Oracle MySQL Cluster Input Validation Error Vulnerability (CNVD-2022-17693)

Oracle MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database developed by Oracle Corporation USA. Oracle MySQL Cluster is vulnerable to an input validation error that could be exploited by attackers to corrupt or delete data...

OnionShare has an unspecified vulnerability (CNVD-2022-06479)

OnionShare is an open source tool for securely and anonymously sharing files, hosting websites, and chatting with friends using the Tor network. OnionShare has a security vulnerability, and no details of the vulnerability are available...

Trendnet AC2600 TEW-827DRU Trust Management Issue Vulnerability

The Trendnet AC2600 TEW-827DRU is a wireless router that has a security vulnerability that could be exploited by attackers to back up and restore device configurations through the management web interface. The devices are encrypted using the hard-coded password "12345678"...

Teeworlds buffer overflow vulnerability

Teeworlds is an online multiplayer shooter game. Teeworlds suffers from a buffer overflow vulnerability that originates when a networked system or product performs an operation on memory that does not properly validate data boundaries, resulting in an incorrect read or write operation being...

Zoho ManageEngine Desktop Central MSP Licensing Issue Vulnerability

ZOHO ManageEngine Desktop Central MSP is a suite of desktop and mobile device management software for MSPs managed service providers from ZOHO. The software enables MSPs to remotely manage desktops, servers, and mobile devices in their customer networks and provides differentiated management...

Apache Druid LoadData has an arbitrary file reading vulnerability

A security vulnerability exists in Apache Druid, a column-oriented open source distributed database written in Java by the Apache Foundation, which stems from the fact that InputSource is used to read data from a data source in the Druid ingestion system. However, the HTTP InputSource allows an...

Cobbler Arbitrary File Writing Vulnerability

Cobbler is a network installation server suite, which is mainly used to quickly set up Linux network installation environment.Cobbler in versions prior to 3.3.0 there is an arbitrary file writing vulnerability, the vulnerability originates from the system does not do effective filtering of user...

Accela Civic Platform Information Disclosure Vulnerability

Accela Civic Platform is a cloud-based solution for Accela's application software to modernize city systems for land management and code enforcement, increased citizen engagement and mobile information access. information disclosure vulnerabilities exist in versions of Accela Civic Platform prior...

CloudBees Jenkins AWS CodeBuild Plugin Information Disclosure Vulnerability

CloudBees Jenkins is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and a number of timed tasks.AWS CodeBuild Plugin is used in one of the test projec...

Foxit Reader Text Annotations Remote Code Execution Vulnerability

Foxit Reader is a small PDF document viewer and printing program. Foxit Reader has a security vulnerability in the Text Annotations handling, which can be exploited to execute arbitrary code in the current process context due to a lack of validation before performing operations on objects...

Multiple SQL Injection Vulnerabilities in MetalGenix GeniXCMS

MetalGenix GeniXCMS is a PHP-based content management system and framework CMSF from MetalGenix Indonesia, which provides modules for user management, content management and menu management. Multiple SQL injection vulnerabilities exist in the inc/lib/User.class.php file in MetalGenix GeniXCMS...

SPIP Remote Code Execution Vulnerability

SPIP is a free Web-based content publishing system. The system is primarily used for online collaboration. A remote code execution vulnerability exists in SPIP 3.1.2 and prior versions. An attacker could exploit this vulnerability to execute arbitrary code at an affected site...

Google Chrome Skia Denial of Service Vulnerability (CNVD-2016-07581)

Google Skia is the United States Google Google company's an open source and C + + based graphics library , it can be used in Mozilla Firefox, Google Chrome and other browsers , but also available in the Android open mobile platform . A denial of service vulnerability exists in the SkPath.cpp file...

Symantec Endpoint Protection Manager Authentication Bypass Vulnerability

Symantec Endpoint Protection Manager SEPM is a suite of enterprise-grade virus protection software from Symantec USA. The software protects against malicious attacks such as viruses, worms, and Trojan horses. SEPM 12.1-RU6-MP1 A security vulnerability exists in the management console of previous...

Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability (CNVD-2023-28104)

Microsoft PostScript Printer Driver is a Microsoft standard printer driver for PostScript printers from Microsoft USA. Microsoft PCL6 Class Printer Driver is a printer driver software from Microsoft Corporation. Microsoft PostScript and PCL6 Class Printer Driver contains an information disclosure...

Linux kernel ksmbd module buffer overflow vulnerability

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. Linux kernel ksmbd module is vulnerable to a buffer overflow vulnerability that can be exploited by attackers to conduct remote denial of service attacks...

IBM Cognos Analytics Server-Side Request Forgery Vulnerability

IBM Cognos Analytics is a suite of business intelligence software from IBM in the United States. The software includes reports, dashboards, and scorecards, and can assist companies in adjusting their decisions by analyzing such things as key factors and key people. A server-side request forgery...

