TCL LinkHub Mesh Wi-Fi OS Command Injection Vulnerability

TCL LinkHub Mesh Wi-Fi is a router from TCL Corporation.TCL LinkHub Mesh Wi-Fi is vulnerable to an operating system command injection vulnerability that originates in the confsrv ucloudaddnode function and can be exploited by attackers to cause arbitrary command execution...

Siemens SIMATIC WinCC OA Client Authentication Vulnerability

Siemens SIMATIC WinCC OA is a SCADA operating system from Siemens, Germany. It is used to control and monitor industrial applications. A security vulnerability exists in Siemens SIMATIC WinCC OA that stems from the application using only client-side authentication when both server-side...

WordPress Plugin iQ Block Country IP Spoofing Attack Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. An IP spoofing attack vulnerability exists in WordPress plugin iQ Block Country version 1.2.13 and prior versions, which stems from not properly...

Illumina Local Run Manager Access Control Error Vulnerability

Illumina Local Run Manager is an integrated solution from Illumina, Inc. Designed to create sequencing runs, monitor run status, analyze sequencing data, and view results, Illumina Local Run Manager is vulnerable to an access control error that could be exploited by remote attackers to gain...

SQL Injection Vulnerability in Panmicroeoffice8 (CNVD-2022-43843)

Panavision eoffice8 is a mobile office platform. A SQL injection vulnerability exists in Panmicroeoffice8, which can be exploited by attackers to obtain sensitive information from the database...

Microsoft Windows Print Spooler Elevation of Privilege Vulnerability (CNVD-2022-84605)

Microsoft Windows is an operating system for personal devices, Microsoft Windows Server is a server operating system, and Windows Print Spooler is one of the print spoolers. An elevation of privilege vulnerability exists in Microsoft Windows Print Spooler due to a flaw in the print spooler...

Omron CX-Position Out-of-Bounds Writing Vulnerability

Omron CX-Position is a position control software from Omron Corporation of Japan. An out-of-bounds write vulnerability exists in Omron CX-Position, which stems from a failure to properly validate data when a program performs an operation in memory while processing a specific project file, and cou...

UltraVNC has an unspecified vulnerability

UltraVNC is an open source remote terminal control software for the Windows platform. versions of UltraVNC prior to 1.3.8.0 have a security vulnerability in the DSM plug-in that can be exploited by a locally authenticated attacker to achieve Local Elevation of Privilege LPE on vulnerable systems...

Google Android Input Validation Error Vulnerability (CNVD-2022-47679)

Google Android is a Linux-based open source operating system from Google, Inc. Google Android is vulnerable to an input validation error that could be exploited by attackers to cause a local denial of service without additional privileges...

Zyxel ZyWALL 2 Plus Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability exists in Zyxel ZyWALL 2 Plus, a firewall appliance for corporate environments from Zyxel China, which stems from a lack of data validation filtering of user-supplied data and output. An attacker could exploit the vulnerability to be able to execute arbitrary...

Weblate Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability exists in Weblate, a Copyleft web-based free software continuous localization system, which stems from the failure of versions prior to 4.11 to properly neutralize user input used in the username and language fields. As a result of this improper neutralization...

Google Tensorflow Input Validation Error Vulnerability (CNVD-2022-09896)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. Google TensorFlow is vulnerable to an input validation error that could be exploited by an attacker to create an operation that contains a tensor with enough elements to cause an integer overflow...

Google Tensorflow code issue vulnerability (CNVD-2022-09862)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow has a code issue vulnerability that stems from TensorFlow's grappler component that can trigger null pointer dereferences. No detailed vulnerability details are available at th...

Open Design Alliance Drawings SDK has an unspecified vulnerability (CNVD-2021-89164)

Open Design Alliance Drawings SDK is a software development kit for drawing design applications from Open Design Alliance, Inc. The package provides access to data in .dwg and .dgn through a convenient, object-oriented API, providing a C API, support for repair files, support for . An out - bound...

Siemens SIMATIC PCS 7 and SIMATIC WinCC Path Traversal Vulnerability

Siemens SIMATIC PCS 7 and SIMATIC WinCC are both products of Siemens, a German company. SIMATIC PCS 7 is a process control system and SIMATIC WinCC is an automated data acquisition and monitoring SCADA system. A path traversal vulnerability exists in SIMATIC PCS 7 and SIMATIC WinCC, which stems...

NETGEAR R6400v2 Buffer Overflow Vulnerability

The NETGEAR R6400v2 is a router from Netgear, Inc. A hardware device that connects two or more networks and acts as a gateway between networks, the NETGEAR R6400v2 is vulnerable to a buffer overflow vulnerability that stems from a process failing to properly validate the length of user-supplied...

