Bluetooth buffer overflow vulnerability in multiple MediaTek chips (CNVD-2022-66252)

MediaTek Inc. is the world's fourth largest fab-based semiconductor company and a leader in the markets of mobile terminals, smart home applications, wireless connectivity and Internet of Things IoT products, with approximately 1.5 billion units of end products with built-in MediaTek chips hittin...

Zabbix Frontend Cross-Site Scripting Vulnerability (CNVD-2022-58412)

Zabbix Frontend is a monitoring software front-end tool from the American company Zabbix. A cross-site scripting vulnerability exists in Zabbix Frontend that stems from a graphical page that lacks checksum filters for user-supplied data and output. An authenticated attacker can exploit this...

Shopware Cross-Site Request Forgery Vulnerability

A cross-site request forgery vulnerability exists in versions of Shopware prior to 5.7.9, which stems from vulnerability to cross-site request forgery CSRF token authentication failures. An attacker could exploit this vulnerability to be subject to a cross-site request forgery CSRF attack...

Huawei HarmonyOS Information Disclosure Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. An information disclosure vulnerability exists in Huawei HarmonyOS version 2.0. The vulnerability stems from the failure to properly validate the Array Index...

WordPress Loco Translate plugin跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WordPress plugin is a WordPress open source application plugin. WordPress Loco Translate plugin version prior to 2.6.1 has a cross-site scripting vulnerability, which can be exploited by attackers t...

Fortinet fortimanager access control error vulnerability (CNVD-2022-18532)

Fortinet FortiGate is a network security platform from Fortinet, Inc. The platform provides firewall, anti-virus and intrusion prevention IPS, application control, anti-spam, wireless controller, and WAN acceleration.Fortinet fortimanager has an access control error vulnerability that is caused b...

Multiple Siemens Industrial Products Denial of Service Vulnerabilities

SIMATIC Drive Controller family products are machines designed for production automation, combining the functionality of the SIMATIC S7-1500 CPU and the SINAMICS S120 drive control.SIMATIC S7-1200 CPU family products are designed for discrete and continuous control in industrial environments such...

Oracle MySQL Input Validation Error Vulnerability (CNVD-2022-09141)

Oracle MySQL Server is a relational database from Oracle Corporation. An input validation error vulnerability exists in MySQL Server, which originates from an input validation error in the Server: Optimizer component in MySQL Server. An attacker can exploit the vulnerability to corrupt or delete...

Discourse Information Disclosure Vulnerability (CNVD-2022-05506)

Discourse is an open source community discussion platform. The platform includes community, email and chat room features.Discourse suffers from an information disclosure vulnerability for which no detailed vulnerability details are currently available...

Redash Code Issue Vulnerability (CNVD-2021-95242)

Redash is a data integration and analysis solution from the Israeli company Redash. The product supports data integration, data visualization, query editing, and data sharing.Redash 10.0.0 and earlier versions are vulnerable to a code issue that stems from the fact that the program is vulnerable ...

json-pointer has an unspecified vulnerability

Json-Pointer is an open source, Rfc 6901 described by Manuel Stofer, a Swiss individual developer of some utilities for Json pointers. json-pointer has a security vulnerability that stems from improper design or implementation during the code development of a web-based system or product. No...

WordPress Weather Effect plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Weather Effect plugin prior to version 1.3.4, whi...

Advantech R-SeeNet Cross-Site Scripting Vulnerability (CNVD-2021-57184)

Advantech R-SeeNet is an industrial monitoring software from Advantech, Taiwan, China. The software is based on the snmp protocol for monitoring platforms and is available for Linux and Windows platforms.A cross-site scripting vulnerability exists in the devicegraphpage.php script function of...

McAfee Agent Code Issue Vulnerability (CNVD-2021-49069)

The McAfee McAfee Agent MA is a set of client components from McAfee, Inc. that provides secure communications between ePolicy Orchestrator the antivirus management platform and managed products. A security vulnerability exists in McAfee Agent in versions prior to 5.7.3. The vulnerability stems...

Google TensorFlow Heap Overflow Vulnerability

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow has a security vulnerability that can be exploited by an attacker to trigger a heap buffer overflow in tf.rawops.BandedTriangularSolve...

Unspecified Vulnerability in Rust (CNVD-2021-36329)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in versions of Rust prior to 2.3.0. The vulnerability stems from the possibility of request smuggling when the program is used behind a reverse proxy. No detailed vulnerability...

SQLiteODBC Competitive Conditions Issue Vulnerability

SQLite is the United States D. Richard Hipp D. Richard Hipp individual developers of a set of C-based open source embedded relational database management system. The system is characterized by independence, isolation, cross-platform and so on. A security vulnerability exists in SQLiteODBC version...

