Apache Submarine Deserialization Vulnerability

Apache Submarine is a cloud-native machine learning platform from the Apache USA Foundation. Apache Submarine suffers from a deserialization vulnerability that stems from unsafe deserialization processing by snakeyaml when receiving serialized data submitted by a user, which can be exploited by a...

Google Android elevation of privilege vulnerability (CNVD-2024-10418)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by an attacker to gain elevated privileges...

Apache Superset REST API Authorization Issues Vulnerability

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset version 2.1.0 and prior versions suffer from an authorization issue vulnerability that stems from incorrect REST API permissions. An attacker can exploit this vulnerability to cau...

Gitea Input Validation Error Vulnerability (CNVD-2023-60472)

Gitea is a lightweight Go-based git service developed by the Gitea community. An input validation error vulnerability exists in Gitea versions prior to 1.19.4, which stems from improper input validation of the program. An attacker can exploit this vulnerability to obtain sensitive information...

Apache Traffic Server Denial of Service Vulnerability (CNVD-2023-55453)

Apache Traffic Server ATS is the United States Apache Apache Foundation's set of scalable HTTP proxy and caching server. A denial of service vulnerability exists in Apache Traffic Server due to improper input validation related to the configuration option proxy.config.http.pushmethodenabled faili...

Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability (CNVD-2023-28109)

Microsoft PostScript Printer Driver is a Microsoft standard printer driver for PostScript printers from Microsoft USA. Microsoft PCL6 Class Printer Driver is a printer driver software from Microsoft Corporation. Microsoft PostScript and PCL6 Class Printer Driver contains a remote code execution...

Siemens Parasolid and Solid Edge SE2022 out-of-bounds read vulnerability

Siemens Parasolid is a geometric modeling kernel from Siemens, a German company. Siemens Solid Edge is a 3D CAD software from Siemens, a German company. The software can be used in industries such as part design, assembly design, sheet metal design, welding design, etc. An out-of-bounds read...

Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability (CNVD-2023-35225)

Microsoft PostScript Printer Driver is a Microsoft standard printer driver for PostScript printers from Microsoft.Microsoft PCL6 Class Printer Driver is a printer driver from Microsoft. Microsoft PCL6 Class Printer Driver is a printer driver software from Microsoft. A remote code execution...

PbootCMS SQL Injection Vulnerability (CNVD-2023-11247)

PbootCMS is an open source enterprise building content management system CMS using PHP language developed by PbootCMS individual developers. A security vulnerability exists in PbootCMS version 3.0.5. An attacker can exploit the vulnerability to execute arbitrary SQL commands via a specially craft...

Siemens SINEC INS Path Traversal Vulnerability (CNVD-2023-02707)

SINEC INS Infrastructure Network Services is a web-based application that combines various network services in a single tool. This simplifies the installation and management of all network services related to industrial networks.A path traversal vulnerability exists in Siemens SINEC INS, which...

Mozilla Firefox Injection Vulnerability (CNVD-2023-03055)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from an injection vulnerability that stems from a failure to execute the Unsafe-Hashes CSP directive. An attacker could exploit this vulnerability to inject executable script...

GE CIMPLICITY HMI/SCADA Software has an unspecified vulnerability

GE CIMPLICITY HMI/SCADA Software is an automation industrial platform from General Electric GE, Inc. It provides true client-server visualization and control from a single machine to plant locations around the world to help manage operations and improve decision making.GE CIMPLICITY HMI/SCADA...

WordPress Contact Form 7 Database Addon plugin CSV Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A CSV injection vulnerabili...

XXL-JOB code issue vulnerability

XXL-JOB is a distributed task scheduling platform based on the java language from the Xu Xueli XXL-JOB community.A security vulnerability exists in versions prior to XXL-JOB v2.3.1, which stems from a vulnerability found via the component /admin/controller/JobLogController.java containing...

IBM CICS TX Encryption Problem Vulnerability (CNVD-2022-83579)

IBM CICS TX is a comprehensive, single transaction runtime package from International Business Machines IBM. IBM CICS TX version 11.7 is vulnerable to an encryption issue that stems from the use of a weaker-than-expected encryption algorithm, which could be exploited by an attacker to decrypt...

Zettlr input validation error vulnerability

Zettlr is the most comprehensive editor for professionally editing Markdown files. version 2.3.0 of Zettlr is vulnerable to an input validation error, which stems from the fact that the application has no CSP policy and does not properly validate content before rendering markdown files, which cou...

SAP 3D Visual Enterprise Author .catpart Buffer Overflow Vulnerability

SAP 3D Visual Enterprise Author is a desktop application for managing 2D, 3D, animation, video and audio assets from SAP. A buffer overflow vulnerability exists in SAP 3D Visual Enterprise Author version 9, which stems from a lack of proper memory management and can be exploited by an attacker to...

