Accela Civic Platform Information Disclosure Vulnerability

Accela Civic Platform is a cloud-based solution for Accela's application software to modernize city systems for land management and code enforcement, increased citizen engagement and mobile information access. information disclosure vulnerabilities exist in versions of Accela Civic Platform prior...

cae input validation error vulnerability (CNVD-2021-25664)

cae is a compression/decompression software package. An input validation error vulnerability exists in the ExtractTo feature in all versions of cae, which stems from the program failing to properly escape the path to a file in a zip archive, and can be exploited by an attacker to add or replace...

WibuKey Network server management WkbProgramLow Heap Overflow Vulnerability

WIBU-KEY is a software protection and license management system.WibuKey Network server management is a network service program. A heap overflow vulnerability in the WibuKey Network server management WkbProgramLow function allows remote attackers to exploit the vulnerability by submitting a...

Micro Focus Secure Messaging Gateway Web administration and quarantine component SQL injection vulnerability

Micro Focus Secure Messaging Gateway SMG is a suite of outbound and inbound protection software for enterprise networks and messaging systems from Micro Focus, UK. The product includes features such as virus protection, anti-spam, anti-DDos attacks, and image analysis.Web administration is one of...

Foxit Reader Text Annotations Remote Code Execution Vulnerability

Foxit Reader is a small PDF document viewer and printing program. Foxit Reader has a security vulnerability in the Text Annotations handling, which can be exploited to execute arbitrary code in the current process context due to a lack of validation before performing operations on objects...

SPIP Remote Code Execution Vulnerability

SPIP is a free Web-based content publishing system. The system is primarily used for online collaboration. A remote code execution vulnerability exists in SPIP 3.1.2 and prior versions. An attacker could exploit this vulnerability to execute arbitrary code at an affected site...

Google Chrome Skia Denial of Service Vulnerability (CNVD-2016-07581)

Google Skia is the United States Google Google company's an open source and C + + based graphics library , it can be used in Mozilla Firefox, Google Chrome and other browsers , but also available in the Android open mobile platform . A denial of service vulnerability exists in the SkPath.cpp file...

Milesight UR32L vtysh_ubus toolsh_excute.constprop.1 Functional Command Injection Vulnerability (CNVD-2023-65490)

The Milesight UR32L is a 4G industrial router from China's Milesight. The Milesight UR32L vtyshubus toolshexcute.constprop.1 feature suffers from a command injection vulnerability that can be exploited by an attacker to execute arbitrary commands on the system...

Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability (CNVD-2023-28104)

Microsoft PostScript Printer Driver is a Microsoft standard printer driver for PostScript printers from Microsoft USA. Microsoft PCL6 Class Printer Driver is a printer driver software from Microsoft Corporation. Microsoft PostScript and PCL6 Class Printer Driver contains an information disclosure...

Fortinet FortiWeb Cross-Site Scripting Vulnerability (CNVD-2023-18299)

Fortinet FortiWeb is a Web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures Web applications and protects sensitive database content. A cross-site scripting vulnerability exists...

Google Android Elevation of Privilege Vulnerability (CNVD-2023-07646)

Google Android is a Linux-based open source operating system from Google, Inc. An elevation of privilege vulnerability exists in Google Android due to a resource exhaustion vulnerability in the NotificationChannel.java component. The vulnerability can be exploited by attackers to gain elevated...

GE CIMPLICITY HMI/SCADA Software Buffer Overflow Vulnerability

GE CIMPLICITY HMI/SCADA Software is an automated industrial platform from General Electric GE. It provides true client-server visualization and control from a single machine to plant locations around the world, helping to manage operations and improve decision making. A buffer overflow...

Google TensorFlow buffer overflow vulnerability (CNVD-2022-80680)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A buffer overflow vulnerability exists in Google TensorFlow, which stems from tf.rawops.ResizeNearestNeighborGrad's lack of length size validation of the input data. validation, an attacker could exploi...

WhatsApp Digital Error Vulnerability

WhatsApp is a suite of mobile applications from the American company WhatsApp that use the Internet to send text messages. The application uses the contact information in a smartphone to find contacts using the program to send texts, pictures, etc. WhatsApp suffers from a numeric error...

Jenkins ThreadFix Plugin Authorization Issues Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins Plugin is an application software. An authorization issue...

WordPress Member Hero plugin code injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...

npm semver-regex denial of service vulnerability

npm semver-regex is a regular expression used to match semver versions. semver-regex versions prior to 3.1.4 and versions 4.0.0 inclusive through 4.0.2 have a denial of service vulnerability that stems from not properly handling incoming error messages, which can be exploited to cause a denial of...

