HPE Superdome Flex Server security vulnerabilities

HPE Superdome Flex Server is a modular server product from Hewlett Packard Enterprise hpe. A security vulnerability exists in HPE Superdome Flex and Superdome Flex 280 Servers that allows local users with administrator access to elevate their privileges...

Express-FileUpload code issue vulnerabilities

express-fileupload is a file upload middleware by Richard Girges, an individual developer in the United States. A code issue vulnerability exists in express-fileupload v1.3.1 that allows attackers to execute arbitrary code via a crafted PHP file...

Multiple Adobe product resource management errors and vulnerabilities

Adobe Acrobat is a set of tools for editing and converting PDF files.Adobe Acrobat Reader is a PDF viewer. The software is used to print, sign and annotate PDFs. A resource management error vulnerability exists in several Adobe products, which can be exploited by an attacker to execute arbitrary...

Google Chrome security vulnerabilities

Google Chrome is a web browser from Google, Inc. A security vulnerability exists in Google Chrome, which is caused by the window.showSaveFilePicker function that parses and returns environment variable values to the user when passing environment variables, which can be exploited by an attacker to...

Joomla! Path Traversal Vulnerability

A path traversal vulnerability exists in Joomla! versions 3.0.0 through 3.10.6 and 4.0.0 through 4.1.0, which stems from a failure of a web system or product to properly filter special elements in a resource or file path, and can be exploited by remote attackers to send specially crafted .zip...

Maccms cross-site scripting vulnerabilities

Maccms is a PHP-based film and television content management system CMS. maccms v10 version of the cross-site scripting vulnerability, the vulnerability stems from the wd parameter in /admin.php/admin/ulog/index.html lack of user-supplied data and output data validation filter, an attacker can us...

Sylius information leakage vulnerability

Sylius is a set of open source e-commerce platform based on the Symfony framework from the Polish company Sylius. Sylius has an information disclosure vulnerability, and no details of the vulnerability are currently available...

Horde Groupware Webmail Cross-Site Script Vulnerability

Horde Groupware Webmail is a browser-based, enterprise-class communications suite from Horde, Inc. A security vulnerability exists in the lib/Horde/Mime/Viewer/Ooo.php file in Horde Groupware Webmail. The vulnerability stems from the fact that the file allows cross-site scripting attacks utilizin...

Microsoft Windows HTML Platform Security Feature Vulnerability

Microsoft Windows is a suite of operating systems for use on personal devices from Microsoft Corporation USA. A vulnerability exists in the Microsoft Windows HTML Platform due to a security feature issue. The following products and versions are affected: Windows 7 for 32-bit Systems Service Pack...

Climatix POL909 Cross-site Scripting Vulnerability

Siemens Climatix AWB Advanced Web and BACnet Module, POL909 enables users of the Climatix 600 solution to connect to a BACnet IP network and implement and load customer web pages and features. Siemens Climatix AWM Advanced Web Module, POL909 enables users of the Climatix 600 solution to implement...

Microsoft Exchange Server code injection vulnerability

Microsoft Exchange Server is the United States Microsoft Microsoft company's set of e-mail service program. It provides email access, storage, forwarding, voicemail, email filtering and screening, and other features. A code injection vulnerability exists in Microsoft Exchange Server. The followin...

Shapelib resource management error vulnerability

Shapelib is a simple C API for reading and writing ESRI ArcView Shape files. A security vulnerability exists in Shapelib, which can be exploited via contrib/shpsort.c to force the release of Shapelib's memory to trigger a denial of service and potentially run code...

Qt path traversal vulnerability

Qt is a cross-platform C application development framework from the Norwegian company Qt. It is widely used for developing GUI programs, in which case it is also known as the widget toolkit. It can also be used to develop non-GUI programs, such as console tools and servers.Qt versions prior to...

Kofax Printix Secure Cloud Print Management code injection vulnerability

Kofax Printix Secure Cloud Print Management is a cloud-based print management software from Kofax USA that is flexible, scalable and easy to use. Manage and maintain complex print environments anytime, anywhere with all the modern printing features users and organizations need. A code injection...

WordPress plugin AccessPress has a security vulnerability

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress plugin AccessPress Themes has a security vulnerability that stems from the existence of a backdoor in the vendor...

