Microsoft Word 安全漏洞

Microsoft Word is a word processing software in the Office suite of the U.S. company Microsoft Microsoft. An information disclosure vulnerability exists in Microsoft Word, which can be exploited by attackers to obtain sensitive information...

Abode Iota 格式化字符串错误漏洞

Abode Iota is a reliable Diy home security system from Abode. A formatting string error vulnerability exists in Abode Iota versions 6.9X and 6.9Z, which stems from the fact that an attacker can send an authenticated, malicious HTTP request to its web interface/action/wirelessConnect functionality...

Cisco Enterprise NFV Infrastructure Software 数据伪造问题漏洞

Cisco Enterprise NFV Infrastructure Software NFVIS is a suite of NVF infrastructure software platforms from Cisco. The platform enables full lifecycle management of virtualized services through a central orchestrator and controller. Cisco Enterprise NFV Infrastructure Software is vulnerable to a...

SAMSUNG TizenRT 安全漏洞

TizenRT is an application system. A lightweight RTOS-based platform that supports low-end IoT devices. SAMSUNG TizenRT suffers from a security vulnerability that originates in l2packetreceivetimeout in wpasupplicant/src/l2packet/l2packetpcap.c Missing checking of the return value of pcapdispatch,...

Cargo 资源管理错误漏洞

Cargo is a Rust package manager open-sourced by The Rust Programming Language. A resource management error vulnerability exists in versions of Cargo prior to 0.65.0, which stems from the extraction of a malicious crate that can fill the filesystem...

TYPO3 跨站脚本漏洞

TYPO3 is a free and open source content management system framework CMS/CMF from TYPO3 Association in Switzerland. A cross-site scripting vulnerability exists in TYPO3. An attacker could exploit this vulnerability to perform cross-site scripting attacks...

Omron CX-Programmer 资源管理错误漏洞

Omron CX-Programmer is a PLC Programmable Logic Controller programming software from Omron Japan. A security vulnerability exists in Omron CX-Programmer versions prior to v9.78, which stems from the fact that opening a specially crafted file may cause the affected product to fail to free its memo...

Flux2 资源管理错误漏洞

Flux2 is a tool from the Cloud Native Computing Foundation that keeps Kubernetes clusters synchronized with their configuration sources. A resource management error vulnerability exists in Flux2 versions prior to v0.0.17 through v0.32.0 and helm-controller versions prior to v0.0.4 through v0.23.0...

vm2 安全漏洞

VM2 is a sandbox that can run untrusted code with built-in modules for whitelisted nodes. versions of VM2 prior to 3.9.11 have a remote code execution vulnerability that can be exploited by an attacker to bypass sandbox protection in order to gain remote code execution privileges on the host...

TRENDnet TV-IP572PI 授权问题漏洞

The TRENDnet TV-IP572PI is a megapixel HD PoE day/night network camera from TRENDnet. A security vulnerability exists in TRENDnet TV-IP572PI v1.0, which stems from improper access control. An attacker could exploit the vulnerability to access sensitive system information...

w3m 缓冲区错误漏洞

w3m is a WWW-enabled pager from the personal developer Tatsuya Kinoshita. A security vulnerability exists in w3m version 0.5.3, which stems from an out-of-bounds write to checkType in etc.c. This can be triggered by sending a crafted HTML file to the w3m binary, allowing attackers to cause a deni...

Intel Active Management Technology 安全漏洞

Intel Active Management Technology AMT is a suite of hardware-based remote active management technology software for computers from Intel Corporation. A security vulnerability exists in Intel Active Management Technology , Standard Manageability versions prior to August 9, 2022, which stems from...

Microsoft Visual Studio 代码注入漏洞

Microsoft Visual Studio is a family of development tool suites and a fundamentally complete set of development tools from Microsoft Corporation USA that includes most of the tools needed throughout the software life cycle. A code injection vulnerability exists in Microsoft Visual Studio. The...

Automattic Mongoose 安全漏洞

Automattic Mongoose is a MongoDB object modeling tool for asynchronous environments. A security vulnerability exists in Automattic Mongoose versions prior to 6.4.6, which stems from the Schema.path function being susceptible to prototype contamination when setting up schema objects, which can be...

vm2 安全漏洞

vm2 is an advanced virtual machine/sandbox for Node.js by individual developer Patrik Simek in the Czech Republic. to run untrusted code using whitelisted Node built-in modules. A security vulnerability exists in vm2 prior to 3.6.11, which stems from reaching the stack call limit via infinite...

Hewlett Packard Enterprise FlexNetwork 和 FlexFabric 跨站脚本漏洞

Hewlett Packard Enterprise FlexNetwork HPE FlexFabric and Hewlett Packard Enterprise FlexFabric HPE FlexFabric are both U.S.-based Hewlett Packard Enterprise Hewlett Packard Enterprise FlexNetwork HPE FlexFabric A security vulnerability exists in Hewlett Packard Enterprise FlexNetwork...