Illumina Local Run Manager Access Control Error Vulnerability

Illumina Local Run Manager is an integrated solution from Illumina, Inc. Designed to create sequencing runs, monitor run status, analyze sequencing data, and view results, Illumina Local Run Manager is vulnerable to an access control error that could be exploited by remote attackers to gain...

Tenda M3 Command Injection Vulnerability (CNVD-2022-33115)

Tenda M3 is an access control from Tenda, a Chinese company. Tenda M3 is vulnerable to command injection, which stems from the component /cgi-bin/uploadAccessCodePic fails to properly filter the construction of command special characters, commands, etc., which can be exploited by attackers to cau...

SyliusGridBundle SQL Injection Vulnerability

SyliusGridBundle is an open source e-commerce solution built from decoupled components with a robust API and the highest quality code.A SQL injection vulnerability exists in SyliusGridBundle versions prior to 1.10.1 and prior to 1.11-rc2, which stems from the fact that values added at the end of ...

Qt path traversal vulnerability

Qt is a cross-platform C application development framework from the Norwegian company Qt. It is widely used for developing GUI programs, in which case it is also known as the widget toolkit. It can also be used to develop non-GUI programs, such as console tools and servers.Qt versions prior to...

Apache James Command Injection Vulnerability

Apache James is an open source Smtp and Pop3 mail transfer agent and Nntp news server written entirely in Java by the Apache Foundation. Apache James 3.6.1 is vulnerable to a command injection vulnerability that could be exploited by attackers to perform a man-in-the-middle command injection...

Palo Alto Networks PAN-OS SCEP feature command injection vulnerability

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances.A command injection vulnerability exists in Palo Alto Networks PAN-OS, which stems from an OS command injection vulnerability in the software's SCEP Simple Certificate The...

Beijing Tongda Zhicheng Technology Co., Ltd. Heart Tongda OA has file upload vulnerability (CNVD-2021-86805)

Xin Tongda OA is an OA office tool equipped with AI artificial intelligence. Beijing Tongda Zhicheng Technology Co. Xin Tongda OA has a file upload vulnerability, which can be exploited by attackers to gain control of the server...

Google TensorFlow null pointer dereference vulnerability (CNVD-2021-64074)

Google TensorFlow is an end-to-end open source machine learning platform. a null pointer dereference vulnerability exists in the tf.rawops.SparseTensorSliceDataset implementation in versions prior to Google TensorFlow 2.6.0. No detailed vulnerability details are available at this time...

Nexus Control Panel Out-of-Bounds Writing Vulnerability

Swisslog Healthcare Nexus Panel is a medical device from Swisslog Healthcare.An out-of-bounds write vulnerability exists in versions prior to Nexus Control Panel 7.2.5.7. An attacker could exploit this vulnerability to cause a stack buffer overflow...

Google TensorFlow Numeric Error Vulnerability

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow 2.4.2, 2.3.3, 2.2.3, 2.1.4 suffers from a number error vulnerability that can be exploited by an attacker to trigger undefined behavior via a null pointer bound to...

CloudBees Jenkins Script Security plugin sandbox bypass vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Script Security Plugin is used in one of the...

zzzcms zzzphp dynamic code execution vulnerability

zzzcms zzzphp is a content management system CMS. A security vulnerability exists in version V1.6.1 of zzzcms zzzphp, which stems from a lax filtering of search template parsing on the search page. An attacker can exploit this vulnerability to execute PHP code...

Subrion CMS Arbitrary PHP Code Execution Vulnerability

Subrion CMS is a PHP-based content management system CMS developed by the Subrion team. The system can be integrated into a website and supports a wide range of extensions plug-ins and more. A security vulnerability exists in /panel/uploads in Subrion CMS version 4.2.1, which stems from the failu...

Mattermost Authorization Issue Vulnerability (CNVD-2024-13545)

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an authorization issue vulnerability that stems from an inability to check the "inviteguest" permission when inviting people from other teams to join the team. A privileged...

SQL Injection Vulnerability in DedeCMS of Shanghai Zhuozhuo Network Technology Company Limited (CNVD-2024-13237)

DedeCMS is the most well-known PHP open source website management system, but also the use of the most users of the PHP class CMS system. Shanghai Zhuozhuo Network Technology Co., Ltd. DedeCMS SQL injection vulnerability, attackers can use the vulnerability to obtain database sensitive informatio...

cURL SOCKS5 Heap Overflow Vulnerability

cURL is a network data transfer project. Usually when we say cURL, we mean the cURL command line tool. cURL's underlying use is the libcurl library. A heap overflow vulnerability exists in cURL SOCKS5, which can be exploited by an attacker to construct a malicious hostname and cause code executio...

SAP PowerDesigner Code Injection Vulnerability (CNVD-2024-23328)

SAP PowerDesigner is a database design software from SAP Germany. A code injection vulnerability exists in SAP PowerDesigner version 16.7 that originates from allowing an unauthenticated attacker to inject VBScript code into a document. An attacker could exploit this vulnerability to cause...

