MongoDB Information Disclosure Vulnerability (CNVD-2023-68220)

MongoDB is a document-oriented database management system of the U.S. MongoDB company. An information disclosure vulnerability exists in MongoDB that stems from the possibility of incorrectly posting events containing authentication-related data to an application-configured command listener, whic...

Siemens Tecnomatix Plant Simulation Out-of-Bounds Write Vulnerability (CNVD-2023-85374)

Siemens Tecnomatix Plant Simulation is an industrial control device from Siemens, Germany. The power of discrete-event simulation is used to analyze and optimize throughput and thus improve manufacturing system performance. Siemens Tecnomatix Plant Simulation suffers from an out-of-bounds write...

Apache NiFi Remote Code Execution Vulnerability

Apache NiFi is an open source tool for building reliable and secure data pipelines. It supports collecting, aggregating and transferring data from a variety of sources and provides powerful data processing and transformation capabilities. A remote code execution vulnerability exists in Apache NiF...

Siemens Solid Edge, JT2Go and Teamcenter Free After Use Vulnerability

JT2Go is a 3D JT viewing tool that allows users to view JT, PDF, Solid Edge, PLM XML with available JT, VFZ, CGM, and TIF data.Solid Edge is a portfolio of software tools that address a variety of product development processes: 3D design, simulation, manufacturing, and design management.Teamcente...

PHPOK Code Problem Vulnerability

PHPOK is an enterprise building system that supports expansion. PHPOK 5.7.140 version of the code problem vulnerability, the vulnerability stems from the existence of a file upload vulnerability, a remote attacker can use this vulnerability through the upload of the produced zip file to run...

Linksys E2000 Command Injection Vulnerability

The Linksys E2000 is a wireless router from Linksys USA. The Linksys E2000 1.0.06 firmware version suffers from a command injection vulnerability that stems from the fact that if an attacker gains web administrative privileges, he/she can inject commands into the post request parameters wlssid,...

Siemens Tecnomatix Plant Simulation Out-of-Bounds Write Vulnerability (CNVD-2023-18936)

Siemens Tecnomatix Plant Simulation is an industrial control device from Siemens, Germany. Using the function of discrete event simulation for production volume analysis and optimization, and thus improve the manufacturing system performance. An out-of-bounds write vulnerability exists in Siemens...

Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability (CNVD-2023-28107)

Microsoft PostScript Printer Driver is a Microsoft standard printer driver for PostScript printers from Microsoft USA. Microsoft PCL6 Class Printer Driver is a printer driver software from Microsoft Corporation. Microsoft PostScript and PCL6 Class Printer Driver contains an information disclosure...

Google Android elevation of privilege vulnerability (CNVD-2023-26070)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that originates from a privilege bypass in resolveAttributionSource of ServiceUtilities.cpp, which can be exploited by an attacker to gain elevated...

Apache Superset Cross-Site Scripting Vulnerability (CNVD-2023-05219)

A cross-site scripting vulnerability exists in Apache Superset, a data visualization and data exploration platform from the Apache Foundation. The vulnerability stems from a failure of the upload data form to properly render user input, which could be exploited by an attacker to cause a cross-sit...

Google Android Denial of Service Vulnerability (CNVD-2022-89771)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from a denial of service vulnerability that can be exploited by attackers to cause a denial of service...

Super Xray Code Issue Vulnerability

Super Xray is an excellent vulnerability scanning tool by 4ra1n individual developers. A code issue exists in versions of Super Xray prior to 0.7, which stems from a program configuration that confirms that trusted inputs will be stored in a yaml file, which can be exploited by an attacker with...

SilverStripe Cross-Site Scripting Vulnerability

SilverStripe is New Zealand SilverStripe company's set of open source programming framework and content management system CMS. The system has support for multiple languages , cross-platform and other features . A cross-site scripting vulnerability exists in SilverStripe 4.11 and earlier versions...

Google TensorFlow MirrorPadGrad buffer overflow vulnerability

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A buffer overflow vulnerability exists in Google TensorFlow, which originates from the "MirrorPadGrad" input "paddings" is too large, an attacker can use this vulnerability to cause a heap memory...

SAP 3D Visual Enterprise Author .sat Buffer Overflow Vulnerability

SAP 3D Visual Enterprise Author is a desktop application for managing 2D, 3D, animation, video and audio assets from SAP. A buffer overflow vulnerability exists in SAP 3D Visual Enterprise Author version 9, which stems from a lack of proper memory management and can be exploited by an attacker to...

Multiple Siemens products open to redirection vulnerabilities

Siemens Desigo PX is a building automation control system from Siemens Germany. Several Siemens products have an open redirection vulnerability, which stems from the fact that the device's embedded browser does not prevent interaction with an alternate URI scheme when the Web application code...

Apache Commons JXPath Buffer Overflow Vulnerability (CNVD-2022-73689)

Apache Commons JXPath is a Java-based implementation of XPath 1.0 from the Apache Foundation, U.S.A. A buffer overflow vulnerability exists in Apache Commons JXPath, which is caused by a stack buffer overflow when parsing XPath. A remote attacker could exploit this vulnerability to cause a denial...