Bento4 Ap4DataBuffer.cpp Denial of Service Vulnerability

Bento4 is an open source C++ library for reading and writing MP4 files. A denial of service vulnerability exists in Bento4 version 1.6.0-639, which stems from excessive memory consumption in the AP4DataBuffer::ReallocateBuffer function in Core/Ap4DataBuffer.cpp. An attacker can exploit the...

WordPress plugin Metform information leakage vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress plugin Metform is vulnerable to an information disclosure vulnerability, which stems from...

Shopware Code Problem Vulnerability (CNVD-2022-31768)

Shopware is a German Shopware company's open source e-commerce software. A code issue vulnerability exists in Shopware that stems from the fact that in the affected version, a user session is not logged off if the password is reset via password recovery. An attacker could exploit the vulnerabilit...

Atlassian Fisheye and Crucible Directory Traversal Vulnerabilities

Atlassian Fisheye is a suite of source code depth viewers.Crucible is a suite of code review tools. Atlassian Fisheye and Crucible contain a security vulnerability that can be exploited by an attacker to view arbitrary files on a system...

SyliusGridBundle SQL Injection Vulnerability

SyliusGridBundle is an open source e-commerce solution built from decoupled components with a robust API and the highest quality code.A SQL injection vulnerability exists in SyliusGridBundle versions prior to 1.10.1 and prior to 1.11-rc2, which stems from the fact that values added at the end of ...

Tp-link TL-WR840N has an unspecified vulnerability

Tp-link TL-WR840N is a wireless router from Tp-link, China. TP-LINK TL-WR840NES V6.20 version 180709 is vulnerable due to a lack of filtering and escaping of command parameters in the component oalstartPing. No details of the vulnerability are available at this time...

Fleet Licensing Issue Vulnerability (CNVD-2022-08935)

Fleet is a suite of host monitoring platforms. fleet suffers from an authorization issue vulnerability that stems from a limited ability to spoof SAML authentication with missing user authentication. No detailed vulnerability details are currently available...

Google TensorFlow null pointer dereference vulnerability (CNVD-2021-64074)

Google TensorFlow is an end-to-end open source machine learning platform. a null pointer dereference vulnerability exists in the tf.rawops.SparseTensorSliceDataset implementation in versions prior to Google TensorFlow 2.6.0. No detailed vulnerability details are available at this time...

Nexus Control Panel Out-of-Bounds Writing Vulnerability

Swisslog Healthcare Nexus Panel is a medical device from Swisslog Healthcare.An out-of-bounds write vulnerability exists in versions prior to Nexus Control Panel 7.2.5.7. An attacker could exploit this vulnerability to cause a stack buffer overflow...

cae input validation error vulnerability (CNVD-2021-25664)

cae is a compression/decompression software package. An input validation error vulnerability exists in the ExtractTo feature in all versions of cae, which stems from the program failing to properly escape the path to a file in a zip archive, and can be exploited by an attacker to add or replace...

Verodin Information Disclosure Vulnerability

Verodin is a suite of network security inspection platforms from Verodin, Inc. in the United States. The platform is primarily used to test the effectiveness of security protections for networks, endpoints, email, and cloud controls.Director is Verodin's console program. An information disclosure...

Ovidentia Cross-Site Scripting Vulnerability

Ovidentia is an open source content management system and collaboration platform based on PHP and MySQL by the French CANTICO team, which can be used for publishing and managing projects, publication and article management, schedule sharing, and more. A cross-site scripting vulnerability exists i...

Green Hills INTEGRITY RTOS Memory Address Information Leakage Vulnerability

INTEGRITY is a real-time operating system RTOS from Green Hills Software. A memory address information leakage vulnerability exists in the Interpeak IPCOMShell TELNET server in Green Hills INTEGRITY RTOS 5.0.4. The vulnerability stems from an undocumented shell command "prompt" that sets the prom...

Mattermost Authorization Issue Vulnerability (CNVD-2024-13545)

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an authorization issue vulnerability that stems from an inability to check the "inviteguest" permission when inviting people from other teams to join the team. A privileged...

FreeImage C_IStream::read function buffer overflow vulnerability

FreeImage is a cross-platform open source library for supporting popular graphic image formats. A buffer overflow vulnerability exists in the FreeImage CIStream::read function, which originates from a boundary error in the CIStream::read function of the PluginEXR.cpp file when handling untrusted...

Schneider Electric Easy UPS Online Monitoring Software Access Control Error Vulnerability

Schneider Electric Easy UPS Online Monitoring Software is a power monitoring software from the French company Schneider Electric Schneider Electric. The Schneider Electric Easy UPS Online Monitoring Software suffers from an Access Control Error vulnerability that stems from a lack of authenticati...

