PHPEMS deserialization vulnerability (CNVD-2024-13536)

PHPEMS is a PHP online mock exam system. PHPEMS has a deserialization vulnerability, the vulnerability arises because there is a function index in app/weixin/controller/index.api.php, which can be exploited by an attacker to cause deserialization via the parameter picurl...

Apache Airflow ODBC Provider Remote Code Execution Vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. A remote code execution vulnerability exists in Apache Airflow ODBC Provider, which can be exploited by an attacker to cause command execution...

Directory Traversal Vulnerability in GitLab CE/EE

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is the GitLab Enterprise Edition and GitLab CE is the GitLab Community Edition. GitLab CE/...

Unspecified Vulnerability in Oracle MySQL Server (CNVD-2023-65518)

Oracle MySQL Server is a relational database from Oracle Corporation. A security vulnerability exists in Oracle MySQL Server, which can be exploited by an attacker to cause unauthorized MySQL connector hangs or frequent and repeated crashes, as well as unauthorized update, insert, or delete acces...

Google TensorFlow tf.raw_ops.ImageProjectiveTransformV2 buffer overflow vulnerability

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A buffer overflow vulnerability exists in Google TensorFlow versions prior to 2.8.4, 2.9.0 and later, and 2.9.3 and earlier, which stems from a lack of proper validation of user-supplied data in...

Product Show Room Site SQL Injection Vulnerability (CNVD-2022-48962)

Product Show Room Site is a product showroom site from Carlo Montero's personal developer. version 1.0 of Product Show Room Site is vulnerable to SQL injection, which originates from the /psrs/admin/?page=user/manageuser&id= page. SQL injection problem. No detailed vulnerability details are...

Jenkins Selection Tasks Plugin跨站脚本漏洞

Jenkins and Jenkins Plugin are both open source products from Jenkins.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.A cross-site scripting vulnerability...

Google Android Elevation of Privilege Vulnerability (CNVD-2022-47670)

Google Android is a Linux-based open source operating system from Google, Inc. An elevation of privilege vulnerability exists in Google Android, which originates in checkSlicePermission in SliceManagerService.java, due to an input validation error, it is possible to access any slice URI, and an...

WordPress Page Builder KingComposer plugin access control error vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress Page Builder KingComposer plugin version...

Google Tensorflow has an unspecified vulnerability (CNVD-2022-09902)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A security vulnerability exists in Google TensorFlow that could be exploited to trigger a denial of service by changing the SavedModel on disk...

UpdateStar HD-Network Real-time Monitoring System Path Traversal Vulnerability

UpdateStar HD-Network Real-time Monitoring System is a high-definition network real-time monitoring system from UpdateStar, a German company. updateStar HD-Network Real-time Monitoring System in version 2.0 is vulnerable to path traversal vulnerability, which stems from the failure of a network...

Google TensorFlow Data Falsification Issue Vulnerability

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow suffers from a data forgery vulnerability that stems from a lack of validation of invalid file formats in the checkpoint loading infrastructure, which can be exploited by an...

Advanced SystemCare Ultimate Elevation of Privilege Vulnerability (CNVD-2021-57452)

Advanced SystemCare Ultimate, a Windows optimization suite from Iobit that analyzes system performance bottlenecks, is vulnerable to an elevation of privilege vulnerability in Advanced SystemCare Ultimate version 14.2.0.220. A local attacker can exploit this vulnerability by sending a malicious I...

Multiple Huawei products command injection vulnerabilities

Huawei S12700 and others are an enterprise-class switch product from Huawei China. A number of Huawei products command injection vulnerability, attackers can use the vulnerability to send malicious parameters can be injected into the command line, affecting normal functionality...

Wireshark MIME Parser Denial of Service Vulnerability

Wireshark is a suite of network packet analysis software from the Wireshark team. A security vulnerability in the processing of messages by the Wireshark MIME parser can be exploited by a remote attacker to submit a special request that can crash an application...

Apple macOS Denial of Service Vulnerability (CNVD-2026-19032)

Apple macOS is a specialized operating system developed by Apple for Mac computers. A denial of service vulnerability exists in Apple macOS, which can be exploited by an attacker to cause an application to cause an unexpected system termination...

OpenClaw Information Disclosure Vulnerability (CNVD-2026-13370)

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from an information disclosure vulnerability. The vulnerability stems from the fact that skills.status may return raw parsed configuration values for the skills.config path via configChecks, which can be...