Unspecified Vulnerability in ARM mbed TLS and ARM Mbed Crypto

ARM mbed TLS and ARM Mbed Crypto are both products of ARM UK. ARM mbed TLS is a product that provides secure communication and encryption for mbed products. ARM Mbed Crypto is an implementation of the cryptographic interface to the ARM Platform Security Architecture PSA. A security vulnerability...

OpenSSH User Enumeration Vulnerability (CNVD-2018-20960)

OpenSSH OpenBSD Secure Shell is a set of connection tools for secure access to remote computers maintained by the OpenBSD Project Group. The tools are an open source implementation of the SSH protocol and support encryption of all transmissions, effectively blocking eavesdropping, connection...

GNU Binutils xmalloc.c file memory leak vulnerability

GNU Binutils GNU Binary Utilities is a set of programming language utility programs developed by the American GNU community. The programs are primarily designed to work with target files in a variety of formats, and provide connectors, assemblers, and other tools for target files and archives. A...

SAP HANA Input Validation Error Vulnerability (CNVD-2024-49626)

SAP HANA is a set of high-performance real-time data analytics platform from Germany's SAP SAP. The platform provides data query functions to support users to query real-time business data query and analysis. An input validation error vulnerability exists in the SAP HANA Node.js client, which ste...

Siemens JT2Go Stack Buffer Overflow Vulnerability

JT2Go is a 3D JT viewing tool that allows users to view JT, PDF, Solid Edge, PLM XML with available JT, VFZ, CGM and TIF data. Siemens JT2Go suffers from a stack buffer overflow vulnerability that can be exploited by an attacker to execute code in the context of the current process...

Docassemble Information Disclosure Vulnerability

Docassemble is a free, open source expert system for guided interviews and document assembly. An information disclosure vulnerability exists in Docassemble versions 1.4.53 through 1.4.96, which can be exploited by an attacker to gain unauthorized access to system information by manipulating a URL...

Apache Airflow Path Traversal Vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A path traversal vulnerability exists in Apache Airflow versions prior to 2.6.3,...

Google Android elevation of privilege vulnerability (CNVD-2023-55363)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that originates in the multiple functions obfuscation agent of the AccountManagerService.java component, which can be exploited by an attacker to elevate...

Publify Input Validation Error Vulnerability (CNVD-2023-04309)

Publify is a simple but full-featured web publishing software. versions of Publify prior to 9.2.10 are vulnerable to an input validation error, which stems from the presence of an integer overflow issue. No detailed vulnerability details are currently available...

Binary Vulnerability in Various Cisco Products (CNVD-2023-09623)

The RV340, RV340W, RV345, and RV345P are all small business VPN routers from Cisco. A binary vulnerability exists in several Cisco products, which can be exploited by an attacker to upload files for overwrite operations...

Google TensorFlow buffer overflow vulnerability (CNVD-2022-80696)

Google TensorFlow is an end-to-end open source platform for machine learning from Google Google. Google TensorFlow is vulnerable to a buffer overflow vulnerability that originates when an operation with a specified input size receives a different number of inputs, and the executor will crash. No...

Democritus Project d8s-asns democritus-html code execution vulnerability

Democritus Project is a collection of simple, effective, modular, well-tested and well-documented features from Democritus. A backdoor vulnerability exists in Democritus Project d8s-asns version 0.1.0, which stems from the presence of a potential code execution package democritus-html inserted by...

ZoneMinder Information Disclosure Vulnerability

ZoneMinder is an open source video surveillance software system. The system supports IP, USB, and analog cameras, etc. ZoneMinder is vulnerable to an information disclosure vulnerability that stems from the ZoneMinder API exposing database log content to users without permissions, allowing logs t...

PrestaShop Cross-Site Scripting Vulnerability (CNVD-2022-62230)

PrestaShop is an open source e-commerce solution from PrestaShop Inc. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. PrestaShop module 5.0.2 prior versions of cross-site scripting vulnerability, the vulnerability stems from t...

Adobe InCopy Out-of-Bounds Write Vulnerability (CNVD-2022-50232)

Adobe InCopy is a text editing software for creative writing from Adobe, USA. Adobe InCopy suffers from an out-of-bounds write vulnerability that can be exploited by an attacker to execute arbitrary code in the context of the current user...

Linux kernel denial of service vulnerability

Linux kernel is the kernel used by the Linux Foundation in the U.S. A denial-of-service vulnerability exists in Linux kernel, which stems from a memory write out-of-bounds flaw in the UDF file system functionality. An attacker could exploit this vulnerability to crash the system...

Product Show Room Site Cross-Site Scripting Vulnerability (CNVD-2022-48964)

Product Show Room Site is a product showroom site from Carlo Montero's personal developer. version 1.0 of Product Show Room Site is vulnerable to cross-site scripting, which stems from using a special string input text box that leads to cross-site scripting. No details of the vulnerability are...

