TP-LINK Cloud Cameras NCXXX Series License RCE Vulnerability

Founded in 1996, TP-LINK, a brand of P&L Technology Ltd, is a leading manufacturer specializing in the research, development, manufacturing and marketing of network and communication terminal equipment. TP-LINK, founded in 1996, is a mainstream manufacturer specializing in the research,...

Multiple RICOH Printer Driver Elevation of Privilege Vulnerabilities

Generic PCL5 Driver, PC FAX Generic Driver, PCL6 PCL XL Driver are RICOH printer drivers. An elevation of privilege vulnerability exists in multiple RICOH printer drivers. An attacker could exploit this vulnerability to gain elevation of privilege...

CA Unified Infrastructure Management Buffer Overflow Vulnerability

CA Unified Infrastructure Management is a unified IT monitoring solution that helps organizations deliver reliable, flexible IT services. A buffer overflow vulnerability exists in the robot component in CA Unified Infrastructure Management 9.20 and earlier. A remote attacker could exploit this...

Siemens SICAM A8000 Command Injection Vulnerability

The Siemens SICAM A8000 is a protection and interval control unit device for relay protection and substation environments from Siemens, Germany. A command injection vulnerability exists in the Siemens SICAM A8000. The vulnerability stems from the device's failure to properly filter constructed...

Google Chrome Networking APIs Code Execution Vulnerability

Google Chrome is a web browser from Google, an American company. A code execution vulnerability exists in Google Chrome Networking APIs that stems from a memory reuse after release issue in the networking APIs. An attacker could exploit this vulnerability to execute arbitrary code on a system or...

Apache Airflow Sqoop Provider Input Validation Error Vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An input validation error vulnerability exists in Apache Airflow Sqoop Provider...

Mozilla Firefox Input Validation Error Vulnerability (CNVD-2023-03060)

Mozilla Firefox is an open source Web browser from the Mozilla Foundation. Mozilla Firefox is vulnerable to an input validation error that stems from a lack of ASN.1 parsing restrictions on error formats. An attacker could exploit this vulnerability to compromise the affected system...

Apache Airflow Command Injection Vulnerability (CNVD-2023-05224)

Apache Airflow is an open source platform for creating, managing and monitoring workflows from the Apache Foundation. Apache Airflow is vulnerable to a command injection vulnerability that could be exploited by remote attackers to submit ad hoc requests that could execute arbitrary commands in th...

XWiki Platform Code Injection Vulnerability

XWiki Platform is the French company XWiki's set of Wiki platform for creating Web collaboration applications. A code injection vulnerability exists in XWiki Platform. The vulnerability stems from incorrectly escaping macro content and menu macro parameters, which can be exploited to execute...

Apache Airflow OS Command Injection Vulnerability (CNVD-2022-83589)

Apache Airflow is an open source platform for creating, managing, and monitoring workflows from the Apache Foundation. The platform features scalable and dynamic monitoring. Apache Airflow suffers from an operating system command injection vulnerability that stems from an improper neutralization ...

Microsoft Exchange Server Elevation of Privilege Vulnerability (CNVD-2022-89608)

Microsoft Exchange Server is a set of email service programs from Microsoft Corporation USA. It provides mail access, storage, forwarding, voice mail, mail filtering and other functions. An attacker could exploit this vulnerability to elevate privileges...

Google Chrome Buffer Overflow Vulnerability (CNVD-2022-76513)

Google Chrome is a web browser from Google, Inc. A security vulnerability exists in Google Chrome, which stems from a heap buffer overflow issue in Crashpad. No details of the vulnerability are currently available...

Google TensorFlow Denial of Service Vulnerability (CNVD-2023-10601)

Google TensorFlow is an end-to-end open source platform for machine learning from Google. Google TensorFlow has a denial-of-service vulnerability that can be exploited by attackers to trigger a denial-of-service attack...

WAVLINK WN530HG4 Trust Management Issue Vulnerability

The WAVLINK WN530HG4 is a wireless router from the Chinese company WAVLINK. A security vulnerability exists in WAVLINK WN530HG4 M30HG4.V5030.191116 version, which originates from a hard-coded encryption/decryption key contained in the configuration file of xportAllSettings.sh. No details of the...

Swftools out-of-bounds write vulnerability (CNVD-2022-62213)

Swftools is a set of utilities for working with Adobe Flash files SWF files. An out-of-bounds write vulnerability exists in Swftools 2020-12-22 and prior versions, which stems from a heap buffer overflow in function swfFontExtractDefineTextCallback located in swftext.c. The vulnerability is cause...

Ericom PowerTerm WebConnect Cross-Site Scripting Vulnerability

Ericom PowerTerm WebConnect is a web browser. version 6.0 of Ericom PowerTerm WebConnect is vulnerable to a cross-site scripting vulnerability that originates when the login portal insecurely writes a cross-site scripting attack load to a page from an AppPortal cookie. An attacker could exploit...

