GoCD Cross-Site Scripting Vulnerability

GoCD is a continuous delivery server. A cross-site scripting vulnerability exists in GoCD versions 19.11.0 through 21.4.0, which could be exploited by attackers to obtain a GoCD user's session cookie and execute malicious code...

IBM Sterling Partner Engagement Manager访问控制错误漏洞

IBM Sterling Partner Engagement Manager is an automation management tool from IBM, U.S.A. An access control error vulnerability exists in IBM Sterling Partner Engagement Manager version 6.2.0, which stems from the lack of a revocation mechanism for JWT tokens. An attacker could exploit the...

TOTOLink A950RG Command Injection Vulnerability

TOTOLink A950RG is a wireless router from TotoLink, China.TOTOLink A950RG V5.9c.4050B20190424 and V4.1.2cu.5204B20210112 versions are vulnerable to command injection, which can be exploited by attackers to execute arbitrary commands via the QUERYSTRING parameter. to execute arbitrary commands...

Google Tensorflow has an unspecified vulnerability (CNVD-2022-09902)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A security vulnerability exists in Google TensorFlow that could be exploited to trigger a denial of service by changing the SavedModel on disk...

WordPress Code Snippets plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. cross-site scripting vulnerability exists in versions of the Code Snippets plugin for WordPress prior to 2.14.3,...

BookStack Access Control Error Vulnerability

BookStack is an open source set of BookStackApp Bookstackapp team's platform for building wiki documents using PHP and Laravel. bookstackapp suffers from an access control error vulnerability that stems from the fact that users with API access can view any attachments to which they do not have re...

Gerapy Authentication Remote Command Execution Vulnerability

Gerapy is a crawler framework based on the Scrapy Scrapyd Scrapyd Client Scrapyd API Django. Gerapy authenticates remote command execution vulnerabilities, which can be exploited by attackers to gain control of the server...

Biqs It Biqs-drive Local File Inclusion Vulnerability

Biqs It Biqs-drive is an online driving school software from the Belgian company Biqs It. BIQS IT Biqs-drive v1.83 and below is vulnerable to a local file inclusion vulnerability, which could be exploited by attackers to read arbitrary files from the server using the privileges of the configured...

WordPress Easy Social Icons Cross-Site Scripting Vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Easy Social Icons plugin is a WordPress open source application plugin. WordPress Easy Social Icons plugin in...

Google TensorFlow divide-by-zero error vulnerability (CNVD-2021-36562)

Google TensorFlow is an end-to-end open source machine learning platform. A divide-by-zero error vulnerability exists in the tf.rawops.Conv3DBackprop implementation in TensorFlow versions prior to 2.5.0. No detailed vulnerability details are provided at this time...

Cacti1 SQL Injection Vulnerability

Cacti is a set of open source network traffic monitoring and analysis tools from the Cacti team. The tool through snmpget to get the data , using RRDtool drawing graphs to analyze , and provide data and user management features . A SQL injection vulnerability exists in the color.php file in Cacti...

Mozilla Firefox Denial of Service Vulnerability (CNVD-2024-10431)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from a denial of service vulnerability caused by an error when using certain WASM files in devtools. An attacker can exploit the vulnerability to cause the browser to crash...

Linux Kernel Denial of Service Vulnerability (CNVD-2024-14766)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A denial of service attack vulnerability exists in the Linux Kernel. The vulnerability is due to a memory leak found in ctnetlinkcreateconntrack in...

Siemens Industrial Product Denial of Service Vulnerability (CNVD-2022-87984)

SIMATIC Drive Controllers for the automation of production machines combine the functionality of SIMATIC S7-1500 CPUs with that of SINAMICS S120 drive controls.SIMATIC ET 200SP Open Controller is the PC-based version of the SIMATIC S7-1500 controller. Includes optional visualization features and...

Airtable.js misconfiguration vulnerability

Airtable.js is Airtable open source an Airtable javascript client . Provides a simple way to access the data . A misconfiguration vulnerability exists in Airtable.js versions prior to 0.11.6 that stems from a misconfiguration in a script that binds environment variables to the build target of a...

Hitachi Energy PCM600 Information Disclosure Vulnerability

The Hitachi Energy PCM600 is a simplified management tool for protection and control relays from Hitachi, Japan. An information disclosure vulnerability exists in Hitachi Energy PCM600. The vulnerability stems from where IED credentials are stored in the PCM600 database in plaintext format. An...

Multiple Siemens Products Cross-Site Request Forgery Vulnerability

SIMATIC Drive Controllers are designed for the automation of production machines, combining the functionality of SIMATIC S7-1500 CPUs and SINAMICS S120 Drive Controllers.SIMATIC PC Station is a software component that manages the interface between SIMATIC software products and the PC. SIMATIC...

