131315 matches found
KiCad EDA Buffer Overflow Vulnerability (CNVD-2022-18330)
KiCad Eda is a cross-platform and open source electronic design automation suite from the KiCad community. KiCad EDA is vulnerable to a buffer overflow vulnerability that could be exploited by an attacker with a specially crafted gerber or excellon file to cause code execution...
Unspecified vulnerability in IDEC PLC (CNVD-2022-02761)
The IDEC PLC is a programmable controller. A security vulnerability exists in the IDEC PLC that can be exploited by an attacker to obtain user credentials from a file server, a backup repository, or a ZLD file saved on an SD card...
Mozilla Rust Memory Corruption Vulnerability (CNVD-2022-01149)
Rust is a general-purpose, compiled programming language from the Mozilla Foundation. security vulnerability exists in versions of Rust pnet crate prior to 0.27.2, which stems from an IcmpTransportChannelIterator compiler optimization error. An attacker could exploit this vulnerability to cause a...
WordPress Plugin SQL Injection Vulnerability (CNVD-2021-101473)
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress Plugin is a WordPress open source application plugin. SQL injection vulnerability exists in the Wordpress...
Adobe Premiere Elements memory buffer out-of-bounds access vulnerability
Adobe Premiere Elements is a video editing software application from Adobe. Adobe Premiere Elements 2021 build 19.0 and earlier versions are vulnerable to a memory buffer out-of-bounds access vulnerability. An attacker can exploit this vulnerability to execute arbitrary code...
Siemens SINEC NMS Path Traversal Vulnerability
Siemens SINEC NMS is a network management system NMS from Siemens, Germany, that can be used 24/7 to centrally monitor, manage and configure industrial networks with tens of thousands of devices, including safety-related areas. A path traversal vulnerability exists in Siemens SINEC NMS versions...
Bento4 Heap Buffer Overflow Vulnerability
Bento4 is an open source C library for reading and writing MP4 files. Bento4 suffers from a heap buffer overflow vulnerability, which stems from a lack of proper boundary checking in the AP4StdcFileByteStream :: ReadPartial component of /StdC/Ap4StdCFileByteStream.cpp. An attacker could exploit...
WordPress ProfilePress plugin trust management issue vulnerability
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A trust management issue vulnerability exists in the ProfilePress plugin for WordPress versions 3.0....
Envoy integer overflow vulnerability
Envoy is an open source distributed proxy server. versions prior to Envoy 1.71.1 are vulnerable to integer overflow, which can be exploited by an attacker with an excessive grpc-timeout value to cause an unexpected timeout calculation...
WordPress College publisher Import plugin file upload vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.College publisher Import is a plugin for WordPress. A file upload vulnerability exists in WordPress College publisher...
Odoo Arbitrary Code Execution Vulnerability
Odoo is an open source enterprise management suite , its features cover CRM, sales, purchasing, inventory management , manufacturing , quality management , HR full-featured , financial management , project management , PLM and a series of perfect enterprise information needs . An arbitrary code...
Apache HTTP Server Data Forgery Issue Vulnerability
Apache HTTP Server is the United States Apache Software Apache Software Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. A data forgery vulnerability exists in Apache HTTP Server. The vulnerability arises from a network system or...
Multiple Red Hat Products Security Feature Issue Vulnerabilities
Red Hat Ceph Storage and Red Hat OpenShift are both products of Red Hat, Inc. Red Hat Ceph Storage is a scalable, open software-defined storage platform.Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform that supports building, testing, deploying, and running applications....
Pivotal Software Spring Cloud Config Path Traversal Vulnerability
Pivotal Software Spring Cloud Config is a configuration management solution for distributed systems from Pivotal Software. The product mainly provides server and client support for external configuration in distributed systems. A path traversal vulnerability exists in Pivotal Software Spring Clou...
zzzcms zzzphp dynamic code execution vulnerability
zzzcms zzzphp is a content management system CMS. A security vulnerability exists in version V1.6.1 of zzzcms zzzphp, which stems from a lax filtering of search template parsing on the search page. An attacker can exploit this vulnerability to execute PHP code...
librsync Limit Bypass Vulnerability
librsync is a free software library developed by software developer Martin Pool that implements the rsync remote-delta algorithm which enables fast and instantaneous updating of remote files over a network. A security restriction bypass vulnerability exists in versions of librsync prior to 1.0.0...
AC8 Buffer Overflow Vulnerability (CNVD-2025-07592) in Shenzhen Jixiang Tengda Technology Co.
Shenzhen Jixiang Tengda Technology Co., Ltd AC8 is a wireless router. Shenzhen Jixiang Tengda Technology Co., Ltd AC8 has a buffer overflow vulnerability, the vulnerability stems from the SetRouteStatic function fails to correctly validate the length and size of the input data, an attacker can us...