Atom CMS Remote Code Execution Vulnerability

Atom CMS is a content management system. A remote code execution vulnerability exists in Atom CMS version 2.0, which stems from /admin/uploads.php failing to properly filter the special elements of the construct snippet. An attacker could exploit this vulnerability to cause arbitrary code executi...

mruby buffer overflow vulnerability (CNVD-2022-20682)

mruby is a lightweight implementation of the Ruby language. mruby suffers from a buffer overflow vulnerability that stems from the presence of null pointer dereference in mruby, which could be exploited by an attacker to crash the mruby interpreter, thereby impacting system availability...

Nvidia GPU Display Driver for Linux拒绝服务漏洞

Nvidia GPU Display Driver for Linux is a driver for interactive support of graphics modules on Linux systems from Nvidia, Inc. A denial-of-service vulnerability exists in the Nvidia GPU Display Driver for Linux kernel driver package, which can be exploited by attackers to The vulnerability can be...

Fleet Licensing Issue Vulnerability (CNVD-2022-08935)

Fleet is a suite of host monitoring platforms. fleet suffers from an authorization issue vulnerability that stems from a limited ability to spoof SAML authentication with missing user authentication. No detailed vulnerability details are currently available...

Lantronix PremierWave 2050 path traversal vulnerability (CNVD-2022-01589)

The Lantronix PremierWave 2050 is an embedded enterprise Wi-Fi module from Lantronix, Inc. It is used to provide reliable and always-on 5G Wi-Fi connectivity. The Lantronix PremierWave 2050 suffers from a path traversal vulnerability that stems from the lack of effective restrictions and filters ...

WordPress WPS Hide Login plugin authorization issue vulnerability

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on PHP and MySQL servers. WordPress WPS Hide Login plugin has an authorization issue vulnerability in versions prior to 1.9.1, which ste...

Gerapy Authentication Remote Command Execution Vulnerability

Gerapy is a crawler framework based on the Scrapy Scrapyd Scrapyd Client Scrapyd API Django. Gerapy authenticates remote command execution vulnerabilities, which can be exploited by attackers to gain control of the server...

Google TensorFlow buffer overflow vulnerability (CNVD-2021-91276)

Google TensorFlow is an end-to-end open source platform for machine learning from Google Google. A buffer overflow vulnerability exists in Google TensorFlow, which stems from the fact that during the crawler optimization phase of the affected version of TensorFlow, constant folding may attempt to...

Apache ShenYu licensing issue vulnerability

Apache ShenYu is an asynchronous, high-performance, cross-language, responsive API gateway from the Apache Foundation.An authorization issue vulnerability exists in Apache ShenYu Admin, which stems from a misuse of JWT in ShenuAdminBootstrap allowing an attacker to bypass authentication. No...

Google Chrome iframe sandbox security bypass vulnerability

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome iframe sandbox that stems from improper policy enforcement in the product's iframe sandbox. An attacker can exploit the vulnerability to bypass security restrictions...

Draytek VigorConnect Local File Inclusion Vulnerability (CNVD-2021-81961)

VigorConnect is the local network management software for DrayTek devices.A local file inclusion vulnerability exists in the file download function of the DownloadFileServlet endpoint of Draytek VigorConnect version 1.6.0-B3. An attacker could exploit this vulnerability to download arbitrary file...

D-Link DIR-X6060 and D-Link DIR-X1560 Denial of Service Vulnerability

The D-Link DIR-X6060 and D-Link DIR-X1560 are both routers from D-Link, a Taiwan-based company. The security vulnerabilities in the D-Link DIR-X6060 and D-Link DIR-X1560 could be exploited to disconnect wireless clients by sending specific spoofed SAE authentication frames...

TinyFileManager path traversal vulnerability

TinyFileManager is a web-based file manager used to store, upload, edit and manage files and folders online via a web browser. A path traversal vulnerability exists in TinyFileManager 2.4.6 and all versions below, which stems from the software's lack of validation and escaping of the fullpath...

Apache Zeppelin Command Injection Vulnerability

Apache Zeppelin is a Web-based open source notebook application from the Apache Foundation. The application supports interactive data analysis and collaborative documentation. Apache Zeppelin 0.9.0 and earlier versions contain a command injection vulnerability that could be exploited by an attack...

Google TensorFlow null pointer dereference vulnerability (CNVD-2021-64074)

Google TensorFlow is an end-to-end open source machine learning platform. a null pointer dereference vulnerability exists in the tf.rawops.SparseTensorSliceDataset implementation in versions prior to Google TensorFlow 2.6.0. No detailed vulnerability details are available at this time...

Adobe Captivate 2019 Elevation of Privilege Vulnerability

Adobe Captivate 2019 is a tool that allows us to quickly create and produce interactive content in html. An elevation of privilege vulnerability exists in Adobe Captivate 2019 11.5.5 and earlier versions. The vulnerability stems from creating temporary files in a directory with incorrect...

PHPMailer has an unspecified vulnerability (CNVD-2021-53931)

PHPMailer is a PHP class library for sending emails. PHPMailer has a security vulnerability that can be exploited by remote attackers to execute arbitrary PHP code on the target system...