Hyperledger Fabric 输入验证错误漏洞

Hyperledger Fabric is an enterprise licensed distributed ledger framework. It is used to develop solutions and applications. Hyperledger Fabric suffers from an input validation error vulnerability that stems from incorrect validation of inputs in a consensus request, which could be exploited by a...

OFFIS DCMTK 代码问题漏洞

OFFIS DCMTK is a collection of libraries and applications from OFFIS Germany that implement most of the DICOM standards. Software for inspecting, building and converting DICOM image files, processing offline media, sending and receiving images over a network connection, and demonstrating image...

Citrix Application Delivery Management 安全漏洞

Citrix Application Delivery Management ADM is an application delivery management system from Citrix. The system provides centralized network and application management functions. A security vulnerability exists in Citrix Application Delivery Management that originates from allowing an...

Citrix Application Delivery Management 资源管理错误漏洞

Citrix Application Delivery Management ADM is an application delivery management system from Citrix. The system provides features such as centralized network and application management. A resource management error vulnerability exists in Citrix Application Delivery Management, which is caused by ...

elitecms SQL注入漏洞

Elitecms is a web content management by elitecms India. elitecms version 1.01 has a SQL injection vulnerability, which originates from the /admin/editsidebar.php page page parameter lack of validation of external input SQL statements, an attacker can use this vulnerability to execute illegal SQL...

CSCMS Music Portal System SQL注入漏洞

CSCMS Music Portal System is a diversified content management system of China Chong Sheng Network Technology CSCMS Company. CSCMS Music Portal System suffers from a SQL injection vulnerability that originates from the lack of validation of the id parameter of /admin.php/pic/admin/type/save for...

radare2 缓冲区错误漏洞

radare2 is a set of libraries and tools for working with binary files. A security vulnerability exists in radare2 versions prior to 5.7.0 that originates from uninitialized pointer access...

Microsoft Office 安全特征问题漏洞

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. Commonly used components of this product include Word, Excel, Access, Powerpoint, FrontPage, and others. A security feature issue vulnerability exists in Microsoft Office. The following products an...

Hitachi Energy RTU500 输入验证错误漏洞

Hitachi Energy RTU500 is a series of industrial control components from Hitachi, Ltd Hitachi, Japan. The Hitachi Energy RTU500 suffers from an input validation error vulnerability that stems from a length information validation error carried in MBAP. An attacker could exploit the vulnerability by...

yii-helpers 安全漏洞

yii-helpers is a set of helper classes for the Yii framework, used as LUYA helpers. A security vulnerability exists in the GitHub library luyadev/yii-helpers prior to version 1.2.1, which can be exploited by an attacker to cause effects such as client-side command injection, code execution, or...

WordPress和WordPress plugin 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Easy Digital Downloads plugin is vulnerable to cross-site request forgery, which originates from Ea...

HPE Superdome Flex Server 安全漏洞

HPE Superdome Flex Server is a modular server product from Hewlett Packard Enterprise hpe. A security vulnerability exists in HPE Superdome Flex and Superdome Flex 280 Servers that allows local users with administrator access to elevate their privileges...

多款Adobe产品资源管理错误漏洞

Adobe Acrobat is a set of tools for editing and converting PDF files.Adobe Acrobat Reader is a PDF viewer. The software is used to print, sign and annotate PDFs. A resource management error vulnerability exists in several Adobe products, which can be exploited by an attacker to execute arbitrary...

Devise-Two-Factor 安全漏洞

Devise-Two-Factor is a minimalist extension to Devise. It is used to provide support for two-factor authentication via the TOTP scheme. A security vulnerability in versions of Devise-Two-Factor prior to 4.0.2 allows an attacker to reapply a one-time password OTP to one and only one immediately...

jc21 Nginx Proxy Manager 跨站脚本漏洞

jc21 Nginx Proxy Manager is a graphical user interface for managing Nginx servers. jc21 Nginx Proxy Manager versions prior to 2.9.17 contain a cross-site scripting vulnerability that stems from the program's lack of data validation filtering of user-supplied data and output. An attacker could...

Joomla! 代码注入漏洞

Joomla! is a set of forum components used in the Joomla! content management system. A code injection vulnerability exists in versions 4.0.0 to 4.1.0 of Joomla!, which stems from an HTTP request parameter input validation error. No detailed vulnerability details are available at this time...

Delta Electronics DIAEnergie SQL注入漏洞

Delta Electronics DIAEnergie is an industrial energy management system used to monitor and analyze energy consumption in real time, calculate energy consumption and load characteristics, optimize equipment performance, improve production processes, and maximize energy efficiency.Delta Electronics...