Rails Cross-Site Scripting Vulnerability (CNVD-2022-58235)

Rails is a set of Rails team based on the Ruby language open source web application framework. Rails suffers from a cross-site scripting vulnerability that stems from the program's lack of data validation filtering of user-supplied data and output. An attacker can exploit the vulnerability to...

SIEMENS Teamcenter Hardcoded Default Credentials Vulnerability

Teamcenter software is a modern, adaptable product lifecycle management PLM system that connects people and processes across functional silos through digital threads to enable innovation.SIEMENS Teamcenter is vulnerable to a hard-coded default credential vulnerability that originates in the Java ...

WordPress Sitemap by click5 plugin存在未明漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Sitemap by click5 plugin version 1.0.36 has a security vulnerability that could be exploite...

Ericom PowerTerm WebConnect Cross-Site Scripting Vulnerability

Ericom PowerTerm WebConnect is a web browser. version 6.0 of Ericom PowerTerm WebConnect is vulnerable to a cross-site scripting vulnerability that originates when the login portal insecurely writes a cross-site scripting attack load to a page from an AppPortal cookie. An attacker could exploit...

Fortinet fortimanager access control error vulnerability (CNVD-2022-18532)

Fortinet FortiGate is a network security platform from Fortinet, Inc. The platform provides firewall, anti-virus and intrusion prevention IPS, application control, anti-spam, wireless controller, and WAN acceleration.Fortinet fortimanager has an access control error vulnerability that is caused b...

Google Tensorflow Resource Management Error Vulnerability (CNVD-2022-09883)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. Google Tensorflow is vulnerable to resource management errors, which can be exploited by attackers to cause mismanagement of resources...

Rosario Student Information System SQL Injection Vulnerability

The Rosario Student Information System is a free student information system used for school administration, and a SQL injection vulnerability exists in the Rosario Student Information System, which can be exploited to execute Postgre SQL statements via the /Side.php parameter via the syear...

D-Link DIR-X6060 and D-Link DIR-X1560 Denial of Service Vulnerability

The D-Link DIR-X6060 and D-Link DIR-X1560 are both routers from D-Link, a Taiwan-based company. The security vulnerabilities in the D-Link DIR-X6060 and D-Link DIR-X1560 could be exploited to disconnect wireless clients by sending specific spoofed SAE authentication frames...

Delta Electronics DOPSoft 2 Out-of-Bounds Write Vulnerability

Delta Electronics DOPSoft is a set of human-machine interface HMI software from Delta Electronics in Taiwan, China. An out-of-bounds write vulnerability exists in Delta Electronics DOPSoft 2, which can be exploited by an attacker to execute code in the context of the current process...

Google TensorFlow buffer overflow vulnerability (CNVD-2021-64543)

Google TensorFlow, an end-to-end open source platform for machine learning from Google, Inc. is vulnerable to security flaws that could be exploited by attackers by sending specially crafted illegal parameters to "BoostedTreesSparseCalculateBestFeatureSplit" by sending specially crafted illegal...

CloudBees Jenkins Dashboard View Plugin Cross-Site Scripting Vulnerability (CNVD-2021-36583)

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site scripting...

Apache Tapestry Code Execution Vulnerability

Apache Tapestry is the United States Apache Apache Foundation of a Web application framework written in the Java language . Apache Tapestry has a security vulnerability that can be exploited by an attacker to download the file "AppModule.class" by requesting the URL "http: localhost: 8080 assets...

CloudMe Buffer Overflow Vulnerability

CloudMe is a file storage service that includes cloud storage, file synchronization, and client browsing software. A buffer overflow vulnerability exists in CloudMe. A remote attacker could exploit this vulnerability to execute arbitrary code...

Artifex Ghostscript Denial of Service Vulnerability

Artifex Ghostscript is an open source Postscript a page description language and programming language used in the electronics industry and desktop publishing parser from Artifex Software that displays Postscript files and prints them on non-Postscript printers. Postscript file. A security...

Google Chrome Crash reporting component buffer overflow vulnerability

Google Chrome is a web browser from Google, Inc. A buffer overflow vulnerability exists in versions prior to Google Chrome 111.0.5563.64, which stems from a boundary error in the Crash reporting component when handling untrusted input. A remote attacker could exploit this vulnerability to obtain...

Fortinet FortiADC Input Validation Error Vulnerability

Fortinet FortiADC is an application delivery controller from Fortinet, Inc. An input validation error vulnerability exists in Fortinet FortiADC, which stems from improper input validation of the application and could be exploited by an authenticated attacker to retrieve a file with a specific...

Google TensorFlow Input Validation Error Vulnerability (CNVD-2023-15775)

Google TensorFlow is an open source platform for machine learning from Google, Inc. An input validation error vulnerability exists in Google TensorFlow, which stems from the fact that entering 'densefeatures' or 'examplestatedata' that is not rank 2 will trigger a 'CHECK' failure in...

