Devolutions Server security vulnerabilities

Devolutions Server is an application system developed by the Canadian company Devolutions. It provides a fully functional solution for shared accounts and password management. Versions of Devolutions Server prior to 2025.3.14.0 contained security vulnerabilities. These vulnerabilities stemmed fro...

D-Link DWR-M960 security vulnerability

The D-Link DWR-M960 is a router from China-based AUO D-Link. A buffer overflow vulnerability exists in the D-Link DWR-M960 formDdns file. The vulnerability stems from a misbehavior of the function sub4648F0 in the file /boafrm/formDdns in the DDNS Settings Handler component with respect to the...

Wren buffer error vulnerability

Wren is a concurrent scripting language developed by Wren OpenSource. Versions of Wren 0.4.0 and earlier contained a buffer error vulnerability, which stemmed from an out-of-bounds read in the peekChar function found in the src/vm/wrencompiler.c file...

WordPress plugin MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar has a security vulnerability.

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There ar...

InvoicePlane cross-site scripting vulnerability

InvoicePlane is an open-source application developed by InvoicePlane. It provides a self-hosted open-source tool for managing your quotes, invoices, customers, and payments. Version 1.7.0 of InvoicePlane contains a cross-site scripting vulnerability, which stems from improper handling of the...

Smarteye iSmartViewPro has security vulnerabilities

Smarteye iSmartViewPro is a remote monitoring application for webcams developed by Smarteye Company in China. Version 1.3.34 of Smarteye iSmartViewPro contains a security vulnerability. This vulnerability allows attackers to cause the application to crash by entering the camera ID field,...

InvoicePlane cross-site scripting vulnerability

InvoicePlane is an open-source application developed by InvoicePlane. It provides a self-hosted open-source tool for managing your quotes, invoices, customers, and payments. Version 1.7.0 of InvoicePlane contains a cross-site scripting vulnerability. This vulnerability allows authenticated users ...

OpenSatKit security vulnerabilities

OpenSatKit is an open-source application development toolkit developed by OpenSatKit. Version 2.2.1 of OpenSatKit contains a security vulnerability. This vulnerability stems from the use of an insecure sprintf call in the EventErrStr buffer, which may lead to a stack buffer overflow...

GIMP security vulnerabilities

GIMP is an open-source bitmap image editor developed by the GIMP team. GIMP has a security vulnerability that can lead to a denial-of-service attack due to specially crafted PSP image files...

Celestial AbsoluteTelnet Security Vulnerability

Celestial AbsoluteTelnet is a Telnet/SSH terminal client software developed by the American company Celestial. Version 11.12 of Celestial AbsoluteTelnet contains a security vulnerability, which stems from improper handling of the license name input field. This vulnerability could lead to...

Melange operating system command injection vulnerability

Melange is a software developed by Chainguard for building APKs from source code. Versions of Melange from 0.10.0 to 0.40.3 had an operating system command injection vulnerability. This vulnerability stemmed from the patch pipeline incorrectly referencing or verifying input-derived values when...

RIOT buffer error vulnerability

RIOT is an open-source operating system designed for the Internet of Things. Versions of RIOT prior to 2025.10 contain a buffer error vulnerability. This vulnerability stems from multiple out-of-bounds read vulnerabilities, which may lead to reading adjacent memory locations or causing device...

Zendesk SweetHawk Survey cross-site scripting vulnerability

Zendesk SweetHawk Survey is a satisfaction survey plugin developed by Zendesk, a Japanese company. Version 1.6 of Zendesk SweetHawk Survey contains a cross-site scripting vulnerability. This vulnerability stems from a storage-based cross-site scripting issue in the ticket submission feature, whic...

Samsung MagicINFO 9 Server security vulnerabilities

SAMSUNG MagicINFO 9 Server is an enterprise-level digital signage content management and device monitoring platform developed by South Korean company Samsung. Previous versions of SAMSUNG MagicINFO 9 Server, such as 21.1090.1, contained security vulnerabilities. These vulnerabilities stemmed from...

D-Link DWR-M961 has a command injection vulnerability

The D-Link DWR-M961 is a router produced by D-Link Corporation. Version 1.1.47 of the D-Link DWR-M961 contains a command injection vulnerability. This vulnerability arises from incorrect handling of the parameter fotaurl in the file /boafrm/formLtefotaUpgradeQuectel, which may lead to command...

Seroval security vulnerabilities

Seroval is a formatted Java library developed by Alexis H. Munsayac. Versions of Seroval 1.4.0 and earlier contain security vulnerabilities, which stem from improper input validation during JSON deserialization, potentially leading to prototype pollution...

