Cisco DNA Center Command Execution Vulnerability

Cisco DNA Center is a network management and command center service from Cisco USA. A command execution vulnerability exists in Cisco DNA Center Software. The vulnerability stems from the application's inadequate validation of user-supplied input in API request parameters and can be exploited by ...

Google Android Resource Management Error Vulnerability (CNVD-2023-43880)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from a security vulnerability that stems from a messed up instruction that can be responsible for freeing memory in the adrenosetparam of the adrenogpu.c file. An attacker can exploit the vulnerabilit...

File Tracker Manager System Cross-Site Scripting Vulnerability

File Tracker Manager System is a file tracker manager system. File Tracker Manager System v1.0 version of a cross-site scripting vulnerability, the vulnerability stems from the /filemanager/admin/saveuser.php parameter firstname of the user-supplied data lack of effective filtering and escaping, ...

MindsDB path traversal vulnerability (CNVD-2023-32764)

MindsDB is an emerging low-code machine learning platform from MindsDB, Inc. A path traversal vulnerability exists in MindsDB version v23.1.5.0 and prior versions, which stems from performing an insecure extraction from a remotely retrieved tarball using tarfile.extractall, resulting in writing t...

chatwoot Cross-Site Scripting Vulnerability (CNVD-2023-29696)

chatwoot is an application. Customer Engagement Suite, an open source alternative to intercom, Zendesk, Salesforce Service Cloud, etc. A cross-site scripting vulnerability exists in chatwoot versions prior to 2.14.0. The vulnerability stems from the application's lack of effective filtering and...

Google Chrome Buffer Overflow Vulnerability (CNVD-2023-43886)

Google Chrome is a web browser from Google, an American company. A buffer overflow vulnerability exists in SQLite in versions prior to Google Chrome 112.0.5615.137. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service...

Apache Airflow Input Validation Error Vulnerability (CNVD-2023-30851)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An input validation error vulnerability exists in Apache Airflow versions prior to...

IBM Security Guardium Information Disclosure Vulnerability (CNVD-2023-20082)

IBM Security Guardium is a suite of platforms from International Business Machines IBM that provide data protection capabilities. The platform includes features such as customizable UI, report management and streamlined audit process building.IBM Security Guardium Key Lifecycle Manager is...

IBM Aspera XML External Entity Injection Vulnerability

IBM Aspera is an IBM FASP protocol-based fast file transfer and streaming solution from International Business Machines IBM. IBM Aspera Faspex version 4.4.2 is vulnerable to XML external entity injection, which stems from not setting the correct filter to allow references to external entities whe...

Schneider Electric IGSS Data Server Code Issue Vulnerability

Schneider Electric IGSS Data Server is a data server for the interactive graphical Scada system from Schneider Electric France. A code issue vulnerability exists in Schneider Electric IGSS Data Server, which can be exploited by attackers to cause remote code execution...

Adobe Dimension Out-of-Bounds Read Vulnerability (CNVD-2023-21654)

Adobe Dimension is the United States of America Odo than Adobe company is a set of 2D and 3D composite design tools. Adobe Dimension suffers from an out-of-bounds read vulnerability that can be exploited by an attacker to execute code in the context of the current user...

Google Android elevation of privilege vulnerability (CNVD-2023-21686)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by an attacker to cause a local privilege escalation without requiring additional execute privileges...

Google Android Information Disclosure Vulnerability (CNVD-2023-26071)

Google Android is a Linux-based open source operating system from Google. Google Android has an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

Forget Heart Message Box SQL Injection Vulnerability

Forget Heart Message Box is a messaging website. v1.1 of Forget Heart Message Box is vulnerable to SQL injection, which stems from a lack of validation of external input SQL statements in the name parameter of ca.php. An attacker could use this vulnerability to execute illegal SQL commands to ste...

F5 BIG-IP Edge Client for Windows Command Execution Vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A command execution vulnerability exists in F5 BIG-IP Edge Client for Windows, which can be exploited by attackers to execute...

F5 HTTP profile denial of service vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A denial of service vulnerability exists in F5 HTTP profiles, when a non-default HTTP profile is configured on a virtual serv...

NexusPHP SQL Injection Vulnerability (CNVD-2023-05400)

NexusPHP is a free and open source complete PT site building solution. versions prior to NexusPHP 1.7.33 have a security vulnerability that could be exploited by attackers to allow remote attackers to execute arbitrary SQL commands via the conuser parameter in takeconfirm.php...

phpMyFAQ cross-site scripting vulnerability (CNVD-2023-04312)

phpMyFAQ is a multi-language, fully database-driven FAQ system. A cross-site scripting vulnerability exists in versions prior to phpMyFAQ 3.1.10, which stems from the presence of stored cross-site scripting XSS. No details of the vulnerability are provided at this time...