Campcodes Advanced Online Voting System SQL Injection Vulnerability (CNVD-2023-29414)

Campcodes Advanced Online Voting System is an online voting system. Campcodes Advanced Online Voting System v1.0 is vulnerable to SQL injection. The vulnerability stems from the lack of validation of external input SQL statements in the parameter voter of the file login.php, which can be exploite...

SAP NetWeaver AS Licensing Issue Vulnerability

SAP NetWeaver AS is a SAP Web Application Server from SAP Germany. It not only provides network services, but also is the basic platform for SAP software. SAP NetWeaver AS version 7.50 has an authorization problem vulnerability, which stems from the lack of authentication checks and can be...

Fortinet FortiWeb Cross-Site Scripting Vulnerability (CNVD-2023-18299)

Fortinet FortiWeb is a Web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures Web applications and protects sensitive database content. A cross-site scripting vulnerability exists...

GE CIMPLICITY HMI/SCADA Software Buffer Overflow Vulnerability

GE CIMPLICITY HMI/SCADA Software is an automated industrial platform from General Electric GE. It provides true client-server visualization and control from a single machine to plant locations around the world, helping to manage operations and improve decision making. A buffer overflow...

Google TensorFlow Input Validation Error Vulnerability (CNVD-2023-15780)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. Google TensorFlow is vulnerable to an input validation error that could be exploited by an attacker to cause a denial of service...

SAP Customer Data Cloud Encryption Issue Vulnerability

SAP Customer Data Cloud is a tool from SAP Germany that provides digital customer identity and access management. It enables companies to collect, aggregate and manage customer data across multiple touch points and applications. An encryption issue vulnerability exists in SAP Customer Data Cloud...

Nasm buffer overflow vulnerability (CNVD-2022-69151)

Nasm is an open source programming tool software. A buffer overflow vulnerability exists in Nasm v2.16, which stems from the inclusion of a stack overflow in the Ndisasm component. No detailed vulnerability details are provided at this time...

WhatsApp Digital Error Vulnerability

WhatsApp is a suite of mobile applications from the American company WhatsApp that use the Internet to send text messages. The application uses the contact information in a smartphone to find contacts using the program to send texts, pictures, etc. WhatsApp suffers from a numeric error...

Google TensorFlow CollectiveGather Denial of Service Vulnerability

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A denial-of-service vulnerability exists in Google TensorFlow, which stems from the fact that when CollectiveGather receives a scalar input input, it gives an assertion of failure, which can be exploite...

Vapor Denial of Service Vulnerability

Vapor is a Swift web development framework. Can be used to develop high-performance Web applications , support for iOS, OS X and Ubuntu systems. A denial-of-service vulnerability exists in Vapor versions prior to 4.61.1 that stems from not properly handling incoming error messages and can be...

Linux kernel denial of service vulnerability

Linux kernel is the kernel used by the Linux Foundation in the U.S. A denial-of-service vulnerability exists in Linux kernel, which stems from a memory write out-of-bounds flaw in the UDF file system functionality. An attacker could exploit this vulnerability to crash the system...

Nextcloud Android app information leakage vulnerability

Nextcloud Android app is an Android-based mobile application for accessing Nextcloud servers from the German company Nextcloud. nextcloud Android app versions prior to 3.19.0 are vulnerable to an information disclosure vulnerability that stems from insufficient privilege restrictions. An attacker...

Qt path traversal vulnerability

Qt is a cross-platform C application development framework from the Norwegian company Qt. It is widely used for developing GUI programs, in which case it is also known as the widget toolkit. It can also be used to develop non-GUI programs, such as console tools and servers.Qt versions prior to...

Gitea Cross-Site Scripting Vulnerability (CNVD-2022-11525)

A cross-site scripting vulnerability exists in Gitea, a Go-based lightweight git service developed by the Gitea community. The vulnerability stems from a mirror setting in the product wiki/issue link that does not effectively handle special characters in the input data. An attacker could execute...

Lantronix PremierWave 2050 path traversal vulnerability (CNVD-2022-01589)

The Lantronix PremierWave 2050 is an embedded enterprise Wi-Fi module from Lantronix, Inc. It is used to provide reliable and always-on 5G Wi-Fi connectivity. The Lantronix PremierWave 2050 suffers from a path traversal vulnerability that stems from the lack of effective restrictions and filters ...

Palo Alto Networks PAN-OS SCEP feature command injection vulnerability

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances.A command injection vulnerability exists in Palo Alto Networks PAN-OS, which stems from an OS command injection vulnerability in the software's SCEP Simple Certificate The...

WECON PLC Editor Stack Buffer Overflow Vulnerability (CNVD-2021-93633)

WECON PLC Editor is a PLC programming software.WECON PLC Editor 1.3.8 and earlier versions are vulnerable to a stack buffer overflow. An attacker can exploit this vulnerability to execute arbitrary code...