AppNeta Tcpreplay Heap Buffer Overflow Vulnerability

AppNeta Tcpreplay is the United States AppNeta company's set of UNIX-based operating system for editing and replaying network traffic open source utilities. A buffer overflow vulnerability exists in the tcprewrite binary in AppNeta Tcpreplay 4.3.2 and earlier versions, which stems from the...

Microsoft Internet Explorer Scripting Engine Remote Code Execution Vulnerability (CNVD-2020-19968)

Microsoft Internet Explorer IE is a Web browser that comes with the Windows operating system from the American company Microsoft. A remote code execution vulnerability exists in the way the scripting engine handles memory objects in Microsoft IE 11. An attacker could exploit this vulnerability to...

Python Resource Management Error Vulnerability

Python is an open source, object-oriented programming language from the Python Software Foundation. The language is extensible, supports modules and packages, and supports multiple platforms. There is a security vulnerability in Python. The vulnerability stems from mismanagement of system resourc...

WordPress Cross-Site Scripting Vulnerability (CNVD-2020-02548)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress versions prior to 5.3.1. The vulnerability stems from...

Horde Groupware Webmail Cross-Site Request Forgery Vulnerability

Horde Groupware Webmail is a browser-based, enterprise-class communications suite from Horde, Inc. A cross-site request forgery vulnerability exists in Horde Groupware Webmail version 5.1.2. The vulnerability stems from a WEB application that does not adequately validate that a request is coming...

Joomla! cross-site scripting vulnerability (CNVD-2020-12779)

Joomla! is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source , cross-platform content management system CMS. A cross-site scripting vulnerability exists in Joomla! The vulnerability stems from a lack of proper validation of client-side data in the WEB...

WordPress Cross-Site Scripting Vulnerability (CNVD-2019-31830)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress has a cross-site scripting vulnerability that can be exploited by attackers to execute client-side...

LIVE555 Media Server Resource Management Error Vulnerability

LIVE555 Media Server is an RTSP server program. The program provides various media file streaming services. A resource management error vulnerability exists in versions prior to Live555 2019.08.16. No detailed vulnerability details are provided at this time...

Google Chrome V8 Out-of-Bounds Write Vulnerability

Google Chrome is a web browser of Google Google, U.S. V8 is one of the open source JavaScript engine. An out-of-bounds write vulnerability exists in V8 in versions prior to Google Chrome 74.0.3729.131. The vulnerability stems from a networked system or product that performs an operation in memory...

Apache HTTP Server Local Elevation of Privilege Vulnerability

Apache HTTP Server is the United States Apache Apache Software Foundation of an open source web server . A local elevation of privilege vulnerability exists in Apache HTTP Server. An attacker could exploit the vulnerability to gain elevated privileges on an affected application...

Flex Denial of Service Vulnerability

flex is a program for recognizing lexical patterns in text. A security vulnerability exists in the 'markbeginningasnormal' function in the nfa.c file in flex version 2.6.4. A remote attacker can exploit this vulnerability to cause a denial of service...

Freeware Advanced Audio Decoder 2 Buffer Overflow Vulnerability (CNVD-2019-05835)

Freeware Advanced Audio Decoder 2 FAAD2 is an open source MPEG-4 and MPEG-2 AAC decoder licensed under the GPLv2 license. A stack buffer overflow vulnerability exists in the third instance of the calculategain function in libfaad/sbrhfadj.c in Freeware Advanced Audio Decoder 2 FAAD2 2.8.8, which...

MediaWiki Security Control Bypass Vulnerability

MediaWiki is a free software open source wiki package written in PHP, originally used for Wikipedia, but now also used by several other projects of the non-profit Wikimedia Foundation and many other wikis. MediaWiki suffers from a security control bypass vulnerability, which can be exploited by a...

Hoek Denial of Service Vulnerability

Hoek is an implementation of the hapi system. A denial of service vulnerability exists in Hoek versions prior to 5.0.3. A local attacker could exploit this vulnerability to cause a denial of service...

GitStack Server User Add Vulnerability

GitStack is a Windows-based version control system. A security vulnerability exists in GitStack 2.3.10 and earlier versions, which stems from the program's failure to adequately filter user input. The vulnerability can be exploited to add a user to the server by sending the username and password...

Shopware content management system backend module cross-site scripting vulnerability

Shopware is the German Shopware company's open source e-commerce software. content management system backend modules is one of the content system backend module. A cross-site scripting vulnerability exists in the customer and order section of the content management system backend module in Shopwa...

Symantec Messaging Gateway Remote Code Execution Vulnerability (CNVD-2017-28446)

Symantec Messaging Gateway is a suite of anti-spam, anti-virus, advanced content filtering and data leakage protection technologies from Symantec. A remote code execution vulnerability exists in Symantec Messaging Gateway versions prior to 10.6.3-267. A remote attacker could exploit this...