Adobe InCopy out-of-bounds write vulnerability (CNVD-2023-05226)

Adobe InCopy is a text editing software for authoring from Adobe, Inc. An out-of-bounds write vulnerability exists in Adobe InCopy, which can be exploited by attackers to execute arbitrary code in the context of the current user...

Lead Management System SQL Injection Vulnerability (CNVD-2023-05741)

Lead management system is a lead management system developed by Mayuri K. A SQL injection vulnerability exists in Lead Management System v1.0, which stems from the lack of validation of external input SQL statements in the id parameter of removeBrand.php, and can be exploited by attackers to The...

Microsoft SharePoint Server Remote Code Execution Vulnerability (CNVD-2023-53468)

Microsoft SharePoint Server is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A remote code...

Google Android Denial of Service Vulnerability (CNVD-2023-18909)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from a denial of service vulnerability that can be exploited by attackers to cause a denial of service...

Tenda A15 wepkey1 parameter stack overflow vulnerability

Tenda A15 is a WiFi extender from Tenda, China. A stack overflow vulnerability exists in the Tenda A15 wepkey1 parameter, which stems from a lack of length checking of input data in the wepkey1 parameter of /goform/WifiBasicSet, and can be exploited by attackers to execute arbitrary code on the...

OpenImageIO Heap Buffer Overflow Vulnerability

OpenImageIO is an image read and write library that also provides several tools and applications. a heap buffer overflow vulnerability exists in the PSD thumbnail resource parsing code in OpenImageIO v2.3.19.0. An attacker can exploit this vulnerability to cause arbitrary code execution via...

Unspecified Vulnerability in XWiki Platform

XWik Platform is a suite of Wiki platforms for creating Web collaboration applications from the French company XWiki. A security error vulnerability exists in XWiki Platform. An attacker exploited the vulnerability to cause a degradation in database performance...

Unspecified Vulnerability in AVEVA Edge

AVEVA Edge is a highly scalable and flexible HMI/SCADA software from AVEVA Software UK. A security vulnerability exists in AVEVA Edge 2020 R2 and prior versions that can be exploited by an attacker to potentially compromise the confidentiality, availability or integrity of the system. Details of...

Typora Cross-Site Scripting Vulnerability

Typora is a lightweight Markdown editor developed by Abner Lee. A cross-site scripting vulnerability exists in versions prior to Typora 1.4.4, which can be exploited by attackers to launch cross-site scripting attacks...

Unspecified Vulnerability in Intelbras SG 2404 MR

The Intelbras SG 2404 MR is a switch with network management features from Intelbras, Brazil. A security vulnerability exists in Intelbras SG 2404 MR version 20180928-rel64938. An authenticated attacker can exploit the vulnerability to create an administrator account via a specially crafted user...

WordPress Popup Maker Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Democritus Project d8s-urls code execution vulnerability

Democritus Project is a collection of simple, effective, modular, well-tested and well-documented features from Democritus. Democritus Project d8s-urls has a security vulnerability that stems from its inclusion of a potential code execution backdoor inserted by a third party. An attacker could...

OpenCart SQL Injection Vulnerability (CNVD-2024-30068)

OpenCart is an open source e-commerce system from the OpenCart team in Hong Kong, China. The system provides product reviews, product ratings, product additions and other modules. OpenCart 3.0.3.7 version of the existence of SQL injection vulnerability , an attacker can exploit the vulnerability...

Tenda AC1206 fromSysToolReboot Function Cross-Site Request Forgery Vulnerability

The AC1206 is a high performance router designed with Gigabit ports for both WAN and LAN ports. Tenda AC1206 firmware version USAC1206V1.0RTLV15.03.06.23multiTD01 suffers from a cross-site request forgery vulnerability, which exists in the fromSysToolReboot function in the /bin/httpd file, and ca...

Microsoft Windows DHCP Client privilege elevation vulnerability

Microsoft Windows is a set of operating systems for personal devices from Microsoft Corporation USA.An elevation of privilege vulnerability exists in Microsoft Windows DHCP Client, which stems from improper privilege assignment in the application and can be exploited by an attacker to cause an...

SAP 3D Visual Enterprise Author .vds Buffer Overflow Vulnerability

SAP 3D Visual Enterprise Author is a desktop application for managing 2D, 3D, animation, video and audio assets from SAP. A buffer overflow vulnerability exists in SAP 3D Visual Enterprise Author version 9, which stems from a lack of proper memory management and can be exploited by an attacker to...

SAP 3D Visual Enterprise Viewer .obj Buffer Overflow Vulnerability

SAP 3D Visual Enterprise Viewer is a 3D view viewer from SAP, Germany. The software supports the publishing of 2D and 3D scenes in all industry-standard desktop applications and supports separate installation as a stand-alone executable program and ActiveX space. A buffer overflow vulnerability...

