漏洞

The Web Media Extensions package extends Microsoft Edge and Windows 10 to support open source formats commonly found on the Web.A remote code execution vulnerability exists in Microsoft Web Media Extensions. An attacker could exploit this vulnerability to execute code on the target host...

WordPress 代码问题漏洞

WordPress is a blogging platform developed using the PHP language, which supports setting up personal blogging sites on PHP and MySQL servers. WordPress plugin Popular Posts 5.3.2 and previous versions are vulnerable to arbitrary file uploads. An attacker could exploit the vulnerability to upload...

Django 跨站脚本漏洞

Django is the Django Foundation's set of open source web application framework based on the Python language. The framework includes an object-oriented mapper, view system, template system, etc. Django's Unicorn framework in version 0.35.3 and earlier has a cross-site scripting vulnerability that...

Nltk 代码问题漏洞

Nltk is a natural language toolkit. It is used to support research and development in natural language processing. A code issue vulnerability exists in nltk that stems from an error in certain regular expressions in the product. An attacker could cause a denial of service via this vulnerability...

Apache Zeppelin 命令注入漏洞

Apache Zeppelin is a Web-based open source notebook application from the Apache Foundation. The application supports interactive data analysis and collaborative documentation. Apache Zeppelin 0.9.0 and earlier versions contain a command injection vulnerability that could be exploited by an attack...

Google TensorFlow数字错误漏洞

Google TensorFlow is an end-to-end open source machine learning platform. A denial of service vulnerability exists in Google TensorFlow. A local attacker could exploit this vulnerability to cause a denial of service condition...

OpenStack 输入验证错误漏洞

OpenStack is a cloud platform management program developed by the National Aeronautics and Space Administration NASA in collaboration with Rackspace in the United States. Openstack Nova suffers from an input validation error vulnerability that allows remote attackers to exploit the vulnerability ...

VMware ESXi 缓冲区错误漏洞

VMware ESXi is a server virtualization platform from VMware that can be installed directly on physical servers. A buffer error vulnerability exists in VMware ESXi, which originates from an out-of-bounds read of heap memory by OpenSLP in the product, which can be triggered by malicious access on...

QEMU 缓冲区错误漏洞

QEMU Quick Emulator is a set of simulation processor software by Fabrice Bellard, a French individual developer. The software is fast and cross-platform. A security vulnerability exists in QEMU for ATI VGA, which stems from a memory access out-of-bounds flaw found in QEMU's ATI VGA device...

IBM AIX 输入验证错误漏洞

IBM AIX is an open standards-based UNIX operating system developed by IBM for the IBM Power architecture. IBM AIX is vulnerable to an input validation error that allows a local user with higher group privileges to exploit a vulnerability in the lpd daemon. No detailed vulnerability details are...

Cisco Finesse 输入验证错误漏洞

Cisco Finesse is a next-generation seat and supervisor desktop designed to provide a collaborative experience for the diverse communities that interact with your customer service organization. An open redirection vulnerability exists in the Web management interface of Cisco Finesse 12.61 and...

Supsystic WordPress plugin 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists i...

PHPMailer 代码问题漏洞

PHPMailer is a PHP class library for sending emails. PHPMailer is vulnerable to a code issue that allows object injection via addAttachment with a UNC pathname via Phar deserialization. No details of the vulnerability are currently available...

NVIDIA GPU Display Driver 安全漏洞

NVIDIA GPU Display Driver is an American NVIDIA driver for interactive support of graphics card display modules in operating systems. A security vulnerability exists in the NVIDIA GPU Display Driver for Windows and Linux, R450 and R460 driver branch, which stems from the use of reference counting...

Wordpress Modern Events Calendar Lite 代码问题漏洞

Wordpress Modern Events Calendar Lite is an open source application plugin for Wordpress. This plugin is the best tool for managing event websites. A code issue vulnerability exists in the WordPress Modern Events Calendar Lite plugin before 5.16.5, which stems from an arbitrary file upload that...

Microsoft Windows DNS 服务器安全漏洞

Microsoft Windows DNS is a domain name resolution service from Microsoft. The Domain Name System DNS is one of the industry-standard suite of protocols that encompasses TCP/IP, and together, DNS clients and DNS servers provide name resolution services for computers and users that map computer nam...

Rust 安全漏洞

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in mio crate for Rust prior to version 0.7.6, which stems from an incorrect expectation of the std::net::SocketAddr memory representation. No details of the vulnerability are...

axios 信息泄露漏洞

Axios is an open-source HTTP client developed by Axios. Versions of Axios prior to 0.32.0 and 1.16.0 have a vulnerability known as information leakage. This vulnerability arises from the Node.js HTTP adapter, which may disclose proxy credentials during redirection, potentially leading to these...

Vim 缓冲区错误漏洞

Vim is an open-source, cross-platform text editor developed by Vim. Versions of Vim prior to 9.2.0565 contained a buffer error vulnerability. This vulnerability stemmed from the updatesnapshot function, which performed a copy of the visible terminal screen into the scroll buffer. During this...

Quest Bot 安全漏洞

Quest Bot is a multi-functional Discord community management robot developed by Duck Organization. Versions of Quest Bot prior to 1.0.4 contained security vulnerabilities. These vulnerabilities stemmed from the fact that audit commands did not disable mention resolution, allowing administrators...

Google Chrome 资源管理错误漏洞

Google Chrome is a web browser developed by Google Inc. Versions of Google Chrome prior to 149.0.7827.115 contained a resource management vulnerability. This vulnerability stemmed from a reuse issue within the WebMIDI component, which could allow remote attackers to execute a sandbox escape throu...

vim 代码注入漏洞

Vim is an open-source, cross-platform text editor developed by Vim developers. Prior to Vim 9.2.0597, there was a code injection vulnerability. This vulnerability stemmed from Python’s omni-completion feature, which used exec to execute function and class definitions reconstructed from the curren...

CyberArk Idira Privileged Session Manager 路径遍历漏洞

CyberArk Idira Privileged Session Manager is a privileged session management platform developed by the American company CyberArk. Versions of CyberArk Idira Privileged Session Manager prior to 15.0.3, 14.6.3, 14.2.5, and 14.0.5 contained a path traversal vulnerability. This vulnerability stemmed...

ABB Freelance 安全漏洞

ABB Freelance is a distributed control system developed by the Swiss company ABB. There is a security vulnerability in ABB Freelance, which stems from an authentication bypass exploit. The following versions are affected: Version 2013, Version 2013 SP1, Version 2016, Version 2016 SP1, Version 201...