Google TensorFlow tf.raw_ops.FusedResizeAndPadConv2D buffer overflow vulnerability

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A buffer overflow vulnerability exists in Google TensorFlow versions prior to 2.7.4, 2.8.0 and later, 2.8.1 and later, 2.9.0 and later, and 2.9.1 and earlier, which originates from "tf.rawops...

ISC BIND input validation error vulnerability

ISC BIND is a set of open source software from ISC that implements the DNS protocol. ISC BIND is vulnerable to an input validation error, which could be exploited by an attacker to cause a query to the wrong server, returning an error message to the client...

F5 NGINX Instance Manager Denial of Service Vulnerability

NGINX Instance Manager NIM is part of F5's NGINX Management Suite NMS.The NIM module provides a REST API that uses standard authentication methods and HTTP response code, among other things.A denial of service vulnerability exists in F5 NGINX Instance Manager, which stems from a When using NGINX...

LDAP Account Manager File Upload Vulnerability

LDAP Account Manager is a web front-end for managing entries stored in LDAP directories e.g., users, groups, DHCP settings. file upload vulnerability exists in LDAP Account Manager LAM versions prior to 8.0, which stems from a faulty regular expression that allows PHP scripts to be uploaded to th...

Advantech iView Command Injection Vulnerability (CNVD-2023-16477)

Advantech iView, a Simple Network Protocol SNMP based software from Advantech, China, for managing B B SmartWorx devices, is vulnerable to a command injection vulnerability in versions prior to Advantech iView 5.7.04.6469, which stems from the use of a special element in a command that is not...

WAVLINK WN535 G3 Information Disclosure Vulnerability

WAVLINK WN535 G3 is a wireless router from WAVLINK China.WAVLINK WN535 G3 version M35G3R.V5030.180927 is vulnerable to an information disclosure vulnerability that stems from improper authorization management on the livemfg.shtml page, which could be exploited by an attacker to obtain sensitive...

TOTOLINK N600R Command Injection Vulnerability (CNVD-2022-53560)

TotoLink N600R is a wireless router from TotoLink, Taiwan, China. TotoLink N600R is vulnerable to command injection, which can be exploited by attackers via the exportOvpn interface of cstecgi.cgi...

IBM AIX Denial of Service Vulnerability (CNVD-2022-48944)

IBM AIX is an open standards-based UNIX operating system developed by IBM for the IBM Power architecture. IBM AIX denial of service vulnerability, which stems from inadequate validation of user-supplied input in the product's nimsh daemon, can be exploited by remote attackers to cause a denial of...

Linux kernel information disclosure vulnerability (CNVD-2022-68595)

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. Linux kernel has a security vulnerability that can be exploited by attackers to obtain internal kernel memory information...

WordPress RegistrationMagic plugin SQL injection vulnerability

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports setting up personal blogging sites on servers with PHP and MySQL.The WordPress RegistrationMagic plugin was vulnerable to SQL injection before 5.0.1.6, which stems from the la...

WordPress WPS Hide Login plugin authorization issue vulnerability

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on PHP and MySQL servers. WordPress WPS Hide Login plugin has an authorization issue vulnerability in versions prior to 1.9.1, which ste...

json-pointer has an unspecified vulnerability

Json-Pointer is an open source, Rfc 6901 described by Manuel Stofer, a Swiss individual developer of some utilities for Json pointers. json-pointer has a security vulnerability that stems from improper design or implementation during the code development of a web-based system or product. No...

Xiuno BBS Cross-Site Scripting Vulnerability (CNVD-2021-85273)

Xiuno BBS is an open source forum program based on PHP and MySQL. Xiuno BBS suffers from a cross-site scripting vulnerability that originates from the failure of the product/admin/?setting-base.htm page to properly handle data in the sitename field. An attacker can execute client-side code via th...

OpenSSH user enumeration vulnerability (CNVD-2018-20962)

OpenSSH OpenBSD Secure Shell is a set of connection tools for secure access to remote computers maintained by the OpenBSD Project Group. The tools are an open source implementation of the SSH protocol and support encryption of all transmissions, effectively blocking eavesdropping, connection...

Python Tablib Arbitrary Command Execution Vulnerability

Tablib is a Python library related to tabular format data that allows importing, exporting, and managing tabular format data. An arbitrary command execution vulnerability exists in Python Tablib version 0.11.4, which allows an attacker to execute arbitrary script code in the context of an affecte...

Foxit PDF Reader Information Disclosure Vulnerability (CNVD-2024-20600)

Foxit PDF Reader is China Foxit Foxit company a PDF reader. Foxit PDF Reader has an information disclosure vulnerability that originates from a post-release reuse issue in the Annotation module, which can be exploited by an attacker to obtain sensitive information...