Ax-Solutions Visual Tools Dvr Vx16 操作系统命令注入漏洞

Ax-Solutions Visual Tools Dvr Vx16 is a video surveillance system from Ax-Solutions, Inc. It is used for image analysis. An operating system command injection vulnerability exists in Ax-Solutions Visual Tools DVR VX16 4.2.28.0, which allows an unauthenticated attacker to achieve remote command...

WordPress SQL注入漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in WP-Board WordPress plugin version 1.1 and earlier, which ste...

object-path 安全漏洞

object-path is an Npm library for individual developers to access variables in data structures via paths. A security vulnerability exists in object-path, which stems from the vulnerability of object paths to uncontrolled modification of object prototype attributes prototype contamination...

GitLab 安全漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab CE/EE that stem...

Cpanel 代码问题漏洞

Cpanel is a set of Web-based automated colocation platform from Cpanel, Inc. in the United States. The platform is primarily used to automate the management of websites and servers. A security vulnerability exists in versions prior to cPanel 98.0.1, which can be exploited to perform a...

Apple macOS 权限许可和访问控制问题漏洞

Apple macOS is a suite of specialized operating systems developed for Mac computers by Apple Inc. in the United States. The macOS is vulnerable to a privilege permission and access control issue, which exists due to improperly imposed security restrictions within IOUSBHostFamily. A local...

Joomla! CMS 输入验证错误漏洞

is a set of forum components used in the Joomla! content management system. Joomla! is vulnerable to an input validation error in versions 2.5.0 to 3.9.27, which can be exploited by attackers to cause corruption in the usergroups table...

ACRN 代码问题漏洞

ACRN is an open source project released by the Linux Foundation, which is a hypervisor designed for IoT and embedded devices. A null pointer dereference vulnerability exists in devicemodel/hw/pci/xhci.c in versions prior to ACRN 2.5. No details of the vulnerability are provided at this time...

White Shark System 信息泄露漏洞

White Shark System WSS is a browser-based collaboration platform that integrates Project Management, Task Management, Work Management and Work Log Management. Project Management", "Task Management", "Work Management" and "Work Log Management". A website physical path disclosure vulnerability exis...

迅易科技 74cms SQL注入漏洞

74CMS is a talent recruitment system based on the second development of ThinkPHP framework. A SQL injection vulnerability exists in 74CMS version 3.2.0. An attacker can exploit this vulnerability to inject SQL statements via the x parameter of plus/ajaxstreet.php...

Minecraft 代码问题漏洞

Minecraft My World is a sandbox game by Mojang of Sweden. a security vulnerability existed before Minecraft 1.16.1.7, which stems from the BDew BdLib library allowing remote code execution to deserialize untrusted data in ObjectInputStream. No detailed vulnerability details are currently availabl...

Apache Dubbo 代码问题漏洞

Apache Dubbo is the Apache Foundation's Java-based high-performance open source RPC framework. A deserialization vulnerability exists in Apache Dubbo versions prior to 2.7.8 and 2.6.9. An attacker can use this vulnerability to further exploit by tampering with byte leading flags and specifying a...

Google TensorFlow 数字错误漏洞

Google TensorFlow is an end-to-end open source machine learning platform. A divide-by-zero error vulnerability exists in the tf.rawops.Conv3DBackprop implementation in TensorFlow versions prior to 2.5.0. No detailed vulnerability details are provided at this time...

Jenkins 跨站脚本漏洞

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site scripting...

Oracle VM VirtualBox 输入验证错误漏洞

Oracle VM VirtualBox is a virtual machine management software from Oracle. Oracle VM VirtualBox suffers from an input validation error vulnerability that stems from an input validation error in the core components of Oracle VM VirtualBox. No detailed vulnerability details are provided at this tim...

Fibaro Home Center 2 安全漏洞

FIBARO Home Center 2 is an application system of the Polish company FIBARO. A system integration system. A security vulnerability exists in Fibaro Home Center 2 that stems from the fact that communications between users and devices can be eavesdropped on to hijack sessions, tokens, and passwords...

Papoo cms 跨站请求伪造漏洞

Papoo cms is an application from the German company Papoo. for modern portable SEO websites Papoo suffers from a cross-site request forgery vulnerability that originates from a cross-site request forgery in the administration interface, which can be used by an attacker to gain privileges. The...

Microsoft Visual Studio Code 代码注入漏洞

Microsoft Visual Studio Code is an open source code editor from Microsoft Corporation USA. A code injection vulnerability exists in Microsoft Visual Studio Code. A remote attacker can exploit this vulnerability to execute arbitrary code...