WECON PLC Editor Out-of-Bounds Writing Vulnerability

WECON PLC Editor is a PLC programming software.An out-of-bounds write vulnerability exists in WECON PLC Editor 1.3.8 and earlier versions. An attacker can exploit this vulnerability to execute arbitrary code...

Google TensorFlow heap allocation array out-of-bounds read vulnerability

Google TensorFlow is an end-to-end open source machine learning platform. an out-of-bounds read vulnerability exists in the shape inference function of the QuantizeAndDequantizeV operation in versions prior to TensorFlow 2.7.0 for heap allocation arrays. No detailed vulnerability details are...

Matrix Information Disclosure Vulnerability (CNVD-2021-70122)

Matrix is an ambitious new ecosystem for open federated instant messaging and VoIP. Matrix 1.41.0 and earlier versions have an information disclosure vulnerability that could be exploited by attackers to access room names, avatars, topics and member counts...

WordPress WooCommerce Blocks SQL plugin injection vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers.WooCommerce Blocks plugin is a WordPress open source application plugin.WooCommerce Blocks feature plugin version...

Nextcloud Android app denial of service vulnerability

Nextcloud Android app is an Android-based mobile application from Nextcloud Germany for accessing Nextcloud servers. A denial of service vulnerability exists in the Nextcloud Android app, which can be exploited by an attacker to cause the Nextcloud app to crash...

Apache HTTP Server Denial of Service Vulnerability

Apache HTTP Server is the United States Apache Apache Software Foundation, an open source web server. The server is fast, reliable and can be expanded through a simple API. A security vulnerability exists in the HTTP/2 modhttp2 connection for httpd in Apache HTTP Server versions 2.4.17 through...

Microsoft StructuredQuery Remote Code Execution Vulnerability

Microsoft Windows is a series of operating systems released by Microsoft.StructuredQuery is one of the structured query components. A remote code execution vulnerability exists in Microsoft StructuredQuery, which stems from the program failing to properly handle objects in memory. A remote attack...

Bazarr Arbitrary File Read Vulnerability

Bazarr is a companion app to Sonarr and Radarr that manages and downloads subtitles to your specifications. Bazarr suffers from an arbitrary file read vulnerability due to an issue in component /api/swaggerui/static in Bazaar v1.4.3 that allows an unauthenticated attacker to perform directory...

Apache HTTP Server Null Pointer Dereference Vulnerability

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. Apache HTTP Server suffers from a null pointer dereference vulnerability that can be exploited by an attacker to cause the server...

Siemens Industrial Products WIBU System CodeMeter Heap Buffer Overflow Vulnerability

PSSRCAPE is a transmission and distribution network protection simulation software.PSSRE is a power system simulation and analysis tool for transmission operations and planning.PSSRODMS is a CIM-based network modeling management tool with network analysis capabilities for planning and operational...

Apache Airflow Input Validation Error Vulnerability (CNVD-2023-67067)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An input validation error vulnerability exists in Apache Airflow Drill Provider...

Linux kernel smb2misc.c file out-of-bounds read vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. An out-of-bounds read vulnerability exists in versions of Linux kernel prior to 6.3.10, which stems from the fact that fs/smb/server/smb2misc.c does not validate the relationsh...

Google Chrome Security Bypass Vulnerability (CNVD-2023-46111)

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome prior to version 114.0.5735.90, which stems from a mal-implementation issue in the Extensions API module. An attacker could exploit this vulnerability to bypass security...

Unspecified Vulnerability in Oracle MySQL Server (CNVD-2023-65518)

Oracle MySQL Server is a relational database from Oracle Corporation. A security vulnerability exists in Oracle MySQL Server, which can be exploited by an attacker to cause unauthorized MySQL connector hangs or frequent and repeated crashes, as well as unauthorized update, insert, or delete acces...

Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability (CNVD-2023-35212)

Microsoft PostScript Printer Driver is a Microsoft standard printer driver for PostScript printers from Microsoft.Microsoft PCL6 Class Printer Driver is a printer driver from Microsoft. Microsoft PCL6 Class Printer Driver is a printer driver software from Microsoft. A remote code execution...

Online Computer and Laptop Store Arbitrary File Upload Vulnerability

Online Computer and Laptop Store is an online computer and laptop store from Carlo Montero's personal developer. Online Computer and Laptop Store v1.0 is vulnerable to arbitrary file uploads. The vulnerability stems from a lack of validation of uploaded files in the...

Microsoft SharePoint Server Security Feature Bypass Vulnerability (CNVD-2023-04532)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft Corporation USA. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information.A...

Mozilla Firefox Security Feature Issue Vulnerability (CNVD-2023-05206)

Mozilla Firefox is an open source Web browser from the Mozilla Foundation. Mozilla Firefox is vulnerable to a security feature issue that stems from a lack of security checks in the sourceMapURL feature of devtools. A remote attacker could use the vulnerability to trick a victim into performing...