SourceForge MBSync buffer error vulnerability

Sourceforge mbsync is an application from the Sourceforge community in the United States. It provides synchronization of remote IMAP mailboxes with local maildir-style mailboxes. Sourceforge mbsync suffers from a buffer error vulnerability that stems from the fact that due to insufficient handlin...

Qualcomm’s multiple product security vulnerabilities

A Qualcomm chip is a chip from Qualcomm Incorporated USA. A way of miniaturizing circuits mainly semiconductor devices, but also passive components, etc., and is manufactured from time to time on the surface of semiconductor wafers. A security vulnerability exists in a number of Qualcomm products...

Google TensorFlow resource management error vulnerability

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. Google Tensorflow is vulnerable to resource management errors, which can be exploited by attackers to cause mismanagement of resources...

Sensio Labs Twig code injection vulnerability

Sensio Labs Twig is a PHP template engine from the French company Sensio Labs that supports custom tags and filters and the creation of DSLs. Sensio Labs Twig is vulnerable to injection, which can be exploited by attackers to run arbitrary PHP functions...

Google Android Resource Management Vulnerability

Google Android is a Linux-based open source operating system from Google, Inc. A security vulnerability exists in Google Android, which stems from a configuration error in the network system or product during operation. An attacker could exploit the vulnerability to cause a local privilege...

cve-search Security Vulnerabilities

Cve-Search is a tool that performs local searches for known vulnerabilities. It is used for searching, indexing, correlating and managing software vulnerabilities. cve-search versions prior to 4.1.0 have a security vulnerability that stems from lib/DatabaseLayer.py allowing regular expression...

Adobe Premiere Pro buffer error vulnerability

Adobe Premiere Pro is a non-linear video editing software developed by Adobe, which is widely used in the professional production of movies, TV and web videos, providing a full-process solution from clip editing to finished output. An out-of-bounds read vulnerability exists in Adobe Premiere Pro,...

Django security vulnerabilities

Django is the Django Foundation's set of open source Web application framework based on the Python language . The framework includes an object-oriented mapper, view system, template system, and more. A security vulnerability exists in Django, which stems from the fact that HTTP requests for URLs...

Microsoft Windows AppX Deployment Extensions: Permissions and access control issues

Microsoft Windows AppX Deployment Extensions is an AppX Deployment Extension DLL from Microsoft Corporation USA that is part of the Microsoft Windows operating system. A vulnerability exists in the Microsoft Windows AppX Deployment Service with privilege permission and access control issues. The...

PHP path traversal vulnerability

PHP is a scripting language that executes on the server side. A security vulnerability exists in PHP that arises from a lack of effective privilege-granting and access-control measures in a networked system or product...

WordPress plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in the WordPress...

GNU Mailman access control error vulnerability

GNU Mailman is a free suite of software from the GNU community for managing e-mail discussions and e-mail lists. The software integrates with web projects to make it easy for users to manage email subscription accounts and provides built-in archiving, automatic forwarding processing, content...

D-Link DSL-2750U: Operating System Command Injection Vulnerability

The D-Link DSL-2750U is a wireless N 300 ADSL2 modem router. an OS command injection vulnerability exists in the D-Link DSL-2750U ME1.16 and earlier versions. An attacker could exploit this vulnerability in combination with other vulnerabilities to execute arbitrary OS commands...

GPAC input validation error vulnerability

GPAC Project on Advanced Content is an open source cross-platform library that implements the MPEG-4 system standard and provides tools for media playback, vector graphics, and 3D rendering. an integer overflow vulnerability exists in the MPEG-4 decoding functionality in GPAC Project on Advanced...

Google TensorFlow security vulnerabilities

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A security vulnerability exists in Google TensorFlow caused by converting a signed integer value to an unsigned integer value and then allocating memory based on that value. No details of the...

Microsoft Office code injection vulnerability

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. Commonly used components of this product include Word, Excel, Access, Powerpoint, FrontPage, and others. A code injection vulnerability exists in Microsoft Microsoft Office. The following products...

Oracle Essbase input validation vulnerability

Oracle Hyperion Essbase Administration Services is a robust, cross-platform graphical user interface that makes Essbase administration tasks easy to perform.Oracle Hyperion Essbase Administration Services 11.1.2.4. Release 21.2 contains a security vulnerability in the EAS Console component. An...

Huawei HarmonyOS code-related vulnerabilities

Huawei HarmonyOS is an operating system from Huawei China. It provides a microkernel-based distributed operating system. Huawei HarmonyOS suffers from a denial-of-service vulnerability that could be exploited by attackers to cause a denial of service...

