Huawei HarmonyOS HwChrService module licensing issue vulnerability

Huawei HarmonyOS is an operating system from Huawei, a Chinese company that provides a microkernel-based, fully distributed operating system. Huawei HarmonyOS is vulnerable to an authorization issue stemming from improper privilege management in the HwChrService module, which could be exploited b...

Bluecms has an unspecified vulnerability

BlueCMS is a PHP and MySQL based content management system CMS. a security vulnerability exists in BlueCMS version 1.6, which stems from an SQL injection in line 55 of admin/model.php. No details of the vulnerability are currently available...

GitLab CE/EE Remote Command Execution Vulnerability

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features.GitLab CE/EE has a security vulnerability that could be exploited by an attacke...

Adobe Acrobat Reader Input Validation Error Vulnerability

Adobe Acrobat Reader is a PDF viewer from the American company Audobee Adobe. The software is used to print, sign and annotate PDF. An input validation error vulnerability exists in Adobe Acrobat Reader that stems from improper input validation and can be exploited by an attacker to cause a memor...

Jenkins RocketChat Notifier Plugin信息泄露漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.An information disclosure vulnerability...

WordPress Google Tag Manager plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress Newsletter plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

npm semver-regex denial of service vulnerability

npm semver-regex is a regular expression used to match semver versions. semver-regex versions prior to 3.1.4 and versions 4.0.0 inclusive through 4.0.2 have a denial of service vulnerability that stems from not properly handling incoming error messages, which can be exploited to cause a denial of...

Fortinet FortiOS Access Control Error Vulnerability (CNVD-2022-50945)

Fortinet FortiOS is a dedicated security operating system for the FortiGate network security platform from Fortinet, Inc. Fortinet FortiOS versions 6.4.8 and earlier and 7.0.3 and earlier are vulnerable to an access control error that could be exploited by an authenticated attacker with a...

Blazer SQL Injection Vulnerability

Blazer is a tool. Allows SQL queries to be executed against a database from a Web panel.A SQL injection vulnerability exists in versions of Blazer prior to 2.6.0, which stems from the application's lack of validation of externally entered SQL statements. An attacker could exploit this vulnerabili...

ZOHO ManageEngine ADSelfService Plus Information Disclosure Vulnerability (CNVD-2022-55221)

An information disclosure exists in Zoho ManageEngine ADSelfService Plus, ZOHO's integrated self-service password management and single sign-on solution for Active Directory and cloud applications. A vulnerability exists in Zoho ManageEngine ADSelfService Plus, which stems from the disclosure of...

Out-of-bounds write vulnerability in multiple Adobe products (CNVD-2022-46968)

Adobe Acrobat is a set of PDF file editing and conversion tools.Adobe Reader is a set of PDF document reading software. Multiple Adobe products have out-of-bounds write vulnerabilities that can be exploited by an attacker to execute arbitrary code in the context of the current user...

Microsoft Windows Network File System Remote Code Execution Vulnerability (CNVD-2022-74601)

Microsoft Windows Network File System is a file sharing solution from Microsoft that allows you to transfer files between computers running Windows Server and UNIX operating systems using the NFS protocol. Network File System is vulnerable to a remote code execution vulnerability caused by a flaw...

Google Android Buffer Overflow Vulnerability (CNVD-2022-47673)

Google Android is a Linux-based open source operating system from Google, Inc. Google Android suffers from a buffer overflow vulnerability, which stems from a lack of privilege checks in the ims service, and can be exploited by attackers to cause local privilege escalation...

Jenkins Dashboard View Plugin Cross-Site Scripting Vulnerability

Jenkins and Jenkins Plugin are both products of Jenkins, an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. Jenkins Dashboard View Plugin version 2.18 and earlier is vulnerable to a cross-site scripting...

showdoc .shtml file upload vulnerability

showdoc is an open source tool for IT teams to share documents online. showdoc versions prior to v2.10.4 are vulnerable to file uploads, which stem from the lack of effective detection of .shtml file extensions in the application's file upload feature. An attacker could use this vulnerability to...

Orchard Core Permissions and Access Control Issues Vulnerability

Orchard Core is an open source modular and multi-tenant application framework built with Asp.Net Core and a content management system Cms built on top of the framework from Orchard Core, Inc. Orchard Core is vulnerable to privilege permission and access control issues that could be exploited by a...

MyBB Remote Code Execution Vulnerability (CNVD-2022-20097)

MyBB is a free and web-based forum software developed by MyBB team using PHP and MySQL. The software is characterized by its simplicity, multi-language support and extensibility. A remote code execution vulnerability exists in MyBB, which can be exploited to cause a Remote Code Execution RCE...

Siemens Climatix POL909 (AWM and AWB) Cross-Site Scripting Vulnerability (CNVD-2022-17788)

Siemens Climatix AWB Advanced Web and BACnet Module, POL909 enables users of the Climatix 600 solution to connect to a BACnet IP network and implement and load customer web pages and features. Siemens Climatix AWM Advanced Web Module, POL909 enables users of the Climatix 600 solution to implement...

