Advantech R-SeeNet Cross-Site Scripting Vulnerability

Advantech R-SeeNet is an industrial monitoring software from Advantech, Taiwan, China. The software is based on the snmp protocol for monitoring platforms and is available for Linux and Windows platforms.A cross-site scripting vulnerability exists in Advantech R-SeeNet, which stems from the lack ...

Advantech R-SeeNet ping.php OS Command Injection Vulnerability

Advantech R-SeeNet is an industrial monitoring software from Advantech, Taiwan, China. The software is based on the snmp protocol for monitoring platforms, and is available for Linux and Windows platforms.An OS command injection vulnerability exists in Advantech R-SeeNet ping.php, which stems fro...

Autodesk Design Review Buffer Overflow Vulnerability (CNVD-2021-53945)

Autodesk Design Review ADR is a suite of AutoCAD drawing software assist software from Autodesk, Inc. The software supports viewing, marking, measuring, printing, and tracking changes to 2D and 3D design files.Autodesk Design Review is vulnerable to a buffer overflow vulnerability, which could be...

Mozilla Rust Resource Management Error Vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in http crate in versions of Mozilla Rust prior to 0.1.20, which stems from HeaderMap:: The Drain API can use raw pointers to corrupt sound effects. No details of the vulnerabilit...

GitLab Information Disclosure Vulnerability (CNVD-2021-14193)

GitLab is a Ruby on Rails developed, self-hosted, Git version control system project repository application from GitLab, Inc. The program can be used to access the project's file contents, commit history, bug list , etc. Git is a free, open source distributed version control system. GitLab CE/EE...

libtorrent 'bdecode' function heap buffer overflow vulnerability

libtorrent is an open source C++ Bittorrent library developed by software developer Arvid Norberg, which provides high performance and good code style of the BT development kit, and supports crawling file pages directly through the network stack. A security vulnerability exists in the 'bdecode'...

Newforma Project Center Server Information Disclosure Vulnerability

Newforma Project Center Server is a project information management solution for the Architecture, Engineering and Construction AEC industry from Newforma for centralized storage and management of project documents and collaboration. An information disclosure vulnerability exists in Newforma Proje...

Microsoft Hyper-V Remote Code Execution Vulnerability (CNVD-2024-11160)

Microsoft Hyper-V is an application from Microsoft Corporation USA. A system hypervisor virtualization technology that enables desktop virtualization. A remote code execution vulnerability exists in Microsoft Hyper-V, which can be exploited by an attacker to execute arbitrary code on a system...

Linux Kernel Denial of Service Vulnerability (CNVD-2024-14766)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A denial of service attack vulnerability exists in the Linux Kernel. The vulnerability is due to a memory leak found in ctnetlinkcreateconntrack in...

answer authorization issue vulnerability

answer is an open source knowledge-based community software. answer 1.0.6 prior versions of the authorization problem vulnerability , the vulnerability stems from the request to set a new password in /answer/admin/api/user/password there is improper permission management , a low-privilege attacke...

Google Chrome memory misreference vulnerability (CNVD-2023-65163)

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in versions of Google Chrome prior to 111.0.5563.110, which stems from a confusion in the instructions responsible for freeing memory in the WebProtect program. An attacker could use this...

IBM AIX Elevation of Privilege Vulnerability (CNVD-2023-00805)

IBM AIX is an open standards-based UNIX operating system developed by International Business Machines IBM for the IBM Power architecture. IBM AIX has an elevation of privilege vulnerability that can be exploited by attackers to gain root privileges...

Amasty Blog Pro for Magento 2 Cross-Site Scripting Vulnerability

Amasty Blog is a website page extension from Amasty. magento2 is an open source PHP e-commerce system. Amasty Blog Pro 2.10.5 before the version for Magento 2 has a cross-site scripting vulnerability , the vulnerability stems from the plugin in the blog post creation function fails to shortconten...

Google TensorFlow has an unspecified vulnerability (CNVD-2022-81226)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A security vulnerability exists in Google TensorFlow, which stems from an error that can be raised if a numpy array is created with the shape of one element being zero and the sum of the other elements...

Google TensorFlow Input Validation Error Vulnerability (CNVD-2023-15780)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. Google TensorFlow is vulnerable to an input validation error that could be exploited by an attacker to cause a denial of service...

Apache Avro Denial of Service Vulnerability

Apache Avro is a data serialization system from the Apache Foundation, Inc. A denial of service vulnerability exists in versions of Apache Avro Rust prior to 0.14.0, which stems from an integer overflow when reading corrupted .avro files in the Avro Rust SDK, and can be exploited by an attacker t...

Tenda AC15 Command Injection Vulnerability

The Tenda AC15 is a wireless router from the Chinese company Tenda. The Tenda AC15 has a security vulnerability that can be exploited by an attacker to cause unconditional arbitrary command execution in conjunction with CVE-2021-44971...