WordPress plugin 跨站脚本漏洞

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. WordPress plugin is a WordPress application plugin. cross-site scripting vulnerability exists in versions of the WordPress ARI Fancy Lightbox plugin prior to 1.3.9, which stems from a...

mruby 代码问题漏洞

mruby is a lightweight implementation of the Ruby language. mruby suffers from a buffer overflow vulnerability that stems from the presence of null pointer dereference in mruby, which could be exploited by an attacker to crash the mruby interpreter, thereby impacting system availability...

Microsoft Windows HTML Platform 安全特征问题漏洞

Microsoft Windows is a suite of operating systems for use on personal devices from Microsoft Corporation USA. A vulnerability exists in the Microsoft Windows HTML Platform due to a security feature issue. The following products and versions are affected: Windows 7 for 32-bit Systems Service Pack...

Shapelib 资源管理错误漏洞

Shapelib is a simple C API for reading and writing ESRI ArcView Shape files. A security vulnerability exists in Shapelib, which can be exploited via contrib/shpsort.c to force the release of Shapelib's memory to trigger a denial of service and potentially run code...

Containous Traefik 信任管理问题漏洞

Containous Traefik is a reverse proxy and load balancer from Containous, U.S. Containous Traefik is vulnerable to a trust management issue that stems from the fact that when a request is sent using an FQDN processed by a router configured with a dedicated TLS configuration, the TLS configuration...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WP RSS Aggregator plugin has a cross-site scripting vulnerability in versions prior to 4.19.3, which...

Atlassian Jira 授权问题漏洞

Atlassian Jira is a defect tracking system from Atlassian Australia. An access control error vulnerability exists in Atlassian Jira Server and Data Center, which stems from an authentication in the product's /plugins/servlet/project-config/PROJECT/roles endpoint. is corrupted, and an attacker cou...

Hitachi Energy Relion 访问控制错误漏洞

Hitachi Energy Relion is used by Hitachi Energy Switzerland to protect, control, measure, and monitor power systems. A security vulnerability exists in the internal database access mechanism of the Hitachi Energy Relion 670/650/SAM600-IO, Relion 650, GMS600, PWC600, which arises from the product'...

Siemens Nucleus 安全漏洞

Siemens Nucleus ReadyStart is a bundled solution from Siemens Germany. It is used to accelerate the fast start-up of complete systems and provides a rich board-level support package Bsp. A security vulnerability exists in Siemens Nucleus ReadyStart, which stems from the total length of the UDP...

Microsoft Power BI Report Server 跨站脚本漏洞

Microsoft Power BI Report Server is a Microsoft server-side application for managing and sharing business analysis reports. A cross-site scripting vulnerability exists in Microsoft Power BI Report Server. The following products and versions are affected: Microsoft Power BI Report Server...

Microsoft Office 代码注入漏洞

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. Commonly used components of this product include Word, Excel, Access, Powerpoint, FrontPage, and so on. A code injection vulnerability exists in Microsoft Office. The following products and edition...

Saltstack SaltStack Salt 安全漏洞

Saltstack SaltStack Salt is a set of open source tools for managing infrastructure from SaltStack Saltstack. The tool provides configuration management, remote execution, and other features. SaltStack Salt versions prior to Salt 3003.3 have a security vulnerability that allows a user with a contr...

Apache Zeppelin 命令注入漏洞

Apache Zeppelin is a Web-based open source notebook application from the Apache Foundation. The application supports interactive data analysis and collaborative documentation. Apache Zeppelin 0.9.0 and earlier versions contain a command injection vulnerability that could be exploited by an attack...

Cisco Expressway Series和Cisco TelePresence Video Communication Server 数据伪造问题漏洞

Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS are both products of Cisco, Inc.Cisco Expressway Series is software for accessing devices outside the firewall. The software provides simple, highly secure access for users outside the firewall, helping telecommuters wo...

Deamon Tools Pro 输入验证错误漏洞

Deamon Tools Pro is a simulation emulation software that facilitates the creation and installation of images. An input validation error vulnerability exists in Deamon Tools Pro. No information about this vulnerability is available at this time, so please stay tuned to CNNVD or the vendor...

Bento4 缓冲区错误漏洞

Bento4 is an open source C library for reading and writing MP4 files. Bento4 suffers from a heap buffer overflow vulnerability, which stems from a lack of proper boundary checking in the AP4StdcFileByteStream :: ReadPartial component of /StdC/Ap4StdCFileByteStream.cpp. An attacker could exploit...

Cpanel 代码问题漏洞

Cpanel is a set of Web-based automated colocation platform from Cpanel, Inc. in the United States. The platform is primarily used to automate the management of websites and servers. A security vulnerability exists in versions prior to cPanel 98.0.1, which can be exploited to perform a...