Siemens Teamcenter Visualization and JT2Go Heap Buffer Overflow Vulnerability

Siemens Teamcenter Visualization is a software that provides team collaboration capabilities for designing 2D and 3D scenes. Siemens JT2GO is a JT file viewer. Siemens Teamcenter Visualization and JT2Go are vulnerable to a heap buffer overflow vulnerability that could be exploited by an attacker ...

Google Chrome Live Caption Code Execution Vulnerability

Google Chrome is a web browser from Google, Inc. A code execution vulnerability exists in Google Chrome Live Caption, which can be exploited by attackers to execute arbitrary code on a system or cause a denial of service...

Multiple Fortinet products vulnerable to information leakage

Fortinet FortiManager and Fortinet FortiAnalyzer, both from Fortinet, are a centralized network security management platform. Fortinet FortiAnalyzer is a centralized network security reporting solution. The product is mainly used to collect network log data and analyze, report and archive...

ZZCMS sendmailto.php SQL Injection Vulnerability

ZZCMS is a content management system CMS by the ZZCMS team in China. A SQL injection vulnerability exists in ZZCMS version 2022, which originates from /admin/sendmailto.php?tomail=&groupid= lack of validation of externally entered SQL statements. An attacker can exploit the vulnerability to execu...

NIC Knot Resolver Denial of Service Vulnerability

Knot Resolver is a cached DNS resolver implementation that includes a resolver library and daemon. A denial of service vulnerability exists in NIC Knot Resolver versions prior to 5.5.3. The vulnerability stems from not properly handling incoming error messages and can be exploited by a remote...

Google Android Information Disclosure Vulnerability (CNVD-2022-61744)

Google Android is a Linux-based open source operating system from Google, Inc. Google Android is vulnerable to an information disclosure vulnerability caused by a missing permission check in the handleramdump function in pixelloader.c. The vulnerability can be exploited to obtain sensitive...

PbootCMS Code Injection Vulnerability

PbootCMS is a new core and permanent open source free PHP enterprise website development and construction management system , is a set of efficient , simple , strong and free commercial PHP CMS source code , to meet the needs of various types of enterprise website development and construction...

KubeEdge Denial of Service Vulnerability

KubeEdge is an open source edge computing framework built on Kubernetes and extends containerized application orchestration and device management to hosts on the end. A denial-of-service vulnerability exists in KubeEdge versions prior to 1.11.0, prior to 1.10.1, and prior to 1.9.3, which can be...

Jenkins ThreadFix Plugin Authorization Issues Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins Plugin is an application software. An authorization issue...

Dolibarr Cross-Site Scripting Vulnerability (CNVD-2022-71638)

Dolibarr is an ERP/CRM system with plug-and-play modules and a well-established ecosystem with customizations and service providers worldwide. version 12.0.5 of Dolibarr suffers from a cross-site scripting vulnerability that can be exploited by attackers to cause cross-site scripting XSS attacks...

jc21 Nginx Proxy Manager Cross-Site Scripting Vulnerability

jc21 Nginx Proxy Manager is a graphical user interface for managing Nginx servers. jc21 Nginx Proxy Manager versions prior to 2.9.17 contain a cross-site scripting vulnerability that stems from the program's lack of data validation filtering of user-supplied data and output. An attacker could...

Jenkins Pipeline Phoenix AutoTest Plugin XML External Entity Injection Vulnerability

Jenkins Pipeline is a set of plug-ins that support the implementation and integration of continuous delivery pipelines into Jenkins.The Jenkins Pipeline Phoenix AutoTest Plugin 1.3 and earlier versions are vulnerable to XML external entity injection, which can be exploited by remote attackers to...

WordPress Photo Gallery by 10Web plugin SQL注入漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress Photo Gallery by 10Web plugin version 1.6.0...

Cobbler Licensing Issue Vulnerability (CNVD-2022-20579)

Cobbler is a network installation server suite that is primarily used to quickly set up Linux network installation environments.An authorization issue vulnerability exists in versions of Cobbler prior to 3.3.2, which stems from the presence of incorrect authorization in the application. An attack...

Mattermost Server Buffer Overflow Vulnerability (CNVD-2022-65355)

Mattermost Server is an open source messaging platform from Mattermost, Inc. A buffer overflow vulnerability exists in Mattermost Server versions 6.3.2 and below, which stems from the fact that Mattermost Server's document extractor does not properly validate data boundaries when performing...

MingSoft Mcms SQL Injection Vulnerability (CNVD-2022-18425)

MingSoft Mcms is China's Ming Fei MingSoft company a complete open source J2ee system . MingSoft Mcms v5.2.5 there is a security vulnerability that can be exploited by an attacker through the file IContentDao.xml in the categoryId parameter for SQL injection attacks...