GNU Wget Code Problem Vulnerability
GNU Wget is a set of free software from the American GNU community for downloading over the Internet, which supports downloading over the three most common TCP/IP protocols: HTTP, HTTPS, and FTP. A code issue vulnerability exists in GNU Wget that stems from an application using Wget to access...
Adobe RoboHelp Server Path Traversal Vulnerability
Adobe RoboHelp Server is a server-based application for FrameMaker and RoboHelp enterprise users. A path traversal vulnerability exists in Adobe RoboHelp Server, which can be exploited by an attacker to execute arbitrary code on the system by sending a specially crafted URL request that contains...
Google Android elevation of privilege vulnerability (CNVD-2024-07112)
Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by attackers to gain elevated privileges...
Milesight UR32L vtysh_ubus toolsh_excute.constprop.1 Functional Command Injection Vulnerability (CNVD-2023-65490)
The Milesight UR32L is a 4G industrial router from China's Milesight. The Milesight UR32L vtyshubus toolshexcute.constprop.1 feature suffers from a command injection vulnerability that can be exploited by an attacker to execute arbitrary commands on the system...
Apache InLong Security Bypass Vulnerability (CNVD-2023-42962)
Apache InLong is the United States Apache Apache Foundation's one-stop massive data integration framework. A security bypass vulnerability exists in Apache InLong versions 1.2.0 through 1.6.0, which can be exploited by an attacker to cancel an application...
IBM Aspera Faspex SQL Injection Vulnerability
IBM Aspera is a set of fast file transfer and streaming solutions built on the IBM FASP protocol from International Business Machines IBM Inc. An SQL injection vulnerability exists in IBM Aspera Faspex version 4.4.2. The vulnerability stems from the application's lack of validation of external...
Siemens Teamcenter Visualization and JT2Go Memory Corruption Vulnerability
Siemens Teamcenter Visualization is a software that provides team collaboration capabilities for designing 2D and 3D scenes. Siemens JT2GO is a JT file viewer. Siemens Teamcenter Visualization and JT2Go are vulnerable to a memory corruption vulnerability that could be exploited by an attacker to...
AVEVA Edge has an information disclosure vulnerability
AVEVA Edge is a highly scalable and flexible HMI/SCADA software from the UK-based Jianwei Software AVEVA. An information disclosure vulnerability exists in AVEVA Edge version 2020 R2, which can be exploited by an attacker to obtain account information for accessing external DB resource...
qpress directory traversal vulnerability
qpress is a patched version of the qpress file archiver program by the individual developer EvgeniyPatlan. A directory traversal vulnerability exists in qpress versions 11.3 and prior to 2022.08.19, which stems from a lack of checking of paths when processing directory requests and can be exploit...
Oracle MySQL Input Validation Error Vulnerability (CNVD-2022-88288)
Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. An input validation error vulnerability exists in Oracle MySQL, which can be exploited by an attacker to cause certain unauthorized update, insert, o...
Joomla! path traversal vulnerability (CNVD-2022-64100)
A path traversal vulnerability exists in Joomla! versions 3.0.0 through 3.10.6 and 4.0.0 through 4.1.0, which stems from a failure of a web system or product to properly filter special elements in a resource or file path, and can be exploited by remote attackers to send specially crafted .zip...
Siemens SINEC NMS Elevation of Privilege Vulnerability
Siemens SINEC NMS is a network management system NMS from Siemens Germany that can be used to centrally monitor, manage, and configure industrial networks with tens of thousands of devices, including security-related areas, 24 hours a day, 7 days a week. The vulnerability could be exploited to...
WordPress Crazy Bone plugin cross-site scripting vulnerability
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability in WordPress Crazy Bone plugin 0.6.0 and earlier versions, which stems fr...
microweber has an unspecified vulnerability (CNVD-2022-13203)
Microweber is an online store management system from the US Microweber community that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. Microweber has a security vulnerability, and no details of the vulnerability are available at this time...
Siemens Spectrum Power 4 Cross-Site Scripting Vulnerability
Spectrum Power provides essential components for SCADA, communications and data modeling for control and monitoring systems. Siemens Spectrum Power 4 suffers from a cross-site scripting vulnerability that can be exploited by an attacker to conduct an attack if an unsuspecting user is tricked into...
Apache Karaf code issue vulnerability (CNVD-2022-14707)
Apache Karaf is the United States Apache Apache Foundation for the deployment of applications and components of a lightweight OSGi Java Dynamic Modular System container. Apache Karaf suffers from a code issue vulnerability that stems from insecure input validation when handling serialized data,...
Discourse has an unspecified vulnerability (CNVD-2022-05505)
Discourse is an open source community discussion platform that includes community, email, and chat room features. A security vulnerability exists in Discourse, which stems from the fact that users invited via email to a forum with "must approve users" enabled will automatically log in, bypassing...