Huawei HarmonyOS kernel module out-of-bounds read vulnerability

Huawei HarmonyOS is an operating system from Huawei China, Inc. providing a microkernel-based, full-scenario distributed operating system. Huawei HarmonyOS provides a microkernel-based, full-scenario distributed operating system. Huawei HarmonyOS suffers from an out-of-bounds read vulnerability,...

Caryll OTFCC otfccdump+0x6adb1e buffer overflow vulnerability

Caryll OTFCC is Caryll open source a C library and utility programs. Used to parse and write OpenType font files. Caryll OTFCC suffers from a buffer overflow vulnerability that originates from a boundary error in /release-x64/otfccdump+0x6adb1e when handling untrusted input. An attacker could...

Rocket.Chat Authorization Issues Vulnerability (CNVD-2022-69165)

Rocket.Chat is an open source team chat software. A security vulnerability exists in Rocket.Chat Mobile App versions prior to 4.14.1.22788, which stems from incorrect authentication and can be exploited by an attacker to bypass local authentication...

WordPress Post SMTP Mailer/Email Log Server Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A server request forgery...

Ivanti Endpoint Manager Elevation of Privilege Vulnerability

Ivanti Endpoint Manager EPM is a suite of endpoint security managers from Ivanti, USA. An elevation of privilege vulnerability exists in Ivanti Endpoint Manager, which stems from the "LANDeskR Management Agent" service exposing a socket that, once connected, can be used to launch commands only fo...

OTFCC has an unspecified vulnerability (CNVD-2023-11788)

OTFCC is a C library and utility open sourced by Caryll. It is used to parse and write OpenType font files. OTFCC has a security vulnerability that stems from a segmentation violation located at its /release-x64/otfccdump 0x4fbc0b. No detailed vulnerability details are currently available...

Adobe InDesign product buffer overflow vulnerability

Adobe InDesign, a set of typesetting and editing applications from Adobe, has a buffer overflow vulnerability that originates from out-of-bounds reads and could lead to a memory leak. An attacker can remotely execute arbitrary code through this vulnerability...

Huawei HarmonyOS Buffer Overflow Vulnerability (CNVD-2022-64981)

Huawei HarmonyOS is an operating system from Huawei China. HarmonyOS version 2.0 contains a buffer overflow vulnerability that stems from the fact that the HWKEYMASTER module does not perform a legitimacy check on the key format, which can be exploited to cause out-of-bounds access...

Clinic's Patient Management System SQL注入漏洞

Clinic's Patient Management System is a patient management system for clinics. a SQL injection vulnerability exists in Clinic's Patient Management System v1.0, which originates in /pms/ The id parameter in updatepatient.php lacks validation for external input SQL statements. An attacker could use...

Cockpit Access Control Error Vulnerability

Cockpit is an interactive server management interface. An access control error vulnerability exists in Cockpit versions prior to 2.2.0 that stems from insufficient session expiration. An attacker could exploit the vulnerability to take control of an account using expired session credentials...

Apple iOS and iPadOS ImageIO Buffer Overflow Vulnerability

Apple iOS and Apple iPadOS are both products of Apple Inc. Apple iOS is an operating system developed for mobile devices.Apple iPadOS is an operating system for the iPad tablet computer. A buffer error vulnerability exists in Apple iOS prior to 15.6 and iPadOS prior to 15.6, which stems from a...

Google Android Denial of Service Vulnerability (CNVD-2022-54348)

Google Android is a Linux-based open-source operating system from the US company Google. Google Android suffers from a denial-of-service vulnerability, which can be exploited by local attackers to perform a factory reset and cause a denial-of-service condition...

flask-mongo-skel path traversal vulnerability

flask-mongo-skel is a Flask MongoDB framework from Shamail Tayyab's personal developer. flask-mongo-skel 2012-11-01 and earlier versions contain a path traversal vulnerability that stems from a failure of Flask's sendfile function to properly filter resource or file paths for The vulnerability is...

Bluetooth buffer overflow vulnerability in multiple MediaTek chips (CNVD-2022-66253)

MediaTek Inc. is the world's fourth largest fab-based semiconductor company and a leader in the markets of mobile terminals, smart home applications, wireless connectivity and Internet of Things IoT products, with approximately 1.5 billion units of end products with built-in MediaTek chips hittin...

Multiple MediaTek Chip CCCI Input Validation Error Vulnerability

MediaTek Inc. is the world's fourth largest fab-based semiconductor company and a leader in the markets of mobile terminals, smart home applications, wireless connectivity and Internet of Things IoT products, with approximately 1.5 billion units of end products with built-in MediaTek chips hittin...