Hospital Management System Cross-Site Scripting Vulnerability (CNVD-2022-67484)

HealthNode Hospital Management System is a hospital management system. The system includes patient information management, ward management, surgery schedule management and financial management, etc. A cross-site scripting vulnerability exists in Hospital Management System v1.0, which stems from t...

WordPress NewStatPress plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. cross-site scripting vulnerability exists in versions of WordPress NewStatPress plugin prior to 1.3.6. The vulnerabili...

Jsish Denial of Service Vulnerability (CNVD-2022-07927)

Jsish is a small JavaScript parser with a built-in database written in C. A security vulnerability exists in Jsish version v3.5.0, which stems from a heap-based buffer overflow in jsiEvalCodeSub in src/jsiEval.c. An attacker could exploit this vulnerability to potentially cause a denial of servic...

Fortinet FortiWeb Cross-Site Scripting Vulnerability (CNVD-2021-99662)

Fortinet FortiWeb is a Web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures Web applications and protects sensitive database content. A cross-site scripting vulnerability exists,...

BookStack Access Control Error Vulnerability

BookStack is an open source set of BookStackApp Bookstackapp team's platform for building wiki documents using PHP and Laravel. bookstackapp suffers from an access control error vulnerability that stems from the fact that users with API access can view any attachments to which they do not have re...

Apache Druid LoadData has an arbitrary file reading vulnerability

A security vulnerability exists in Apache Druid, a column-oriented open source distributed database written in Java by the Apache Foundation, which stems from the fact that InputSource is used to read data from a data source in the Druid ingestion system. However, the HTTP InputSource allows an...

Google TensorFlow has an unspecified vulnerability (CNVD-2021-92554)

A security vulnerability in Google TensorFlow, an end-to-end open source platform for machine learning from Google, stems from the use of uninitialized variables in the Grappler optimizer. If the trainnodes vector obtained from the saved optimization model does not contain Dequeue nodes, then...

Apache MINA Denial of Service Vulnerability

Apache MINA is a web application framework from the Apache Foundation. A denial-of-service vulnerability exists in Apache MINA, which is caused by improper handling of HTTP message header requests in Apache MINA. An attacker could exploit this vulnerability to potentially cause an infinite loop i...

Linux kernel denial of service vulnerability (CNVD-2021-60516)

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. Linux kernel suffers from a denial of service vulnerability that is caused by an out-of-bounds read flaw in strlen in fs/nfsd/trace.h. A remote attacker can exploit this vulnerability to cause a denial o...

Mozilla Thunderbird Permissions and Access Control Issues Vulnerability

Mozilla Thunderbird is an open source email client. Mozilla Thunderbird is vulnerable to permission permission and access control issues, which stem from the way Mozilla maintenance services are installed on the Windows operating system. No detailed vulnerability details are currently available...

cae input validation error vulnerability (CNVD-2021-25664)

cae is a compression/decompression software package. An input validation error vulnerability exists in the ExtractTo feature in all versions of cae, which stems from the program failing to properly escape the path to a file in a zip archive, and can be exploited by an attacker to add or replace...

Sensio Labs Symfony PHP Code Injection Execution Vulnerability

Sensio Labs Symfony is a free, MVC-based PHP development framework. The Sensio Labs Symfony 'eval' function fails to adequately filter user input, allowing remote attackers to exploit the vulnerability by submitting a special request to execute arbitrary code with WEB privileges...

GNU Binutils nm.c File Buffer Overflow Vulnerability

GNU Binutils GNU Binary Utilities is a set of programming language utility programs developed by the American GNU community. The programs are primarily designed to work with target files in a variety of formats, and provide connectors, assemblers, and other tools for target files and archives. A...

GNU Binutils libbfd.c file memory leak vulnerability

GNU Binutils GNU Binary Utilities is a set of programming language utility programs developed by the American GNU community. The programs are primarily designed to work with target files in a variety of formats, and provide connectors, assemblers, and other tools for target files and archives. A...

Unspecified vulnerability in vantage6 (CNVD-2024-07865)

vantage6 is vantage6 open source an open source priVAcy preserviNg federalTed leArningG infrastructure for Secure Insight eXchange. A security vulnerability exists in vantage that stems from the fact that input is not checked to see if it is encrypted if the task is created in encrypted...

Unspecified vulnerability in vantage6 (CNVD-2024-07864)

vantage6 is vantage6 open source an open source priVAcy preserviNg federalTed leArningG infrastructure for Secure Insight eXchange. A security vulnerability previously existed in vantage6 version 4.2.0 that stemmed from the ability to find out a username from the response time of a login request...