Bento4 AP4_BitReader::ReadBits Buffer Overflow Vulnerability

Bento4 is an open source C++ library for reading and writing MP4 files. A buffer overflow vulnerability exists in Bento4 version v1.6.0-639, which stems from a heap overflow in the AP4BitReader::ReadBits function of the mp4mux component. An attacker could exploit the vulnerability to affect the...

Bytebase Access Control Error Vulnerability

Bytebase is an open source web-based, zero-configuration, dependency-free database schema change and version control management tool for DevOps teams.Bytebase versions 0.1.0 through 1.0.4 are vulnerable to an access control error that stems from unrestricted low privilege user access, which can b...

Adobe Experience Manager Cross-Site Scripting Vulnerability (CNVD-2022-87164)

Adobe Experience Manager AEM is a content management solution from Adobe that can be used to build websites, mobile applications and forms. Adobe Experience Manager contains a cross-site scripting vulnerability that could be exploited by attackers to execute malicious JavaScript content in the...

Apache Flume input validation error vulnerability

Apache Flume is a distributed, reliable and available service from the Apache Foundation, USA. Used to efficiently collect, aggregate, and move large amounts of log data, versions of Apache Flume prior to 1.4.0 through 1.10.0 contain a security vulnerability that stems from vulnerability to remot...

Google Android Information Disclosure Vulnerability (CNVD-2022-61753)

Google Android is a Linux-based open-source operating system from the U.S. company Google Google. Google Android has an information leakage vulnerability that could be exploited by attackers to obtain sensitive information...

Huawei WS7200-10 Access Control Error Vulnerability

The Huawei ws7200-10 is a wireless router from the Chinese company Huawei HUAWEI. Huawei WS7200-10 11.0.2.13 suffers from an access control error vulnerability, which stems from a problem with user password authentication, and can be exploited by an attacker on a local area network LAN to obtain ...

LDAP Account Manager Parameter Injection Vulnerability

LDAP Account Manager is a web front-end for managing entries e.g., users, groups, DHCP settings stored in the LDAP directory. LDAP Account Manager LAM versions prior to 8.0 are vulnerable to parameter injection, which stems from the fact that LAM instantiates objects from arbitrary classes and ca...

Elasticsearch Denial of Service Vulnerability

Elasticsearch is a search engine based on the Lucene library. A denial of service vulnerability exists in Elasticsearch versions 8.0.0 included through 8.2.1 not included. An unauthenticated attacker could exploit the vulnerability to forcefully shut down an Elasticsearch node via a network reque...

Dominion Voting Systems ImageCast X has an unspecified vulnerability (CNVD-2022-77546)

Dominion Voting Systems ImageCast X is an intuitive and configurable face-to-face voting solution from Dominion Voting Systems, Inc. A security vulnerability exists in Dominion Voting Systems ImageCast X that could be exploited by an attacker to obtain sensitive information and perform privileged...

WordPress Birthdays Widget plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Birthdays Widget plugin version 1.7.18 and earlier is vulnerable to a cross-site scripting...

Oracle E-Business Suite Access Control Error Vulnerability

Oracle Corporation Oracle is the world's largest provider of information management software and services, founded in 1977, headquartered in Redwood shore, California, United States, open to the world oracle certification. Oracle E-Business Suite E-Business Suite is the United States Oracle Oracl...

Directus Cross-Site Scripting Vulnerability (CNVD-2022-81371)

Directus is a live Api and application dashboard. Used to manage Sql database content, a cross-site scripting vulnerability existed prior to Directus version 9.7.0, which stems from the program's lack of data validation filtering of user-supplied data and output. An attacker could exploit this...

Linux kernel memory corruption vulnerability (CNVD-2022-55071)

Linux kernel is the kernel used by the Linux Foundation's open-source operating system Linux. Linux kernel is vulnerable to a memory corruption vulnerability that originates in drivers/hid/hid-elo.c in the Linux kernel, which is a memory leak for a certain hidparse error condition and can be...

Maccms Cross-Site Scripting Vulnerability (CNVD-2022-30794)

Maccms is a PHP-based film and television content management system CMS. v10 version of Maccms contains a cross-site scripting vulnerability, which originates from the lack of user-supplied data and output data validation filtering in the select and input parameters in...

Linux kernel denial of service vulnerability (CNVD-2022-79428)

Linux kernel is the kernel used by the Linux Foundation's open-source operating system Linux.KVM is one of the kernel-based virtual machines. A denial of service vulnerability exists in Linux kernel, which stems from a lack of code cleanup when the deviceadd call fails when adding a partition to...

showdoc .aspx file upload vulnerability

showdoc is an open source tool ideal for IT teams to share documents online. showdoc versions prior to v2.10.4 contain a file upload vulnerability, which stems from the lack of valid detection of .aspx file extensions in the application's file upload feature. An attacker could exploit this...