OpenDMARC code issue vulnerability

OpenDMARC is an open source implementation of the DMARC Domain-based Message Authentication, Reporting and Conformance specification from The Trusted Domain project. OpenDMARC suffers from a security vulnerability that stems from an unknown feature in the component header field handler. An attack...

WordPress plugin cross-site scripting vulnerabilities

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . Funnel Builder by CartFlows - Create High Converting Sale...

http4s path traversal vulnerability

Http4s is an open source for Scala streaming HTTP server . Http4s has a path traversal vulnerability that can be exploited by an attacker to obtain sensitive information...

Acyba AcyMailing: Input validation error vulnerability

Acyba AcyMailing is a suite of newsletter and marketing automation software from the Acyba team in France. AcyMailing suffers from an input validation error vulnerability that stems from the redirect parameter not being cleared correctly when AcyMailing performs a subscription...

vmd Cross-Site Scripting Vulnerabilities

vmd is a software application. Preview markdown files in a separate window A cross-site scripting vulnerability exists in vmd version 1.34.0 and earlier versions, which leaks div class="markdown-body"...

Google Kubernetes code issues and vulnerabilities

Google Kubernetes is a set of open source Docker container cluster management system from the U.S. company Google Google. The system provides resource scheduling, deployment and operation, service discovery and scaling up and down for containerized applications. A code issue vulnerability exists ...

GitLab authorization issue vulnerabilities

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An authorization issue vulnerability exists in GitLab CE/...

McAfee McAfee ePolicy Orchistrator Cross-site Scripting Vulnerability

McAfee ePolicy Orchistrator ePO is a suite of scalable security management software from McAfee. The software enables centralized, streamlined management of endpoint, network, content security and compliance solutions. A cross-site scripting vulnerability exists in McAfee ePolicy Orchestrator ePO...

Jenkins Matrix Authorization Strategy Security Vulnerability

Jenkins Matrix Authorization Strategy is a Jenkins open source application plugin . The plug-in in Jenkins to achieve fine-grained access control . An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows attackers with Item/Read permissions to nested...

Wind River VxWorks buffer error vulnerability

Wind River VxWorks is an operating system from Wind River, Inc. the industry-leading real-time operating system for building embedded devices and systems. A buffer overflow vulnerability exists in Wind River VxWorks versions 6.5 through 7, which can be exploited by a remote attacker to submit a...

GENIVI Diagnostic Log Buffer Error Vulnerability

GENIVI Diagnostic Log is a communication protocol for the GlobalGENIVI community. Log and Trace interfaces are provided. A buffer error vulnerability exists in GENIVI Diagnostic Log and Trace that originates when a networked system or product performs an operation on memory without properly...

FiberHome HG6245D devices have vulnerabilities related to trust management.

The HG6245D is an FTTH ONT router from FiberHome. The FiberHome HG6245D is vulnerable to a hard-coded GEPON password vulnerability. The vulnerability stems from a hardcoded GEPON password defined in /etc/init.d/system-config.sh. No detailed vulnerability details are provided at this time...

HPE Moonshot Provisioning Manager Path Traversal Vulnerability

A path traversal vulnerability in HPE Moonshot Provisioning Manager prior to v1.20, which stems from incorrectly handling user input that results in traversing a directory triggering khuploadfile.cgi, can be exploited by an attacker to cause remote code execution, denial of service, and/or...

Roundcube Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability exists in versions prior to Roundcube 1.4.11, which can be exploited by an attacker with carefully constructed CSS displayed in an HTML email...

OpenMage Code Issues Vulnerabilities

OpenMage Magento Lts Magento is an e-commerce system organized by OpenMage. A code issue vulnerability exists in OpenMage versions 19.4.10 and 20.0.6, which stems from the presence of a vulnerability that allows remote attackers to execute code...

Vtiger CRM information leakage vulnerability

Vtiger CRM is a set of customer relationship management system CRM based on SugarCRM developed by American Vtiger. The management system provides management, collection and analysis of customer information and other functions. Vtiger CRM v7.2.0 suffers from a path traversal vulnerability that can...

Sass Node-sass Trust Management Issues Vulnerability

Sass Node-sass is a C++-based codebase from the Gogo Sass team that supports Node interaction with LibSass. A security vulnerability exists in node-sass 2.0.0 to 4.14.1, which stems from certificate validation being disabled...