Multiple MediaTek chip ril denial-of-service vulnerabilities

MediaTek Inc. is the world's fourth largest fab semiconductor company and a market leader in mobile devices, smart home applications, wireless connectivity technologies and IoT products, with approximately 1.5 billion devices with MediaTek chips built into them available worldwide each year...

Zinc Delete Template Function Cross-Site Scripting Vulnerability

Zinc is a full-text indexing search engine open sourced by Zinc Labs. Zinc v0.1.9 and later, v0.3.1 and earlier versions have a cross-site scripting vulnerability that can be exploited by attackers to obtain sensitive information such as user credentials...

Food Ordering Management System SQL Injection Vulnerability

Food Ordering Management System is a food ordering management system from Carlo Montero's personal developer. The Food Ordering Management System is vulnerable to SQL injection, which stems from the lack of validation of external input SQL statements by username, and can be exploited by attackers...

Adobe InDesign Heap Buffer Overflow Vulnerability (CNVD-2022-79412)

Adobe InDesign is a set of layout and editing applications from the American company Audobee Adobe. Adobe InDesign suffers from a heap buffer overflow vulnerability that can be exploited by an attacker to execute arbitrary code in the context of the current user...

XXL-JOB authorization issue vulnerability

XXL-JOB is a distributed task scheduling platform based on the java language from the Xu Xueli XXL-JOB community. all versions of XXL-JOB released after July 11, 2022 have an authorization issue vulnerability that stems from its insecure privilege control, which could be exploited by an attacker ...

Apache Jetspeed-2 Input Validation Error Vulnerability

Apache Jetspeed-2 is a very open and customizable portal platform from the Apache USA Foundation. Apache Jetspeed-2 suffers from an input validation error vulnerability that stems from Apache Jetspeed-2 failing to adequately filter untrusted user input by default, which can be exploited by an...

WordPress plugin Google Maps cross-site request forgery vulnerability

WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin Google Maps 1.2.1 and previous versions have a cross-site request forgery vulnerability, which can be exploited by attacke...

Google TensorFlow Input Validation Error Vulnerability (CNVD-2022-44174)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. An input validation error vulnerability exists in TensorFlow versions prior to 2.9.0, 2.8.1, 2.7.2, and 2.6.4, which stems from the fact that tf.rawops.SparseTensorToCSRSparseMatrix does not ful...

Apache Tomcat Request Obfuscation Vulnerability

Apache Tomcat is the United States Apache Apache Foundation of a lightweight Web application server. The program implements the Servlet and JavaServer Page JSP support. Apache Tomcat suffers from a request obfuscation vulnerability that stems from the fact that if a Web application sends a...

Foxit PDF Reader Annotation Remote Code Execution Vulnerability (CNVD-2023-07902)

Foxit PDF Reader is a PDF reader from Foxit China.A remote code execution vulnerability exists in Foxit PDF Reader Annotation, which can be exploited by attackers to execute code in the context of the current process...

Cambium Networks cnMaestro OS Command Injection Vulnerability (CNVD-2022-64237)

Cambium Networks cnMaestro is a cloud-based or native software platform from Cambium Networks for secure end-to-end network control. Cambium Networks cnMaestro suffers from an operating system command injection vulnerability. An attacker could exploit this vulnerability to upload specially crafte...

Simple Bus Ticket Booking System SQL Injection Vulnerability

Simple Bus Ticket Booking System, a bus ticket booking system, is vulnerable to a SQL injection vulnerability in version 1.0 of Simple Bus Ticket Booking System, which originates in the username and password parameters in /assets/partials/handleLogin.php. and password parameters in...

Bareos Access Control Error Vulnerability

Bareos is a suite of open source data backup storage and recovery software from Bareos, a German company. Bareos suffers from an access control error vulnerability that stems from the fact that the affected product will completely skip authorization checks when built and configured for PAM...

Google Android permission permission and access control issue vulnerability (CNVD-2022-47676)

Google Android is a Linux-based open-source operating system from the U.S. company Google. Google Android is vulnerable to permission and access control issues, which can be exploited by attackers to cause local privilege escalation...

Google Tensorflow has an unspecified vulnerability (CNVD-2022-09901)

Google TensorFlow is an end-to-end open source platform for machine learning from Google Google Inc. Google Tensorflow has a security vulnerability that could be exploited by an attacker to cause a denial of service in the TensorFlow process...

LibreCAD Denial Vulnerability

LibreCAD is an open source CAD Computer Aided Design application from the LibreCAD organization. A denial of service vulnerability in LibreCAD version 2.2.0, which originates from a null pointer dereference in the HATCH handling of libdxfrw, can be exploited by an attacker to crash the applicatio...

OnionShare has an unspecified vulnerability (CNVD-2022-06474)

OnionShare is an open source tool for securely and anonymously sharing files, hosting websites and chatting with friends using the Tor network. Used to securely and anonymously share files, host websites, and chat with friends using the Tor network, OnionShare has a security vulnerability that...