Unspecified Vulnerability in Oracle Java SE (CNVD-2025-24093)

Oracle Java SE is a U.S. Oracle Oracle company for the development and deployment of desktop, server and embedded devices and real-time environments in the Java application. A security vulnerability exists in Oracle Java SE for Oracle Java SE and Oracle GraalVM for JDK, which can be exploited by...

SQL Injection Vulnerability in PbootCMS

PbootCMS is the new core and permanent open source free PHP enterprise web development and construction management system. PbootCMS SQL injection vulnerability , attackers can exploit the vulnerability to obtain sensitive database information...

AutomationDirect P3-550E Access Control Error Vulnerability

The AutomationDirect P3-550E is a programmable control system PLC from AutomationDirect USA. An access control error vulnerability exists in AutomationDirect P3-550E version 1.2.10.9, which can be exploited by an attacker to cause arbitrary writes by sending specially crafted network packets...

Graylog Authorization Issues Vulnerability

Graylog is a centralized log management solution from Graylog USA. The product supports capturing, storing and analyzing logs in real time, among other things. Graylog has an authorization issue vulnerability that stems from the presence of a cookie injection vulnerability. A remote attacker coul...

F5 BIG-IP Denial of Service Vulnerability (CNVD-2023-75597)

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management and other functions. A denial of service vulnerability exists in F5 BIG-IP, which can be exploited by attackers to cause a denial o...

Google Android Information Disclosure Vulnerability (CNVD-2023-82065)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability that stems from improper input validation in the parseInputs module of ShimPreparedModel.cpp, which may result in out-of-bounds reads. An attacker can...

Siemens SIMATIC WinCC OA Ultralight Client Parameter Injection Vulnerability

SIMATIC WinCC Open Architecture OA is part of the SIMATIC HMI family. It is designed for applications that require a high degree of customer-specific adaptability, large or complex applications, and projects that require specific system requirements or functionality. A parameter injection...

Google Chrome Lacros Graphics code execution vulnerability

Google Chrome is a web browser from Google, Inc. A code execution vulnerability exists in Google Chrome Lacros Graphics, which can be exploited by attackers to execute arbitrary code on a system or cause a denial of service...

Google Chrome Type Obfuscation Vulnerability

Google Chrome is a web browser from Google, an American company. A type obfuscation vulnerability exists in versions of Google Chrome prior to V8 108.0.5359.71, which can be exploited by remote attackers to launch an attack via a crafted HTML page using heap corruption...

Google TensorFlow Input Validation Error Vulnerability (CNVD-2023-15775)

Google TensorFlow is an open source platform for machine learning from Google, Inc. An input validation error vulnerability exists in Google TensorFlow, which stems from the fact that entering 'densefeatures' or 'examplestatedata' that is not rank 2 will trigger a 'CHECK' failure in...

strongSwan trust management issue vulnerability

strongSwan is a set of open source IPsec-based VPN solution for Linux platforms used by Andreas Steffen, a personal developer in Switzerland. The solution contains X.509 public key certificates, secure storage private keys, smart cards and other authentication mechanisms. strongSwan versions prio...

Jenkins OpsGenie Plugin Information Disclosure Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.An information disclosure vulnerability...

SIEMENS SCALANCE XM-400 and XR-500 OSPF Packet Processing Vulnerability

SCALANCE X switches are used to connect industrial components such as programmable logic controllers PLCs or human machine interfaces HMIs. An OSPF packet handling vulnerability exists in the SIEMENS SCALANCE XM-400 and XR-500, which stems from the implementation of the OSPF protocol in the devic...

Google Android Buffer Overflow Vulnerability (CNVD-2022-47671)

Google Android is a Linux-based open source operating system from Google, Inc. Google Android is vulnerable to a buffer overflow vulnerability that originates in l2cbleprocesssigcmd in l2cble.cc, which could result in an out-of-bounds read due to a boundary check error The vulnerability can be...

Microsoft Windows Common Log File System Driver权限提升漏洞

Microsoft Windows Common Log File System Driver is a Microsoft Corporation Common Log File System CLFS API that provides a high-performance, common log file subsystem that can be used by dedicated client applications and shared by multiple clients to optimize log access. An elevation-of-privilege...

Shopware Access Control Error Vulnerability

Shopware is a suite of open source e-commerce software from the German company Shopware. Shopware is vulnerable to an access control error that stems from not properly setting sensitive HTTP headers to non-cacheable, which could be exploited by an attacker to enable HTTP caching and then have...

snapd competition condition issue vulnerability

Snapd is an open source, cross-platform package management tool. snapd is vulnerable to a contention issue, which can be exploited by local attackers to gain root privileges and execute arbitrary code to gain privilege escalation by binding to mount their own content in snap's private mount...