Tp-link Archer C2 OS Command Injection Vulnerability

TP-Link Archer C2 is a wireless router from Tp-link.TP-Link Archer C20i version 0.9.1 3.2 v003a.0 Build 170221 Rel.55462n is vulnerable due to a security flaw in the device's HTTP parameter XTP ExternalIPv6Address. ExternalIPv6Address in the device lacks filtering and escaping of user data, which...

WordPress NextScripts:Social Networks Auto-Poster plugin cross-site request forgery vulnerability

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. WordPress NextScripts:Social Networks Auto-Poster plugin is vulnerable to cross-site request forgery in versions prior to 4.3.25. The vulnerability stems from the fact that there is no CSRF check...

Reolink Rlc-410W Denial of Service Vulnerability

Reolink Rlc-410W is a Wifi security camera from Reolink China.Reolink RLC-410W has a security vulnerability that can be exploited by attackers to cause a denial of service...

Multiple Siemens Industrial Products Denial of Service Vulnerabilities

SIMATIC Drive Controller family products are machines designed for production automation, combining the functionality of the SIMATIC S7-1500 CPU and the SINAMICS S120 drive control.SIMATIC S7-1200 CPU family products are designed for discrete and continuous control in industrial environments such...

FreeCAD ODA Command Injection Vulnerability

FreeCad is a free and open source general-purpose parametric 3D Cad modeler from the FreeCad community and supports the finite element method of building information modeling software. A command injection vulnerability exists in FreeCAD version 0.19, which stems from improper cleanup when calling...

JerryScript /js-parser-mem.c Denial of Service Vulnerability

JerryScript is a lightweight JavaScript engine from the JerryScript project.JerryScript has a denial-of-service vulnerability in version 3.0.0, which stems from an assertion failure in /parser/js/js-parser-mem.c. An attacker could use this vulnerability to launch a denial of service...

gif2apng buffer overflow vulnerability

gif2apng is a simple program that converts animations from GIF to APNG format. gif2apng suffers from a buffer overflow vulnerability that stems from an incorrect while loop in the product code, which can be exploited by an attacker to cause a buffer overflow...

Unspecified vulnerability in Rust bronzedb-protocol crate

Rust bronzedb-protocol crate is browndb is a kv database. It is a re-export crate. a security vulnerability exists in Rust bronzedb-protocol crate, which stems from the fact that ReadKVExt can read data from an uninitialized memory location. No detailed vulnerability details are available at this...

Talariax SendQuick Alertplus Server Admin Information Disclosure Vulnerability

TalariaX Pte Ltd Talariax SendQuick Alertplus Server Admin is a server management system of TalariaX Pte Ltd, Singapore. versions prior to 4.3 8HF11, a security vulnerability exists in the software where /appliance/shiftmgn.php lacks effective filtering and escaping of user submitted SQL...

Sourcecodester Online Event Booking and Reservation System Cross-Site Scripting Vulnerability

Sourcecodester Online Event Booking and Reservation System is developed using PHP, MySQL database, HTML, CSS, Javascript, Bootstrap and AdminLTE. The system can be accessed by 3 types of users, namely system administrators, students and faculty. sourcecodester Online Event Booking and Reservation...

bugs cross-site scripting vulnerability

Bugs is a branch of the open-source Tinyissue defect tracking system by Alexandre Plennevaux, a Belgian individual developer. bugs 1.8 and earlier versions of install/index.php are vulnerable to cross-site scripting, which can be exploited by remote attackers to inject arbitrary web scripts via...

Google TensorFlow buffer overflow vulnerability (CNVD-2021-64539)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A security vulnerability exists in Google TensorFlow, which could be exploited by an attacker to bind a reference to a null pointer in all operations of type tf.rawops.MatrixSetDiagV to cause undefined...

Prosodical Thoughts Prosody Information Disclosure Vulnerability

Prosodical Thoughts Prosody is an open source application of Prosodical Thoughts. A modern XMPP communication server. Prosodical Thoughts Prosody is vulnerable to an information disclosure vulnerability that originates in muc.lib.lua in Prosody versions 0.11.0 through 0.11.9, which can be exploit...

Google Android iaxxx-codec.c elevation of privilege vulnerability

Google Android is a Linux-based open source operating system from the Google Open Handheld Consortium Google. Google Android iaxxx-codec.c suffers from an elevation of privilege vulnerability. An attacker can exploit this vulnerability to cause a local elevation of privilege...

Synology DiskStation Manager Path Traversal Vulnerability

Synology DiskStation Manager DSM is an operating system for use on Network Storage Servers NAS from Synology Inc. of Taiwan, China. This operating system manages information such as data, files, photos, music, and more. A path traversal vulnerability exists in Synology DiskStation Manager version...