Auth0 express-jwt Authorization Issues Vulnerability

Auth0 express-jwt is a package that supports authentication of JWT JSON Web tokens via the jsonwebtoken module from Auth0 USA. An authorization issue vulnerability exists in Auth0 express-jwt version 5.3.3 and earlier NPM package, which can be exploited by an attacker to bypass authorization with...

CloudMe Buffer Overflow Vulnerability

CloudMe is a file storage service that includes cloud storage, file synchronization, and client browsing software. A buffer overflow vulnerability exists in CloudMe. A remote attacker could exploit this vulnerability to execute arbitrary code...

TOTOLINK N600R Command Injection Vulnerability

TOTOLINK N600R is a dual-band wireless router launched by Korean brand TOTOLINK in 2013, which supports 2.4GHz and 5GHz bands to work concurrently, with a maximum wireless transmission rate of up to 300Mbps. The TOTOLINK N600R suffers from a command injection vulnerability that stems from the pin...

SQL Injection Vulnerability in DedeCMS of Shanghai Zhuozhuo Network Technology Company Limited (CNVD-2024-13237)

DedeCMS is the most well-known PHP open source website management system, but also the use of the most users of the PHP class CMS system. Shanghai Zhuozhuo Network Technology Co., Ltd. DedeCMS SQL injection vulnerability, attackers can use the vulnerability to obtain database sensitive informatio...

Google Chrome Security Bypass Vulnerability (CNVD-2024-10242)

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome version 121.0.6167.85 and prior versions due to an improper implementation in the Extensions API. An attacker can exploit the vulnerability to bypass security restrictions...

Apache Submarine Deserialization Vulnerability

Apache Submarine is a cloud-native machine learning platform from the Apache USA Foundation. Apache Submarine suffers from a deserialization vulnerability that stems from unsafe deserialization processing by snakeyaml when receiving serialized data submitted by a user, which can be exploited by a...

Google TensorFlow tf.raw_ops.TensorListConcat denial of service vulnerability

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A denial of service vulnerability exists in Google TensorFlow versions prior to 2.8.4, 2.9.0 and later, 2.9.3 and later, 2.10.0 and later, and 2.10.1. TensorListConcat" is given "elementshape=", resulti...

NextAuth.js authorization issue vulnerability

NextAuth.js is an authentication for Next.js. NextAuth.js version v3.0.2 is vulnerable to authorization issues, which can be exploited by attackers to perform unauthorized actions...

Google TensorFlow CollectiveGather Denial of Service Vulnerability

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A denial-of-service vulnerability exists in Google TensorFlow, which stems from the fact that when CollectiveGather receives a scalar input input, it gives an assertion of failure, which can be exploite...

D-Link DIR-2150 OS Command Injection Vulnerability (CNVD-2023-21660)

The D-Link DIR-2150 is a wireless router device from D-Link.The D-Link DIR-2150 is vulnerable to an operating system command injection vulnerability that could be exploited by attackers to execute code in the context of a service account...

Google Chrome Intents security bypass vulnerability

Google Chrome is a web browser from Google, Inc. A security bypass vulnerability exists in Google Chrome Intents, which is caused by an untrusted input that does not adequately validate intent and can be exploited by attackers to bypass security restrictions...

Red Hat OpenShift Cross-Site Scripting Vulnerability

Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform from Red Hat that supports building, testing, deploying, and running applications. JavaScript code on the client side...

SIEMENS Teamcenter Hardcoded Default Credentials Vulnerability

Teamcenter software is a modern, adaptable product lifecycle management PLM system that connects people and processes across functional silos through digital threads to enable innovation.SIEMENS Teamcenter is vulnerable to a hard-coded default credential vulnerability that originates in the Java ...

Artifex Software Artifex MuJS Denial of Service Vulnerability (CNVD-2022-70081)

Artifex Software Artifex MuJS is a lightweight JavaScript interpreter from Artifex Software, Inc. that is used to embed into other software to provide script execution functionality.Artifex Software Artifex MuJS version 1.2.0 and earlier versions are vulnerable to denial of service vulnerability,...

Cisco IOS XE AVC-FNF Denial of Service Vulnerability

Cisco IOS XE is a set of operating systems developed by Cisco for its network devices.A denial of service vulnerability exists in Cisco IOS XE AVC-FNF, which originates from packets that do not adequately validate traffic inspected by the AVC function and can be exploited by attackers to cause a...

Nextcloud Information Disclosure Vulnerability (CNVD-2022-20155)

Nextcloud is a set of open source self-hosted file synchronization and sharing communication applications platform from Nextcloud Germany.A security vulnerability exists in Nextcloud Server, which is due to an issue with the Nextcloud Text application which is provided with Nextcloud Server by...

IBM AIX Denial of Service Vulnerability (CNVD-2022-48942)

IBM AIX is an open standards-based UNIX operating system developed for the IBM Power architecture. IBM AIX denial-of-service vulnerability, which stems from the product AIX pmsvcs kernel extensions do not do the correct processing of incoming error messages, an attacker can use the vulnerability ...