GNU Chess 安全漏洞

GNU Chess is a chess game program. A buffer overflow vulnerability exists in the cmdpgnload and cmdpgnreplay functions in frontend/cmd.cc in GNU Chess version 6.2.7. An attacker can exploit this vulnerability to execute arbitrary code via specially crafted PGN data...

IMAGE CONQUEST DICOM SERVER 命令注入漏洞

IMAGE CONQUEST DICOM SERVER is IMAGE an open source application. It can store, validate, query and retrieve through programmable SQL database tables. A security vulnerability exists in CONQUEST DICOM SERVER before 1.5.0, which can be exploited by attackers to execute malicious code...

Cisco Jabber for Windows 输入验证错误漏洞

Cisco Jabber is a web conferencing and instant messaging application that allows users to send messages over the Extensible Messaging and Status Protocol XMPP. A code execution vulnerability exists in Cisco Jabber, which is caused by incorrect validation of message content. An attacker can send...

WordPress plugin Paid Memberships Pro SQL注入漏洞

WordPress plugin Paid Memberships Pro is an open source application plugin for WordPress. The plugin is designed for premium content sites, clubs/associations, subscription products, newsletters and more. Paid Memberships Pro versions prior to 2.5.6 suffers from a SQL injection vulnerability that...

keycloak 安全漏洞

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in keycloak that could allow an attacker to access the contents of the directory in which keycloak is stored...

FiberHome HG6245D devices 信任管理问题漏洞

Fiber is an open source web framework written in the Go language . A trust management issue vulnerability exists in FiberHome HG6245D, which arises from the lack of an effective trust management mechanism in a network system or product, and can be exploited by an attacker to attack affected...

GENIVI Diagnostic Log Buffer Error Vulnerability

GENIVI Diagnostic Log is a communication protocol for the GlobalGENIVI community. Log and Trace interfaces are provided. A buffer error vulnerability exists in GENIVI Diagnostic Log and Trace that originates when a networked system or product performs an operation on memory without properly...

Microsoft Dynamics 365 Information Disclosure Vulnerability

Microsoft Dynamics 365 is a suite of ERP business solutions for multinational organizations from Microsoft USA. The product includes financial management, production management and business intelligence management. An information disclosure vulnerability exists in Microsoft Dynamics 365. The...

Cross-Site Scripting Vulnerability in Multiple NEC Aterm Products

The NEC Aterm WG2600HP and others are a wireless router from NEC Corporation of Japan. A cross-site scripting vulnerability exists in multiple Aterm products, which stems from a lack of proper validation of client-side data by the WEB application. The vulnerability can be exploited by an attacker...

Hyperledger Indy Node Data Forgery Issue Vulnerability

Indy Node is a distributed Ledger implementation based on indy-plenum Byzantine Fault Tolerance Protocol from the Linux Foundation, USA. Versions of Hyperledger Indy prior to 1.12.4 suffer from a data forgery issue vulnerability that stems from the absence of transaction-specific signature...

Google Asylo Buffer Error Vulnerability

Google Asylo is a framework for developing trusted applications from Google Inc. in the United States. The software supports the creation of a trusted execution environment, including software isolation and hardware isolation. A security vulnerability exists in Google Asylo version 0.6.0 and...

Microsoft Windows Error Reporting Information Disclosure Vulnerability

Microsoft Windows Error Reporting WER is a component of Microsoft Corporation USA. It enables users to notify Microsoft of application failures, kernel failures, unresponsive applications, and other application-specific issues. An information disclosure vulnerability exists in Microsoft Windows...

gst-plugins-bad 缓冲区错误漏洞

gst-plugins-bad is a GStreamer open-source plugin. gst-plugins-bad has a buffer error vulnerability, which stems from the multiple slice processing loop in the gsth266 parser’s gsth266parserparsepicturepartition function. This loop does not check whether the slice index exceeds the boundary. When...

CyberArk Idira Secrets Manager Self-Hosted 访问控制错误漏洞

CyberArk Idira Secrets Manager Self-Hosted is an enterprise-level confidential information management platform developed by the CyberArk company. Versions of CyberArk Idira Secrets Manager Self-Hosted prior to 13.8.0 contained a access control vulnerability. This vulnerability stemmed from improp...

axios 输入验证错误漏洞

Axios is an open-source HTTP client developed by Axios. Versions of Axios from 1.0.0 to 1.16.0 had security vulnerabilities. These vulnerabilities were caused by prototype pollution attacks, which could lead to the Object.prototype in the application dependency tree being polluted, resulting in...