Pillow Buffer Overflow Vulnerability (CNVD-2021-54035)

Pillow is a Python-based image processing library.A buffer overflow vulnerability exists in Pillow Tiff image file processing, which can be exploited by remote attackers to submit special file requests that trick users into parsing, which can crash the application or execute arbitrary code in the...

Rust Resource Management Error Vulnerability (CNVD-2021-17263)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in scratchpad crate before 1.3.1 for Rust, which stems from the move elements function being able to use double free. no details of the vulnerability are currently available...

Nagios XI Remote Code Execution Vulnerability

Nagios XI is a commercial monitoring solution built on Nagios Core, including dashboards, web-based configuration, advanced reporting and rich data visualization. A remote code execution vulnerability exists in the "Manage Plugins" page in Nagios XI versions prior to 5.8.0. The vulnerability stem...

Projectworlds Online Book Store Project In Php SQL Injection Vulnerability

Projectworlds Online Book Store Project In Php is a Php-based online bookstore system from the Austrian company Projectworlds. Projectworlds Online Book Store Project In Php 1.0 is vulnerable to SQL injection. An attacker could exploit this vulnerability to dump the entire database on which the w...

Zeroshell command injection vulnerability

Zeroshell is a small open source Linux distribution for servers and embedded systems designed to provide web services. a command injection vulnerability exists in the /cgi-bin/kerbynet StartSessionSubmit parameter in Zeroshell 3.9.3. An attacker could execute system commands via shell...

Apache HTTP Server Input Validation Error Vulnerability

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. An input validation error vulnerability exists in Apache HTTP Server versions 2.4.0 through 2.4.41. The vulnerability arises from ...

mongo-express code execution vulnerability

mongo-express is a lightweight web-based management interface for interactively managing MongoDB databases. A security vulnerability exists in mongo-express versions prior to 0.54.0. An attacker can exploit this vulnerability to execute code with the help of an endpoint using the toBSON method...

AdPlug Buffer Overflow Vulnerability (CNVD-2019-32341)

AdPlug is an AdLib sound player library written in C++. A buffer overflow vulnerability exists in the 'Ca2mLoader::load' function of the a2m.cpp file in AdPlug version 2.3.1. The vulnerability stems from a networked system or product performing operations in memory without properly validating dat...

DISCOUNT Denial of Service Vulnerability (CNVD-2018-10852)

DISCOUNT is a Markdown markup language implementation. A security vulnerability exists in the 'isfootnote' function in the markdown.c file of the libmarkdown.a static link library in DISCOUNT version 2.2.3a. A remote attacker can exploit this vulnerability to cause a denial of service heap-based...

Mathias Kettner Check_MK Information Disclosure Vulnerability

Mathias Kettner CheckMK is an open-source, general-purpose Nagios/Icinga monitoring system data collection plug-in from Mathias Kettner, Germany, which collects data from operating system and network components by employing a new methodology and supports the automated detection of monitoring item...

Samsung MagicINFO 9 Server Path Traversal Vulnerability

Samsung MagicINFO 9 Server is a core component of the MagicINFO solution and is responsible for content management and scheduling functions. A path traversal vulnerability exists in Samsung MagicINFO 9 Server, which stems from an improperly restricted pathname, and can be exploited by an attacker...

Mozilla Firefox and Thunderbird Information Disclosure Vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the U.S. Mozilla Thunderbird is a set of e-mail client software separate from the Mozilla Application Suite. Mozilla Firefox and Thunderbird have an information disclosure vulnerability that is caused by a CSP violation...

Apache Tomcat Denial of Service Vulnerability (CNVD-2024-13569)

Apache Tomcat is the United States Apache Apache Foundation of a lightweight Web application server. The program implements the Servlet and JavaServer Page JSP support. Apache Tomcat has a denial of service vulnerability that can be exploited by an attacker to increase resource consumption and...

Siemens Sinteso EN and Cerberus PRO EN Fire Protection Systems Stack Buffer Overflow Vulnerability

Cerberus PRO EN is a fire protection system consisting of fire panels, detection and management stations. It is available to Siemens partners and complies with the European standard EN 54 for fire detection and alarm systems. Sinteso EN is a fire protection system consisting of fire panels,...

Cups Easy cross-site scripting vulnerability (CNVD-2024-11137)

Cups Easy is a PHP-based purchasing and inventory software that may become a full-fledged ERP in the future. Cups Easy suffers from a cross-site scripting vulnerability that stems from insufficient escaping of the grndate parameter on the /cupseasylive/grnmodify.php page. An attacker could use th...

MindsDB Information Disclosure Vulnerability

MindsDB is an emerging low-code machine learning platform from MindsDB, Inc. An information disclosure vulnerability exists in MindsDB versions prior to 23.11.4.1, which stems from insufficient protection of sensitive information in file.py and can be exploited by an attacker to cause information...