Microsoft Windows Print Spooler Elevation of Privilege Vulnerability (CNVD-2022-84605)

Microsoft Windows is an operating system for personal devices, Microsoft Windows Server is a server operating system, and Windows Print Spooler is one of the print spoolers. An elevation of privilege vulnerability exists in Microsoft Windows Print Spooler due to a flaw in the print spooler...

Microsoft Windows Win32k Elevation of Privilege Vulnerability (CNVD-2022-62516)

Microsoft Windows Win32k is a system file for Windows multi-user management from Microsoft Corporation USA. Microsoft Windows Win32k has an elevation of privilege vulnerability that could be exploited by attackers to execute arbitrary code with elevated privileges...

Microsoft Windows Network File System Remote Code Execution Vulnerability (CNVD-2022-74601)

Microsoft Windows Network File System is a file sharing solution from Microsoft that allows you to transfer files between computers running Windows Server and UNIX operating systems using the NFS protocol. Network File System is vulnerable to a remote code execution vulnerability caused by a flaw...

ZoneMinder Cross-Site Scripting Vulnerability (CNVD-2022-57841)

ZoneMinder is an open source video surveillance software system. ZoneMinder 1.32.3 and earlier versions have a cross-site scripting vulnerability that stems from the fact that the program is not properly filtered and can be exploited by remote attackers to execute arbitrary HTML or JavaScript cod...

Jenkins Pipeline Phoenix AutoTest Plugin XML External Entity Injection Vulnerability

Jenkins Pipeline is a set of plug-ins that support the implementation and integration of continuous delivery pipelines into Jenkins.The Jenkins Pipeline Phoenix AutoTest Plugin 1.3 and earlier versions are vulnerable to XML external entity injection, which can be exploited by remote attackers to...

Joomla! path traversal vulnerability (CNVD-2022-64100)

A path traversal vulnerability exists in Joomla! versions 3.0.0 through 3.10.6 and 4.0.0 through 4.1.0, which stems from a failure of a web system or product to properly filter special elements in a resource or file path, and can be exploited by remote attackers to send specially crafted .zip...

Veeam Backup&Replication Access Control Error Vulnerability

Veeam Backup & Replication is a suite of data protection software from the Swiss company Veeam. The software provides backup, replication and recovery for VMware and Hyper-V VMs, physical and cloud environments. Veeam Backup&Replication is vulnerable to an Access Control Error vulnerability, no...

Cobbler Licensing Issue Vulnerability (CNVD-2022-20579)

Cobbler is a network installation server suite that is primarily used to quickly set up Linux network installation environments.An authorization issue vulnerability exists in versions of Cobbler prior to 3.3.2, which stems from the presence of incorrect authorization in the application. An attack...

FreeTAKServer Access Control Error Vulnerability

FreeTAKServer is an open source lightweight server from the FreeTAKTeam team. It is used to connect to TAK clients. FreeTAKServer suffers from an access control error vulnerability, which stems from the fact that Endpoint/ManageRoute/postRoute can be accessed without authentication, and can be...

Google Android permission permission and access control issue vulnerability (CNVD-2022-47676)

Google Android is a Linux-based open-source operating system from the U.S. company Google. Google Android is vulnerable to permission and access control issues, which can be exploited by attackers to cause local privilege escalation...

MyBB Remote Code Execution Vulnerability (CNVD-2022-20097)

MyBB is a free and web-based forum software developed by MyBB team using PHP and MySQL. The software is characterized by its simplicity, multi-language support and extensibility. A remote code execution vulnerability exists in MyBB, which can be exploited to cause a Remote Code Execution RCE...

Weblate Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability exists in Weblate, a Copyleft web-based free software continuous localization system, which stems from the failure of versions prior to 4.11 to properly neutralize user input used in the username and language fields. As a result of this improper neutralization...

WordPress WP Statistics plugin SQL注入漏洞（CNVD-2022-46466）

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WordPress plugin is a WordPress open source application plugin. WordPress WP Statistics plugin 13.1.5 and earlier versions are vulnerable to SQL injection, which can be exploited by attackers to...

Oracle MySQL Cluster Input Validation Error Vulnerability (CNVD-2022-17688)

Oracle MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database developed by Oracle Corporation. Oracle MySQL Cluster is vulnerable to an input validation error, which can be exploited by attackers to execute arbitrary code...

LibreCAD Denial Vulnerability

LibreCAD is an open source CAD Computer Aided Design application from the LibreCAD organization. A denial of service vulnerability in LibreCAD version 2.2.0, which originates from a null pointer dereference in the HATCH handling of libdxfrw, can be exploited by an attacker to crash the applicatio...

Google Chrome Media streams API buffer overflow vulnerability

Google Chrome is a web browser from Google, Inc. A buffer overflow vulnerability exists in the Google Chrome Media streams API, which can be exploited by remote attackers to overflow the buffer and execute arbitrary code on the system, or cause the application to crash...

Apache James Command Injection Vulnerability

Apache James is an open source Smtp and Pop3 mail transfer agent and Nntp news server written entirely in Java by the Apache Foundation. Apache James 3.6.1 is vulnerable to a command injection vulnerability that could be exploited by attackers to perform a man-in-the-middle command injection...

WordPress WP Visitor Statistics SQL Injection Vulnerability

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.The WordPress WP Visitor Statistics plugin has a SQL injection vulnerability in versions prior to 4.8. The...