Apache Kylin permission permission and access control issues vulnerability

Apache Kylin is an open source distributed analytic data warehouse from the Apache Foundation. The product mainly provides SQL query interface and multidimensional analysis OLAP on top of Hadoop/Spark. Apache Kylin is vulnerable to permission and access control issues, which stem from the fact th...

Fortinet FortiNAC Elevation of Privilege Vulnerability

Fortinet FortiNAC is a network access control solution from Fortinet, a US-based company. Fortinet FortiNAC has an elevation of privilege vulnerability that can be exploited to elevate privileges to root via the sudo command...

Grafana Information Disclosure Vulnerability (CNVD-2021-101998)

Grafana is a set of open source monitoring tools from Grafana Labs that provides a visual monitoring interface. The tool is primarily used to monitor and analyze Graphite, InfluxDB, and Prometheus, etc. An information disclosure vulnerability exists in Grafana Agent versions 0.20.1 and earlier an...

BusyBox Denial of Service Vulnerability

A security vulnerability exists in Busybox, a suite of applications containing several linux commands and tools developed by Denis Vlasenko, a Ukrainian developer. An attacker could cause a denial of service through this vulnerability...

MediaWiki Denial of Service Vulnerability (CNVD-2022-05528)

MediaWiki is a free and free-to-use web-based wiki engine from the US-based Wikimedia MediaWiki Foundation. The product can be used to deploy internal knowledge management and content management systems.MediaWiki has a denial of service vulnerability in versions prior to 1.36.2, which stems from...

HMI3 Control Panel Trust Management Issue Vulnerability

Swisslog Healthcare Nexus Panel is a medical device from Swisslog Healthcare.A security vulnerability exists in the HMI3 Control Panel, which stems from an insecure privilege issue in the HMI3 Control Panel of the Swisslog Healthcare Nexus. No details of the vulnerability are currently available...

Ypsomed mylife App has an unspecified vulnerability

Ypsomed mylife App is an application of Ypsomed AG. To optimize communication between people with diabetes and healthcare professionals, mylife Therapy Management is an easy-to-use, easy-to-share solution for diabetes therapy data. mylife App by Ypsomed suffers from a security vulnerability that...

Google TensorFlow RaggedCross Denial of Service Vulnerability

Google TensorFlow is an end-to-end open source machine learning platform. A security vulnerability exists in Google TensorFlow RaggedCross. An attacker can exploit the vulnerability by passing invalid tensor values to tf.rawops.RaggedCross to cause a heap out-of-bounds read...

Grav Code Injection Vulnerability

Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms and one-page product presentations. Grav suffers from a code injection vulnerability that can be exploited by an attacker to perform arbitrary code execution and elevate privileges on an...

Unspecified vulnerability in npm jose

npm jose is an application from the U.S. company npm. Use native encryption runtime does not depend on the item JWA, JWS, JWE, JWT, JWK. A security vulnerability exists in npm jose that stems from a possible timing difference when a padding error occurs while decrypting a ciphertext. No detailed...

Portier SQL Injection Vulnerability

Portier is an access rights management application. A SQL injection vulnerability exists in Portier versions 4.4.4.2 and 4.4.4.6, which stems from the program failing to validate user input and can be exploited by remote attackers to execute SQL commands and steal encrypted passwords from super...

yaml-cpp denial of service vulnerability (CNVD-2019-01859)

yaml-cpp aka LibYaml-C++ is a C++ parser for use in YAML. A security vulnerability exists in the YAML::SingleDocParser of the singledocparser.cpp file in yaml-cpp version 0.6.2. A remote attacker can exploit this vulnerability to cause a denial of service with the help of the cpp file...

Nagios Core null pointer dereference vulnerability (CNVD-2018-17097)

Nagios Core is an open source system and network monitoring application. A null pointer dereference vulnerability exists in qhhelp in Nagios Core 4.4.1 and earlier. An attacker can exploit this vulnerability by sending a specially crafted payload to a listening UNIX socket to cause a denial of...

iBall Baton ADSL2+ Authentication Bypass Vulnerability

The iBall Baton ADSL2+ Home Router is a router from iBall India. An authentication bypass vulnerability exists in the iBall Baton ADSL2+ Home Router version FWiB-LR7011A1.0.2. An attacker can exploit the vulnerability by logging into the admin panel with the help of building URLs with .cgi...

libgit2 Remote Code Execution Vulnerability

libgit2 is a portable, C implementation of the Git core development kit . A remote code execution vulnerability exists in libgit versions 20.25 and 0.24. An attacker could exploit this vulnerability to execute arbitrary code or cause the affected application to crash denial of service...

LibVNCServer Heap Buffer Overflow Vulnerability

LibVNCServer is cross-platform C library. A heap buffer overflow vulnerability exists in versions of LibVNCServer prior to 0.9.11 that can be exploited by an attacker to execute arbitrary code within the context of an application. Failure to exploit could result in a denial of service condition...