Apache James Command Injection Vulnerability
Apache James is an open source Smtp and Pop3 mail transfer agent and Nntp news server written entirely in Java by the Apache Foundation. Apache James 3.6.1 is vulnerable to a command injection vulnerability that could be exploited by attackers to perform a man-in-the-middle command injection...
Grafana Path Traversal Vulnerability (CNVD-2021-100286)
Grafana is an open source monitoring tool from Grafana Labs that provides a visual monitoring interface. The tool is mainly used to monitor and analyze Graphite, InfluxDB and Prometheus, etc. A path traversal vulnerability exists in Grafana, which stems from the product's failure to effectively...
TinyFileManager path traversal vulnerability
TinyFileManager is a web-based file manager used to store, upload, edit and manage files and folders online via a web browser. A path traversal vulnerability exists in TinyFileManager 2.4.6 and all versions below, which stems from the software's lack of validation and escaping of the fullpath...
Siemens IFC adapter in NX use after release vulnerability
NX software is an integrated toolset that helps develop design, simulation and manufacturing solutions by supporting all aspects of product development. A use-after-release vulnerability exists in Siemens IFC adapter in NX, which can be exploited by an attacker to execute code in the context of t...
Apache Dubbo formatting string error vulnerability
Apache Dubbo is a lightweight Java-based RPC remote procedure call framework from the Apache Foundation. It provides interface-based remote calling, fault tolerance and load balancing, and automatic service registration and discovery.A code injection vulnerability exists in Apache Dubbo, which...
Advantech R-SeeNet File Inclusion Vulnerability
Advantech R-SeeNet is an industrial monitoring software from Advantech, Taiwan, China. The software is based on the snmp protocol for monitoring platforms and is available for Linux and Windows platforms.Advantech R-SeeNet suffers from a file inclusion vulnerability, which stems from the failure ...
Unspecified Vulnerability in JerryScript (CNVD-2021-42984)
JerryScript is a lightweight JavaScript engine . A security vulnerability exists in the parserparseobjectinitializer in js-parser-expr.c:3230 in JerryScript version 2.2.0. No details of the vulnerability are provided at this time...
Wireshark Memory Consumption Vulnerability
Wireshark is a network packet analyzer. Wireshark is a network packet analyzer that captures network packets and displays the most detailed packet information possible.Wireshark uses WinPCAP as an interface to exchange data packets directly with the network card. A memory consumption vulnerabilit...
Unspecified Vulnerability in Rust (CNVD-2021-37535)
Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in versions prior to Rust magnetic crate 2.0.1 that stems from MPMCConsumer and MPMCProducer allowing cross-threaded sends of non-sending types. No details of the vulnerability ar...
Total.js CMS Command Injection Vulnerability
Total.js CMS is a content management system CMS based on a NoSQL database. A command injection vulnerability in Total.js CMS version 12.0.0 can be exploited by an attacker to execute illegal commands...
eslint-utils Arbitrary Code Execution Vulnerability
eslint-utils is a utility for ESLint plugins and custom rules. An arbitrary code execution vulnerability exists in versions of eslint-utils prior to 1.4.1. An attacker can exploit this vulnerability to execute arbitrary code via the getStaticValue function...
Artifex Software MuJS Buffer Overflow Vulnerability (CNVD-2016-10581)
Artifex Software MuJS is a lightweight JavaScript interpreter from Artifex Software, USA. Artifex Software MuJS 5000749f5afe3b956fc916e407309de840997f4a A buffer overflow vulnerability exists in the Spreplaceregexp function in previous versions, which can be exploited by an attacker to execute co...
vBulletin forumrunner/includes/moderation.php SQL Injection Vulnerability
VBulletin is a powerful, flexible and fully customizable suite of forum programs. A SQL injection vulnerability exists in the forumrunner/includes/moderation.php file in versions of vBulletin prior to 4.2.2 Patch Level 5 and prior to 4.2.3 Patch Level 1. A remote attacker can exploit this...
WAVLINK AC3000 adm.cgi set_TR069 Function Command Injection Vulnerability
WAVLINK AC3000 is a wireless router from China Ruiyin WAVLINK. A command injection vulnerability exists in the WAVLINK AC3000 M33A8.V5030.210505 version, which stems from the failure of the adm.cgi setTR069 function to correctly filter constructed command special characters, commands, etc. The...
Mozilla Firefox Denial of Service Vulnerability (CNVD-2024-10440)
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from a denial of service vulnerability caused by a stack buffer overflow in the WebAudio OscillationNode object. An attacker can exploit this vulnerability to cause the browser ...
Siemens CPCI85 Firmware of SICAM A8000 Devices Command Injection Vulnerability
The SICAM A8000 rtu remote terminal unit series is a modular family of devices for remote control and automation applications in all areas of energy supply. A command injection vulnerability exists in the Siemens CPCI85 Firmware of SICAM A8000 Devices, which can be exploited by an authenticated,...