FreeImage C_IStream::read function buffer overflow vulnerability

FreeImage is a cross-platform open source library for supporting popular graphic image formats. A buffer overflow vulnerability exists in the FreeImage CIStream::read function, which originates from a boundary error in the CIStream::read function of the PluginEXR.cpp file when handling untrusted...

TP-Link Archer VR1600V Command Injection Vulnerability

The TP-Link Archer VR1600V is a wireless modem from China P&L TP-LINK. The TP-Link Archer VR1600V suffers from a command injection vulnerability that stems from the application failing to properly filter constructed command special characters, commands, etc. An attacker could exploit the...

Schneider Electric Easy UPS Online Monitoring Software Access Control Error Vulnerability

Schneider Electric Easy UPS Online Monitoring Software is a power monitoring software from the French company Schneider Electric Schneider Electric. The Schneider Electric Easy UPS Online Monitoring Software suffers from an Access Control Error vulnerability that stems from a lack of authenticati...

SAP NetWeaver AS Licensing Issue Vulnerability

SAP NetWeaver AS is a SAP Web Application Server from SAP Germany. It not only provides network services, but also is the basic platform for SAP software. SAP NetWeaver AS version 7.50 has an authorization problem vulnerability, which stems from the lack of authentication checks and can be...

Siemens Parasolid and Solid Edge SE2022 out-of-bounds read vulnerability

Siemens Parasolid is a geometric modeling kernel from Siemens, a German company. Siemens Solid Edge is a 3D CAD software from Siemens, a German company. The software can be used in industries such as part design, assembly design, sheet metal design, welding design, etc. An out-of-bounds read...

Mozilla Firefox Injection Vulnerability (CNVD-2023-03055)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from an injection vulnerability that stems from a failure to execute the Unsafe-Hashes CSP directive. An attacker could exploit this vulnerability to inject executable script...

Linux kernel buffer overflow vulnerability (CNVD-2023-58993)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a buffer overflow vulnerability that stems from an issue found in ksmbd where fs/ksmbd/smb2pdu.c lacks length validation in the unfilled case of...

Siemens Teamcenter Visualization and JT2Go Heap Buffer Overflow Vulnerability

Siemens Teamcenter Visualization is a software that provides team collaboration capabilities for designing 2D and 3D scenes. Siemens JT2GO is a JT file viewer. Siemens Teamcenter Visualization and JT2Go are vulnerable to a heap buffer overflow vulnerability that could be exploited by an attacker ...

Google TensorFlow Input Validation Error Vulnerability (CNVD-2023-15780)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. Google TensorFlow is vulnerable to an input validation error that could be exploited by an attacker to cause a denial of service...

Nasm buffer overflow vulnerability (CNVD-2022-69151)

Nasm is an open source programming tool software. A buffer overflow vulnerability exists in Nasm v2.16, which stems from the inclusion of a stack overflow in the Ndisasm component. No detailed vulnerability details are provided at this time...

WordPress HTML2WP plugin arbitrary file upload vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress HTML2WP plugin 1.0.0 and earlier versions contain an arbitrary file upload vulnerability th...

Vapor Denial of Service Vulnerability

Vapor is a Swift web development framework. Can be used to develop high-performance Web applications , support for iOS, OS X and Ubuntu systems. A denial-of-service vulnerability exists in Vapor versions prior to 4.61.1 that stems from not properly handling incoming error messages and can be...

Linux kernel denial of service vulnerability

Linux kernel is the kernel used by the Linux Foundation in the U.S. A denial-of-service vulnerability exists in Linux kernel, which stems from a memory write out-of-bounds flaw in the UDF file system functionality. An attacker could exploit this vulnerability to crash the system...

Joomla! path traversal vulnerability (CNVD-2022-64100)

A path traversal vulnerability exists in Joomla! versions 3.0.0 through 3.10.6 and 4.0.0 through 4.1.0, which stems from a failure of a web system or product to properly filter special elements in a resource or file path, and can be exploited by remote attackers to send specially crafted .zip...

Google Android Buffer Overflow Vulnerability (CNVD-2022-47673)

Google Android is a Linux-based open source operating system from Google, Inc. Google Android suffers from a buffer overflow vulnerability, which stems from a lack of privilege checks in the ims service, and can be exploited by attackers to cause local privilege escalation...

Veeam Backup&Replication Access Control Error Vulnerability

Veeam Backup & Replication is a suite of data protection software from the Swiss company Veeam. The software provides backup, replication and recovery for VMware and Hyper-V VMs, physical and cloud environments. Veeam Backup&Replication is vulnerable to an Access Control Error vulnerability, no...