Sandboxie Plus code issue and vulnerabilities

Sandboxie Plus is an open-source Windows sandboxing tool developed by Sandboxie Plus. Version 0.7.2 of Sandboxie Plus has a code vulnerability; this vulnerability stems from a service path in the SbieSvc service that lacks quotation marks, which may allow local attackers to execute code with...

Oracle Virtualization security vulnerabilities

Oracle Virtualization is a virtualization solution developed by Oracle, a company in the United States. This product is used for unified management of the entire hardware and software system, from applications to disks, enabling virtualization from desktops to data centers. VM VirtualBox is one o...

SmarterTools SmarterTrack security vulnerabilities

SmarterTools SmarterTrack is a customer service software developed by SmarterTools Corporation. It can improve customer service and reduce support costs. Version 7922 of SmarterTools SmarterTrack contains a security vulnerability. This vulnerability stems from the Chat Management search form, whi...

Microsoft Windows SMB Server race condition vulnerability

Microsoft Windows SMB Server is a network file-sharing protocol from Microsoft. It allows applications on a computer to read and write files and request services from server programs on a computer network. A denial of service vulnerability exists in Microsoft Windows SMB Server, which is caused d...

TYPO3 CMS security vulnerabilities

TYPO3 CMS is a content management system from TYPO3 open source. A security vulnerability exists in TYPO3 CMS that stems from the utilization of the defVals parameter that can bypass field-level access checks and may result in the insertion of arbitrary data into exclusion fields prohibited by a...

SLiMS 9: Bulian SQL Injection Vulnerability

SLiMS 9 Bulian is a free and open source software from the SLiMS community in Indonesia. It is used for library resource management e.g. books, journals, digital files and other library materials and administration. An SQL injection vulnerability exists in SLiMS 9 Bulian version 9.0.0, which stem...

react-router Cross-Site Request Forgery Vulnerability

react-router is a Remix open source declarative routing for React. A cross-site request forgery vulnerability exists in react-router version 7.11.0 and earlier, which stems from the vulnerability to a cross-site request forgery attack against document POST requests when using a server-side route...

Yonyou KSOA SQL injection vulnerability

Yonyou KSOA is an enterprise management software from China's UFIDA Yonyou company. A SQL injection vulnerability exists in Yonyou KSOA version 9.0, which originates from the incorrect operation of the parameter zpjhid in the file /kp/PrintZPYG.jsp, which could lead to a SQL injection attack...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from premature initialization of the GPIO controller, which could lead to a race condition...

wolfSSL security vulnerabilities

wolfSSL CyaSSL is a small, portable embedded SSL programming library for use by embedded systems developers from wolfSSL, Inc. in the United States. A security vulnerability exists in wolfSSL that stems from compiler optimizations and time-side channels introduced by CPU architectural limitations...

Sports Club Management System Vulnerability Due to PHP SQL Injection

Sports Club Management System in php is a sports club management system by Darkseid Personal Developer. A SQL injection vulnerability exists in Sports Club Management System in php version 1.0, which stems from an incorrect manipulation of the parameter loginid in the file...

OpenML Frontend security vulnerabilities

OpenML Frontend is an OpenML Frontend page from OpenML Open Source. A security vulnerability exists in OpenML Frontend version v2.0.20241110, which stems from the use of predictable MD5-based tokens that could lead to account takeover...

DataX-Web Access Control Vulnerability

DataX-Web is a distributed data synchronization tool developed on top of DataX by WeiYe's personal developer. An access control error vulnerability exists in DataX-Web 2.1.2 and earlier versions, which stems from incorrect operation of the function remove/update/pause/start/triggerJob in the...

Qualcomm Chipsets: Input validation error vulnerability

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. An input validation error vulnerability exists in Qualcomm Chipsets, which arises from a memory corruption when processing large input data from a communication interface from a remote source...

Several WordPress plugin products have security vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which provides the ability to host personal blog sites on PHP and MySQL-based...

Ubiquiti UniFi Access Application security vulnerabilities

Ubiquiti UniFi Access Application is an access control system from Ubiquiti, Inc. A security vulnerability exists in the Ubiquiti UniFi Access Application versions 3.3.22 through 3.4.31, which stems from an exposed management API and lack of proper authentication, which could lead to unauthorized...

Pi-hole Web Interface Cross-Site Script Vulnerability

Pi-hole Web Interface is a dashboard web interface from Pi-hole open source. A cross-site scripting vulnerability exists in Pi-hole Web Interface versions prior to 6.3, which stems from improper input cleanup in the Address field and could lead to a cross-site scripting attack...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a mismatch in the return type of the netiucvtx function, which could lead to a kernel panic or thread...