Google TensorFlow Input Validation Error Vulnerability (CVE-2022-29192)

Google TensorFlow, an end-to-end open source platform for machine learning from Google, Inc. is vulnerable to an input validation error in versions prior to 2.9.0, 2.8.1, 2.7.2, and 2.6.4, which originates in tf.rawops QuantizeAndDequantizeV4Grad does not fully validate the input parameters and c...

IBM Sterling Partner Engagement Manager访问控制错误漏洞

IBM Sterling Partner Engagement Manager is an automation management tool from IBM, U.S.A. An access control error vulnerability exists in IBM Sterling Partner Engagement Manager version 6.2.0, which stems from the lack of a revocation mechanism for JWT tokens. An attacker could exploit the...

shescape Information Disclosure Vulnerability

shescape is an open source package of simple shell escaping programs for JavaScript. Use it to escape user-controlled input to shell commands to prevent shell injection. shescape versions 1.4.0 through 1.5.1 are vulnerable to an information disclosure vulnerability that stems from using the escap...

Google TensorFlow code issue vulnerability (CNVD-2022-11512)

Google TensorFlow is an end-to-end open source platform for machine learning from Google USA. Google Tensorflow is vulnerable to a code issue that could be exploited by an attacker to deny service by passing in parameters that would trigger a CHECK failure...

Google Tensorflow Input Validation Error Vulnerability (CNVD-2022-09889)

Google TensorFlow is an end-to-end open source platform for machine learning from Google USA. Google TensorFlow is vulnerable to an input validation error that stems from an integer overflow in the Range implementation, which could be exploited by an attacker to trigger undefined behavior or, in...

Fortinet FortiMail Cross-Site Scripting Vulnerability (CNVD-2022-19073)

Fortinet FortiMail is a suite of email security gateway products from Fortinet, Inc. Fortinet FortiMail is vulnerable to a cross-site scripting vulnerability that could be exploited to execute unauthorized code or commands via a specially crafted HTTP GET request to the FortiGuard URI protection...

Apache Ozone has an unspecified vulnerability (CNVD-2021-91626)

Apache Ozone is an application. A scalable, redundant and distributed object store for Hadoop and cloud-native environments. Apache Ozone version 1.2.0 has a security vulnerability that stems from various internal server-to-server RPC endpoints that can be used to connect, and an attacker can...

Palo Alto Networks PAN-OS SCEP feature command injection vulnerability

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances.A command injection vulnerability exists in Palo Alto Networks PAN-OS, which stems from an OS command injection vulnerability in the software's SCEP Simple Certificate The...

Google TensorFlow heap allocation array out-of-bounds read vulnerability (CNVD-2021-85884)

Google TensorFlow is an end-to-end open source machine learning platform. an out-of-bounds read vulnerability exists in the shape inference function of SparseCountSparseOutput in versions prior to TensorFlow 2.7.0 for heap allocation arrays. No detailed vulnerability details are currently availab...

Biqs It Biqs-drive Local File Inclusion Vulnerability

Biqs It Biqs-drive is an online driving school software from the Belgian company Biqs It. BIQS IT Biqs-drive v1.83 and below is vulnerable to a local file inclusion vulnerability, which could be exploited by attackers to read arbitrary files from the server using the privileges of the configured...

WordPress Easy Social Icons Cross-Site Scripting Vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Easy Social Icons plugin is a WordPress open source application plugin. WordPress Easy Social Icons plugin in...

Advantech R-SeeNet Cross-Site Scripting Vulnerability

Advantech R-SeeNet is an industrial monitoring software from Advantech, Taiwan, China. The software is based on the snmp protocol for monitoring platforms and is available for Linux and Windows platforms.A cross-site scripting vulnerability exists in Advantech R-SeeNet, which stems from the lack ...

Advantech R-SeeNet ping.php OS Command Injection Vulnerability

Advantech R-SeeNet is an industrial monitoring software from Advantech, Taiwan, China. The software is based on the snmp protocol for monitoring platforms, and is available for Linux and Windows platforms.An OS command injection vulnerability exists in Advantech R-SeeNet ping.php, which stems fro...

Autodesk Design Review Buffer Overflow Vulnerability (CNVD-2021-53945)

Autodesk Design Review ADR is a suite of AutoCAD drawing software assist software from Autodesk, Inc. The software supports viewing, marking, measuring, printing, and tracking changes to 2D and 3D design files.Autodesk Design Review is vulnerable to a buffer overflow vulnerability, which could be...

Mozilla Rust Resource Management Error Vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in http crate in versions of Mozilla Rust prior to 0.1.20, which stems from HeaderMap:: The Drain API can use raw pointers to corrupt sound effects. No details of the vulnerabilit...

eslint-utils Arbitrary Code Execution Vulnerability

eslint-utils is a utility for ESLint plugins and custom rules. An arbitrary code execution vulnerability exists in versions of eslint-utils prior to 1.4.1. An attacker can exploit this vulnerability to execute arbitrary code via the getStaticValue function...