Apache HTTP Server Denial of Service Vulnerability (CNVD-2017-13906)

Apache HTTP Server is the United States Apache Apache Software Foundation, an open source web server. The server is fast, reliable and can be expanded through a simple API. A denial of service vulnerability exists in Apache HTTP Server versions prior to 2.4.26. An attacker can exploit this...

Ruby on Rails Active Record SQL Injection Vulnerability (CNVD-2016-06338)

Ruby on Rails Rails is the Rails core team to develop and maintain a set of open source Web application framework based on the Ruby language , which is separated from the United States 37signals, Inc. project management tools Basecamp. Active Record is one of the domain modeling patterns . A SQL...

Ceragon FiberAir IP-10 Private Key Vulnerability

The Ceragon FiberAir IP-10 is a wireless microwave transmission device from Ceragon Israel. The Ceragon FiberAir IP-10 SSH private key disclosure vulnerability allows remote attackers to exploit the vulnerability to gain unauthorized access to the device...

ASUSWRT Backdoor Command Execution Vulnerability

ASUSWRT is the ASUS router firmware. In ASUS WRT versions 3.0.0.4.3761071, 3.0.0.376.2524-g0013f52, infosvr's common.c fails to properly check the requested MAC address, which could allow a remote attacker to send a NETCMDIDMANUCMD packet to UDP port 9999, by sending a packet to UDP port 9999, an...

Oracle MySQL Server JSON Component Denial of Service Vulnerability

Oracle MySQL Server is an open source relational database management system that provides data storage, querying and management capabilities. A denial of service vulnerability exists in Oracle MySQL Server. The vulnerability stems from a failure of the Server: JSON component to properly handle...

Fortinet FortiClient MacOS installer data forgery issue vulnerability

Fortinet FortiClient MacOS installer is a client installer from Fortinet. The Fortinet FortiClient MacOS installer suffers from a data forgery issue vulnerability that stems from improper cryptographic signature validation, which can be exploited by an attacker to cause elevation of privilege for...

Intel 800 Series Ethernet Integer Overflow Vulnerability

Intel 800 Series Ethernet is a new generation of high-speed Ethernet technology from Intel that supports 25GbE and 100GbE speeds and is backward compatible with 10GbE. Intel 800 Series Ethernet suffers from an integer overflow vulnerability that stems from an integer overflow or wrap-around error...

1Panel Command Injection Vulnerability

1Panel is an open source Linux server operation and maintenance management panel of the Chinese 1Panel community . 1Panel suffers from a command injection vulnerability that stems from incomplete certificate validation, which can be exploited by an attacker to cause remote code execution...

Complaint Management System Cross-Site Request Forgery Vulnerability

Complaint Management System is a complaint management system. The Complaint Management System suffers from a cross-site request forgery vulnerability that arises from a web application that does not adequately validate that a request is coming from a trusted user. An attacker could use this...

MB CONNECT LINE mbNET.mini OS Command Injection Vulnerability (CNVD-2025-21143)

The mbNET.mini from MB CONNECT LINE is an industrial router designed for industrial scenarios and is primarily used to enable secure remote connections to machines and systems. MB CONNECT LINE mbNET.mini suffers from an operating system command injection vulnerability that stems from improper...

PDF-XChange Editor Information Disclosure Vulnerability (CNVD-2025-16293)

PDF-XChange Editor is a PDF-XChange company running on Microsoft Windows systems in the PDF file viewer software. An information disclosure vulnerability exists in PDF-XChange Editor, which is caused by a lack of proper validation of user-supplied data. An attacker could exploit this vulnerabilit...

PDF-XChange Editor Heap Buffer Overflow Vulnerability (CNVD-2025-16305)

PDF-XChange Editor is a PDF-XChange company running on Microsoft Windows systems in the PDF file viewer software. PDF-XChange Editor suffers from a heap buffer overflow vulnerability that can be exploited by an attacker to execute code in the context of the current process...

Mattermost Permission Issues Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a privilege issue vulnerability that stems from insufficient privilege validation, which can be exploited by an attacker to access team invitation IDs...

Microsoft Office Code Execution Vulnerability (CNVD-2025-10659)

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. The product's common components include Word, Excel, Access, Powerpoint, FrontPage, and so on. A code execution vulnerability exists in Microsoft Office, which can be exploited by an attacker to...

ChuanhuChatGPT Cross-Site Scripting Vulnerability

ChuanhuChatGPT is an application that provides a lightweight and easy-to-use web GUI and many additional features for a wide range of LLMs such as ChatGPT. ChuanhuChatGPT suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping o...

IBM EntireX Denial of Service Vulnerability

IBM EntireX is a cross-platform middleware developed by IBM for high-performance data communication and transaction processing between heterogeneous systems. A denial of service vulnerability exists in IBM EntireX regular expressions, which is caused by a complexity flaw in the regular expression...