Google Tensorflow Buffer Overflow Vulnerability (CNVD-2022-09888)

Google TensorFlow is a set of end-to-end open source platform for machine learning from Google Google Inc. Google TensorFlow has a buffer overflow vulnerability, which stems from the fact that TensorFlow is vulnerable to heap OOB write attacks in er. No detailed vulnerability details are currentl...

Google Tensorflow Resource Management Error Vulnerability (CNVD-2022-09858)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow suffers from a resource management error vulnerability that can be exploited by an attacker to cause use-after-release behavior when decoding PNG images...

JerryScript has an unspecified vulnerability (CNVD-2022-07244)

JerryScript, a lightweight JavaScript engine from the JerryScript project, has a security vulnerability in version 3.0.0 of JerryScript, which originates in /jerry-core/ecma/operations/ecma-objects.c The ecmaobjectcheckclassnameisobject objp declaration in /jerry-core/operations/ecma-objects.c...

Oracle MySQL Cluster Input Validation Error Vulnerability (CNVD-2022-17693)

Oracle MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database developed by Oracle Corporation USA. Oracle MySQL Cluster is vulnerable to an input validation error that could be exploited by attackers to corrupt or delete data...

WordPress WP_Query SQL Injection Vulnerability

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress has a SQL injection vulnerability in versions prior to 5.8.3, which stems from the lack of validation of externally...

Google Chrome Post-release Reuse Vulnerability (CNVD-2021-62188)

Chrome is a web browsing tool developed by Google, and a post-release reuse vulnerability exists in the File System API in versions prior to Google Chrome 92.0.4515.131. An attacker could use this vulnerability to execute arbitrary code or cause a denial of service condition on the system...

Cisco Adaptive Security Device Manager Remote Code Execution Vulnerability

Cisco Adaptive Security Device Manager ASDM is a simple, GUI-based firewall device management application. a remote code execution vulnerability exists in Cisco Adaptive Security Device Manager ASDM version 9.16.1 and earlier. The vulnerability stems from a lack of proper signature verification o...

Wireshark infinite loop vulnerability (CNVD-2022-11207)

Wireshark is a network packet analyzer. Wireshark is a network packet analyzer that captures network packets and displays the most detailed packet information possible.Wireshark uses WinPCAP as an interface to exchange data packets directly with the network card. An infinite loop vulnerability...

Unspecified Vulnerability in Apache HTTP Server (CNVD-2021-44766)

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. Apache HTTP Server has a security vulnerability in modproxywstunnel, modproxyhttp, no details of the vulnerability are provided at...

Siemens SCALANCE and RuggedCmd Device Stack Overflow Vulnerability

SCALANCE SC-600 devices SC622-2C, SC632-2C, SC636-2C, SC642-2C, SC646-2C are used to protect trusted industrial networks from untrusted networks. SCALANCE M-800/S615 industrial routers are used for secure remote access to plants via mobilenetworks such as GPRS or UMTS for secure remote access to...

Mozilla Rust post-release reuse vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. futures-task crate before 0.3.6 for Rust contains a security vulnerability that can be exploited by an attacker to potentially cause use-after-free in the case of non-static types...

CloudBees Jenkins Script Security Plugin Cross-Site Scripting Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Script Security Plugin is used in one of the...

Pi-hole code issue vulnerability

Pi-hole is a web-grade ad-blocking application from Pi-hole.Gravity updater is an auto-updating plugin used in it. A code issue vulnerability exists in gravityDownloadBlocklistFromUrl in Gravity updater in Pi-hole 4.4 and prior versions. An attacker can exploit this vulnerability to write a PHP...

jQuery cross-site scripting vulnerability (CNVD-2021-26411)

jQuery is a set of open source , cross-browser JavaScript library . The library simplifies the operation between HTML and JavaScript , and has a modular , plug-in extensions and other features . A cross-site scripting vulnerability exists in versions of jQuery prior to 3.5.0. The vulnerability...

Green Hills INTEGRITY RTOS Memory Address Information Leakage Vulnerability

INTEGRITY is a real-time operating system RTOS from Green Hills Software. A memory address information leakage vulnerability exists in the Interpeak IPCOMShell TELNET server in Green Hills INTEGRITY RTOS 5.0.4. The vulnerability stems from an undocumented shell command "prompt" that sets the prom...

Mozilla Firefox Bidding Condition Vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A competing conditional vulnerability exists in versions of Mozilla Firefox prior to 131.0.3, which can be exploited by attackers to cause unexpected behavior and cause the browser to crash...