AMTT Hotel Broadband Operation System Security Vulnerabilities

AMTT Hotel Broadband Operation System is a hotel broadband operation system from China-based AmTech Century AMTT. A security vulnerability exists in the AMTT Hotel Broadband Operation System, which originates from an unauthenticated command injection in the /manager/radius/serverping.php endpoint...

DCMTK security vulnerabilities

DCMTK is a collection of libraries and applications that implement most of the DICOM standards from the DCMTK open source. Software for inspecting, building, and converting DICOM image files, processing offline media, sending and receiving images over a network connection, and demonstrating image...

NetBird VPN security vulnerability

NetBird VPN is an open source proxy software from NetBird. A security vulnerability exists in NetBird VPN that stems from the failure to remove or change the default administrator account password created by ZITADEL during installation...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a double release of blkmqtags, which could cause the kernel to crash...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an unchecked codairamalloc return value that could lead to a null pointer dereference...

Cisco Wireless LAN Controller security vulnerabilities

Cisco Wireless LAN Controller WLC is a wireless LAN controller product from Cisco USA. The product provides security policy, intrusion detection, and other functions in a wireless LAN. A security vulnerability exists in Cisco Wireless LAN Controller that stems from insufficient validation of 802....

RPi-Jukebox-RFID code injection vulnerability

RPi-Jukebox-RFID is a contactless jukebox for the Raspberry Pi from the individual developer Micz Flor in Germany. It can play audio files, playlists, podcasts, web streams and spotify triggered by RFID cards. A code injection vulnerability exists in RPi-Jukebox-RFID version 2.8.0 and earlier,...

Itsourcecode POS Point of Sale System Code Injection Vulnerability

POS Point of Sale System is a pos point of sale system. POS Point of Sale System suffers from a cross-site scripting vulnerability that originates from the lack of effective filtering and escaping of user-supplied data in the scripts parameter of the...

MetaCPAN CGI::Simple security vulnerability

MetaCPAN CGI::Simple is a module for Perl from the MetaCPAN Foundation. A security vulnerability exists in MetaCPAN CGI::Simple versions prior to 1.282, which stems from HTTP response splitting and could lead to reflective cross-site scripting or open redirects...

F5 NGINX Plus and F5 NGINX Open Source have buffer error vulnerabilities

F5 NGINX Plus and F5 NGINX Open Source are both products of F5 Corporation, U.S.A. F5 NGINX Plus is a software-based application delivery platform.F5 NGINX Open Source is a high-performance web server, reverse proxy server, load balancer, and API gateway. A buffer error vulnerability exists in F5...

Microsoft Windows Ancillary Function Driver for WinSock code-related vulnerabilities

Microsoft Windows Ancillary Function Driver for WinSock is a helper function driver for Winsock from Microsoft Corporation USA. A code issue vulnerability exists in Microsoft Windows Ancillary Function Driver for WinSock. An attacker could exploit the vulnerability to elevate privileges. The...

Intel SPS and Intel CSME security vulnerabilities

Intel SPS and Intel CSME are both products of Intel Corporation Intel, U.S.A. Intel SPS is a server platform service. Intel CSME is a converged security management engine. A security vulnerability exists in Intel SPS and Intel CSME that stems from an observable time difference that could lead to...

POCO security vulnerabilities

POCO is a cross-platform C++ library open-sourced by POCO. It is used to build web and internet based applications that run on desktop, server, mobile, IoT and embedded systems. A security vulnerability exists in POCO v1.14.1-release that stems from a weak encryption issue...

Portábilis i-Educar code injection vulnerability

Portábilis i-Educar is an application from Portábilis. It can easily help you with basic and technical education. A code injection vulnerability exists in Portábilis i-Educar version 2.10, which stems from improper handling of the parameter nome in the file /module/RegraAvaliacao/edit, which coul...

Agenzia Impresa EccoBook security vulnerabilities

Agenzia Impresa EccoBook is a ledger software from Agenzia Impresa, Italy. A security vulnerability exists in Agenzia Impresa Eccobook v2.81.1 and earlier versions, which stems from an insecure direct object reference in the PdfHandler component that could lead to the reading of confidential...

XORUX LPAR2RRD security vulnerability

XORUX LPAR2RRD is a server performance monitoring platform from the Czech company XORUX. A security vulnerability exists in XORUX LPAR2RRD that stems from improper privilege management and could lead to process termination...