WordPress NotificationX Plugin SQL Injection Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in WordPress NotificationX Plugin versions prior to 2.3.9. The...

Liferay Portal and Liferay DXP Cross-Site Scripting Vulnerability (CNVD-2022-19496)

Liferay Portal and Liferay DXP are both products of Liferay, a J2EE-based portal solution that uses EJB and JMS technologies and serves as a web publishing and shared workspace, enterprise collaboration platform, social network, etc. Liferay DXP is a digital experience collaboration platform...

TOTOLink A830R Command Injection Vulnerability

TOTOLink A830R is a wireless dual-band router from TotoLink, China.TOTOLink A830R V5.9c.4729B20191112 is vulnerable to command injection, which can be exploited by attackers to execute arbitrary commands via the QUERYSTRING parameter...

Unspecified vulnerability exists in mruby (CNVD-2022-12747)

mruby is a lightweight implementation of the Ruby language. mruby 3.2 previously had a security vulnerability that stemmed from the use of out-of-range pointer offsets. No detailed vulnerability details are currently available...

Jenkins dbCharts Plugin Cross-Site Request Forgery Vulnerability

Jenkins plug-ins are plug-ins that provide appropriate functionality for Jenkins. Jenkins dbCharts Plugin cross-site request forgery vulnerability. The vulnerability allows an attacker to connect to a specified database via JDBC using specified credentials and determine whether a class is availab...

microweber cross-site request forgery vulnerability (CNVD-2022-12800)

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A cross-site request forgery vulnerability exists in microweber because the product does...

Oracle MySQL Cluster Input Validation Error Vulnerability (CNVD-2022-07926)

Oracle MySQL Cluster is a write-scalable, real-time, ACID-compatible transactional database developed by Oracle Corporation USA. Oracle MySQL Cluster is vulnerable to an input validation error, which can be exploited by attackers to corrupt or delete data...

Oracle GraalVM Input Validation Error Vulnerability (CNVD-2022-15477)

Oracle GraalVM is a set of on-the-fly compilers written in the Java language from Oracle Corporation USA.GraalVM Enterprise Edition is the enterprise version of GraalVM.An input validation error vulnerability exists in Oracle GraalVM due to an Oracle GraalVM Enterprise Edition has incorrect input...

Apache Kylin Input Validation Error Vulnerability

Apache Kylin is an open source distributed analytic data warehouse from the Apache Foundation. The product mainly provides SQL query interface on top of Hadoop/Spark and multi-dimensional analysis OLAP and other functions. Apache kylin has an input validation error vulnerability, which stems from...

Mozilla Rust has an unspecified vulnerability (CNVD-2022-03130)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. version 0.6.0 before Rust simpleasn1 crate 0.6.1 contains a security vulnerability that can be triggered if a remote attacker exploits the vulnerability to provide UTCTime data with a second character larger tha...

GNU patch denial of service vulnerability

GNU patch is a set of tools used by the GNU community to generate patch files. GNU patch has a denial of service vulnerability in version 2.7, which stems from the existence of an invalid pointer to the Otherhunk function, which can be exploited to cause a denial of service...

Mattermost Input Validation Error Vulnerability (CNVD-2022-08350)

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost 6.0 and earlier versions, which can be exploited by an authenticated attacker to cause a WEB application client to crash via a maliciously crafted post...

Zephyr has an unspecified vulnerability (CNVD-2021-95617)

Zephyr is an open source, small, scalable, real-time operating system. a security vulnerability exists in Zephyr, which stems from the ZephyrJSON decoder incorrectly decoding arrays. No details of the vulnerability are currently available...

Commvault CommCell Arbitrary File Upload Vulnerability

Commvault CommCell enables fast, large-scale backup and recovery of virtual machines, structured and unstructured data.An arbitrary file upload vulnerability exists in the AppStudioUploadHandler class in versions of Commvault CommCell prior to 11.25, which stems from a lack of proper validation o...

Beijing Tongda Zhicheng Technology Co., Ltd. Heart Tongda OA has file upload vulnerability (CNVD-2021-86805)

Xin Tongda OA is an OA office tool equipped with AI artificial intelligence. Beijing Tongda Zhicheng Technology Co. Xin Tongda OA has a file upload vulnerability, which can be exploited by attackers to gain control of the server...

Oracle MySQL Cluster Input Validation Error Vulnerability (CNVD-2022-17697)

Oracle MySQL Cluster is a write-scalable, real-time, ACID-compatible transactional database developed by Oracle Corporation USA. Oracle MySQL Cluster 8.0.26 and earlier versions of the Cluster: General component are vulnerable to an input validation error that could be exploited by an attacker to...

Cobbler Remote Code Execution Vulnerability

Cobbler is a network installation server suite that is primarily used to quickly build Linux network installation environments. remote code execution vulnerability exists in versions of Cobbler prior to 3.3.0, which stems from the failure of a network system or product to properly filter special...