Apache Hive Trust Management Issue Vulnerability

Apache Hive is a set of data warehouse software based on Hadoop Distributed Systems Infrastructure from the Apache Apache Foundation in the United States. The software provides a data integration approach and a high-level query language to support large-scale data analysis on Hadoop. A trust...

IrfanView WBZ plugin WB1 file parsing out-of-bounds write remote code execution vulnerability

IrfanView is an image viewer. It supports image browsing, image editing, image format conversion and so on. IrfanView WBZ plugin WB1 file parsing suffers from an out-of-bounds write remote code execution vulnerability caused by a lack of proper validation of user-supplied data, which can be...

Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability (CNVD-2024-37703)

Cisco Identity Services Engine is an environment-aware platform from the U.S. company Cisco Cisco. Cisco Identity Services Engine has a cross-site request forgery vulnerability that can be exploited by a remote attacker to construct a malicious URI, induce a request, and can perform malicious...

Remote Code Execution Vulnerability in D-Link DIR-2150 (CNVD-2024-33401)

The D-Link DIR-2150 is a wireless router from China-based AUO D-Link. A remote code execution vulnerability exists in the D-Link DIR-2150, which can be exploited by an attacker to execute arbitrary code...

Siemens JT Open and PLM Null Pointer Dereference Vulnerability

The Siemens JT Open Toolkit Siemens JTTK is a C++ application programming interface API from Siemens, Germany.The PLM XML SDK is a lightweight, flexible mechanism for product data transfer. It supports an adapter-based approach to transform data from any source into an XML representation. A null...

Apache StreamPipes Security Feature Issue Vulnerability

Apache StreamPipes is a self-service industrial IoT toolkit from the Apache USA Foundation that enables non-technical users to connect, analyze and explore IIoT data streams. Apache StreamPipes suffers from a security signature issue vulnerability that stems from the presence of a cryptographical...

Dell PowerScale OneFS Encryption Issue Vulnerability (CNVD-2024-16188)

Dell PowerScale OneFS is an operating system from Dell USA. PowerScale OneFS operating system that provides horizontal scaling of NAS. Dell PowerScale OneFS suffers from an encryption issue vulnerability that stems from the use of a corrupted encryption algorithm, which can be exploited by an...

Docassemble Information Disclosure Vulnerability

Docassemble is a free, open source expert system for guided interviews and document assembly. An information disclosure vulnerability exists in Docassemble versions 1.4.53 through 1.4.96, which can be exploited by an attacker to gain unauthorized access to system information by manipulating a URL...

IBM Maximo Application Suite Cross-Site Scripting Vulnerability

IBM Maximo Application Suite is a single platform for intelligent asset management, monitoring, maintenance, computer vision, security and reliability from International Business Machines IBM. A cross-site scripting vulnerability exists in IBM Maximo Application Suite version 7.6.1.3, which stems...

Fortinet FortiClientEMS CSV Injection Vulnerability

Fortinet FortiClientEMS is part of Fortinet's Endpoint Management solution from Fortinet, a U.S.-based company, and is designed to help organizations effectively manage endpoint devices in their networks and provide monitoring and control of endpoint security. Fortinet FortiClientEMS suffers from...

IBM DS8900F HMC Information Disclosure Vulnerability

The IBM DS8900F HMC is an enterprise-class disk storage system from International Business Machines IBM for storing and managing large-scale enterprise data. An information disclosure vulnerability exists in the IBM DS8900F HMC, which can be exploited by an attacker to read arbitrary files after...

Apache Airflow Information Disclosure Vulnerability (CNVD-2024-26530)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An information disclosure vulnerability exists in Apache Airflow versions prior to...

libming memory leak vulnerability (CNVD-2024-48760)

libming is a Flash SWF output library written in C. It can be used as a library to export Flash SWF files to other languages. A memory leak vulnerability exists in libming, which arises from the parseSWFFREECHARACTER function not freeing or failing to free dynamically allocated heap memory, and c...

Linux kernel resource management error vulnerability (CNVD-2024-14762)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that originates from a confusion in the instructions responsible for freeing memory in the netfilter: nftables component. An...

maxView Storage Manager Input Validation Error Vulnerability

SIMATIC IPC Industrial PC is Siemens' PC-based automation hardware platform. The maxView Storage Manager input validation error vulnerability can be exploited by attackers to gain unauthorized access...

Microweber File Upload Vulnerability (CNVD-2023-9820348)

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A file upload vulnerability exists in Microweber version v.2.0.4, which stems from the...

Adobe Premiere Pro Buffer Overflow Vulnerability (CNVD-2023-95451)

Adobe Premiere Pro is a video editing software developed by Adobe for non-linear editing. A buffer overflow vulnerability exists in Adobe Premiere Pro, which can be exploited by an attacker to overflow a buffer and execute arbitrary code on the system or cause the application to crash...