Cups Easy cross-site scripting vulnerability (CNVD-2024-11142)

Cups Easy is a PHP-based purchasing and inventory software that may become a full-fledged ERP in the future. Cups Easy suffers from a cross-site scripting vulnerability that stems from insufficient escaping of the bincardinfo parameter on the /cupseasylive/itemmodify.php page. An attacker could u...

Adobe ColdFusion Cross-Site Scripting Vulnerability (CNVD-2023-100311)

Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. Adobe ColdFusion cross-site scripting vulnerability, the vulnerability stems from the lack of effective...

Microsoft 3D Builder Remote Code Execution Vulnerability (CNVD-2023-04329)

Microsoft 3D Builder, a tool for creating models and 3D printing from Microsoft USA, has a security vulnerability. No details of the vulnerability are currently available...

Google TensorFlow tf.raw_ops.FusedResizeAndPadConv2D buffer overflow vulnerability

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A buffer overflow vulnerability exists in Google TensorFlow versions prior to 2.7.4, 2.8.0 and later, 2.8.1 and later, 2.9.0 and later, and 2.9.1 and earlier, which originates from "tf.rawops...

Hoosk CMS Arbitrary File Upload Vulnerability

Hoosk CMS is a lightweight content management system. Hoosk CMS v1.8.0 suffers from an arbitrary file upload vulnerability that stems from its /attachments component failing to validate uploaded files. An attacker can exploit the vulnerability to remotely execute code...

Rdiffweb Information Disclosure Vulnerability

Rdiffweb is a web application by Patrik Dufresne, an individual developer in the USA. Provides quick access to your archives through an efficient web interface. An information disclosure vulnerability exists in Rdiffweb versions prior to 2.4.8, which stems from the use of a cache containing...

Halo Cross-Site Scripting Vulnerability (CNVD-2022-47473)

Halo is a personal blogging system for individual developers. Halo is vulnerable to a cross-site scripting vulnerability that originates in adminindex.html/system/tools and contains a stored cross-site scripting XSS vulnerability. No detailed vulnerability details are available at this time...

Google TensorFlow Input Validation Error Vulnerability (CNVD-2022-11511)

Google TensorFlow is an end-to-end open source platform for machine learning from Google USA. Google Tensorflow is vulnerable to an input validation error, which can be exploited by attackers to cause a denial of service...

Rails Action Pack Information Disclosure Vulnerability (CNVD-2022-13387)

Rails Action Pack is a web framework from the US Rails community. It provides a routing mechanism mapping request URLs to actions, a controller that defines the implementation of actions and a mechanism for generating responses by rendering views templates in various formats.Rails Action Pack has...

Google Tensorflow Input Validation Error Vulnerability (CNVD-2022-09880)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. Google Tensorflow is vulnerable to an input validation error that could be exploited by an attacker to build a TFLite model that leads to an integer overflow in the embedding lookup operation...

Oracle MySQL Connectors Input Validation Error Vulnerability (CNVD-2022-15473)

Oracle MySQL is an open source relational database management system from Oracle Corporation. MySQL Connectors is a driver for applications that use MySQL. versions 8.0.27 and earlier are vulnerable to an input validation error. An attacker could use this vulnerability to compromise Oracle MySQL...

Oracle MySQL Cluster Input Validation Error Vulnerability (CNVD-2022-13061)

Oracle MySQL is an open source relational database management system from Oracle Corporation. MySQL Cluster is a highly useful, highly redundant version of Oracle MySQL Cluster for distributed computing environments. The vulnerability can be exploited to read memory content or crash an applicatio...

WordPress WP Visitor Statistics SQL Injection Vulnerability

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.The WordPress WP Visitor Statistics plugin has a SQL injection vulnerability in versions prior to 4.8. The...

Rosario Student Information System SQL Injection Vulnerability

The Rosario Student Information System is a free student information system used for school administration, and a SQL injection vulnerability exists in the Rosario Student Information System, which can be exploited to execute Postgre SQL statements via the /Side.php parameter via the syear...

Wipro Holmes Orchestrator Access Control Error Vulnerability

Wipro Holmes Orchestrator, a one-stop application artificial intelligence Ai and automation platform orchestrator from Wipro India, is vulnerable to an access control error in Wipro Holmes Orchestrator version 20.4.1, which could be exploited by an unauthenticated attacker to download previously...

FrogCMS Path Traversal Vulnerability

FrogCms is an HTTP server. A path traversal vulnerability exists in FrogCMS, which stems from a vulnerability in the FileManagerController.php function in FrogCMS version 0.9.5, which can be exploited to perform a directory traversal attack via the GET request urlencode parameter...

Delta Electronics DOPSoft 2 Out-of-Bounds Write Vulnerability

Delta Electronics DOPSoft is a set of human-machine interface HMI software from Delta Electronics in Taiwan, China. An out-of-bounds write vulnerability exists in Delta Electronics DOPSoft 2, which can be exploited by an attacker to execute code in the context of the current process...