VMware Spring for GraphQL 代码问题漏洞

VMware Spring for GraphQL is a GraphQL application development framework provided by the American company VMware. Versions of VMware Spring for GraphQL such as 2.0.0, 1.4.0, and 1.3.0 contain code vulnerabilities. These vulnerabilities stem from insecure deserialization during the processing of...

Google Chrome 资源管理错误漏洞

Google Chrome is a web browser developed by Google Inc. In versions prior to 149.0.7827.115, there was a resource management vulnerability. This vulnerability stemmed from a problem with reusing resources after they were released by the Network component. This could allow attackers with privilege...

Google Chrome 资源管理错误漏洞

Google Chrome is a web browser developed by Google Inc. In versions prior to 149.0.7827.115, there was a resource management vulnerability that stemmed from issues with reusing resources after their release in the Media component. This vulnerability could allow remote attackers to exploit heap...

WordPress plugin JoomSport SQL注入漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

Quest Bot 安全漏洞

Quest Bot is a multi-functional Discord community management robot developed by Duck Organization. Versions of Quest Bot prior to 1.0.3 contained security vulnerabilities. These vulnerabilities stemmed from users who had access to manage servers but did not have management roles or administrator...

WordPress plugin Contact Form and Lead Form Elementor Builder 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

Axios 注入漏洞

Axios is an open-source HTTP client developed by Axios. Versions of Axios from 1.15.2 to 1.16.0 had a injection vulnerability. This vulnerability stemmed from the lack of hasOwnProperty checks on nested objects created by the utils.merge function. This could lead to prototype pollution and...

Apple macOS 后置链接漏洞

Apple macOS is a proprietary operating system developed by the American company Apple for Mac computers. Versions of Apple macOS Sequoia 15.4 and earlier contained a backlink vulnerability, which was caused by improper handling of symbolic links. This vulnerability could allow applications to...

VMware Spring Boot 安全漏洞

VMware Spring Boot is an open-source framework developed by the American company VMware. There are security vulnerabilities in versions 4.0.0 to 4.0.6, 3.5.0 to 3.5.14, 3.4.0 to 3.4.16, 3.3.0 to 3.3.19, and 2.7.0 to 2.7.33 of VMware Spring Boot. These vulnerabilities stem from the use of fixed...

gst-plugins-bad 缓冲区错误漏洞

gst-plugins-bad is a GStreamer open-source plugin. gst-plugins-bad has a buffer error vulnerability. This vulnerability stems from the H.265 codec parser library using incorrect loop boundaries when parsing SEI messages during the buffer period. As a result, the CPB values allocated for the stack...

KanaDojo 操作系统命令注入漏洞

KanaDojo is an attractive and customizable Japanese learning platform developed by lingdojo. KanaDojo has a vulnerability related to operating system command injection. This vulnerability arises from command injection, and it could allow attackers with access to pull requests to execute arbitrary...

libnfs 安全漏洞

libnfs is a network file system access client library developed by Ronnie Sahlberg. Versions of libnfs prior to 55c18ea contained security vulnerabilities; these vulnerabilities stemmed from unvalidated string sizes, which could lead to integer overflows when connecting to specially crafted NFS...

Erlang/OTP 安全漏洞

Erlang/OTP is an open-source JavaScript library for handling exceptions, developed by Erlang/OTP. This library can catch exceptions caused by Node.js’s built-in APIs. Erlang/OTP ssh versions prior to 6.0.0 had a security vulnerability. This vulnerability stemmed from the sshauth module’s use of...

Roxy-WI 授权问题漏洞

Roxy-WI is an open-source web interface designed for managing Haproxy, Nginx, and Keepalived servers. Versions of Roxy-WI 8.2.6.4 and earlier have a vulnerability related to authorization. This vulnerability arises from using the API substring in the URL and unauthenticated /api/gpt endpoints,...

KubeV2V Migration assessment 跨站脚本漏洞

The Migration Planner UI is an open-source migration planning front-end tool developed by KubeV2V. The Migration Planner UI has a cross-site scripting vulnerability. This vulnerability arises from the ability of attackers to register malicious discovery agents containing JavaScript code. When an...

Fission 路径遍历漏洞

Fission is an open-source function deployment framework based on Kubernetes. Versions of Fission prior to 1.25.0 contained a path traversal vulnerability. This vulnerability stemmed from the Unarchive function using filepath.Join to concatenate the archive entry name with the target directory,...

Splunk Enterprise 输入验证错误漏洞

Splunk Cloud Platform and Splunk Enterprise are both products of the American company Splunk. Splunk Cloud Platform is a powerful service for data collection, processing, and analysis. Splunk Enterprise is a suite of software for data collection and analysis. There is an input validation...