Binaryen Denial of Service Vulnerability (CNVD-2022-06889)

Binaryen is a compiler and toolchain infrastructure library for WebAssembly, written in C. A denial of service vulnerability exists in Binaryen 103, which stems from an assertion failure in wasm::handleunreachable and can be exploited by an attacker to cause a denial of service...

BusyBox Denial of Service Vulnerability

A security vulnerability exists in Busybox, a suite of applications containing several linux commands and tools developed by Denis Vlasenko, a Ukrainian developer. An attacker could cause a denial of service through this vulnerability...

Google TensorFlow numeric error vulnerability (CNVD-2021-88715)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A numeric error vulnerability exists in versions of Google TensorFlow prior to 2.7.0, which stems from the fact that AllToAll in TensorFlow performs division by zero when inferring code. No details of t...

Sourcecodester Engineers Online Portal Cross-Site Scripting Vulnerability

Sourcecodester Engineers Online Portal is an open source online portal. sourcecodester Engineers Online Portal in PHP is vulnerable to a cross-site scripting vulnerability. An attacker can exploit the vulnerability to run javascript commands via the addquiz.php quiz title and quiz description...

Oracle MySQL Cluster Input Validation Error Vulnerability (CNVD-2021-89939)

MySQL Cluster is a write-scalable, real-time, ACID-compatible transactional database designed to guarantee 99.999% availability. A security vulnerability exists in the Cluster: General component of MySQL Cluster 7.4.33, 7.5.23, 7.6.19, 8.0.26 and earlier versions. An attacker could exploit this...

Vulnerability of the Siemens LOGO! CMR family and SIMATIC RTU 3000 family security feature issues

The LOGO! CMR family is a communication system for monitoring and controlling distributed devices and systems via text messages or e-mail.Siemens SIMATIC RTU3000C is a compact RTU from Siemens, Germany is a low-power remote terminal unit RTU for energy self-sufficiency. A vulnerability in the...

Delta Electronics DIAScreen Buffer Overflow Vulnerability

A buffer overflow vulnerability exists in Delta Electronics DIAScreen, a smartphone builder from Delta Electronics, Taiwan, China, which stems from the vulnerability of DIAScreen to out-of-bounds write conditions. An attacker could exploit the vulnerability to cause a system crash or remote...

WordPress WooCommerce Blocks SQL plugin injection vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers.WooCommerce Blocks plugin is a WordPress open source application plugin.WooCommerce Blocks feature plugin version...

Advantech R-SeeNet telnet_form.php Cross-Site Scripting Vulnerability

Advantech R-SeeNet is an industrial monitoring software from Advantech Taiwan, China. The software is based on the snmp protocol for monitoring platforms and is available for Linux and Windows platforms.Advantech R-SeeNet telnetform.php in v2.4.12 contains a cross-site scripting vulnerability tha...

Advanced SystemCare Ultimate Elevation of Privilege Vulnerability (CNVD-2021-57452)

Advanced SystemCare Ultimate, a Windows optimization suite from Iobit that analyzes system performance bottlenecks, is vulnerable to an elevation of privilege vulnerability in Advanced SystemCare Ultimate version 14.2.0.220. A local attacker can exploit this vulnerability by sending a malicious I...

Google TensorFlow Numeric Error Vulnerability

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow 2.4.2, 2.3.3, 2.2.3, 2.1.4 suffers from a number error vulnerability that can be exploited by an attacker to trigger undefined behavior via a null pointer bound to...

Cisco NX-OS Denial of Service Vulnerability (CNVD-2021-12829)

Cisco NX-OS is the network operating system for the Cisco Nexus family of Ethernet switches and the MDS family of Fibre Channel storage area network switches. A denial of service vulnerability exists in the Protocol Independent Multicast PIM feature of the Cisco NX-OS, which can be exploited by a...

Nagios XI Remote Code Execution Vulnerability

Nagios XI is a commercial monitoring solution built on Nagios Core, including dashboards, web-based configuration, advanced reporting and rich data visualization. A remote code execution vulnerability exists in the "Manage Plugins" page in Nagios XI versions prior to 5.8.0. The vulnerability stem...

Projectworlds Online Book Store Project In Php SQL Injection Vulnerability

Projectworlds Online Book Store Project In Php is a Php-based online bookstore system from the Austrian company Projectworlds. Projectworlds Online Book Store Project In Php 1.0 is vulnerable to SQL injection. An attacker could exploit this vulnerability to dump the entire database on which the w...

MikroTik RouterOS Integer Underflow Vulnerability

MikroTik RouterOS is a Linux-based router operating system developed by the Latvian company MikroTik. The system can be deployed in a PC to enable it to provide router functionality. An integer underflow vulnerability exists in the SMB server in versions of MikroTik RouterOS prior to 6.45.5, whic...

Unnamed Vulnerability in IOBit Unlocker

IOBit Unlocker is a file cleaning tool. A security vulnerability exists in the driver in IOBit Unlocker version 1.1.2. An attacker can exploit the vulnerability to unlock files and shut down a process even if the process is running with SYSTEM privileges...

Red Hat Ceph Object Gateway Cross-Site Scripting Vulnerability

Red Hat Ceph is a Linux petabyte-level distributed file system from Red Hat. The main goal of the system is to be designed as a distributed file system based on POSIX Portable Operating System Interface without a single point of failure, so that data can be fault-tolerant and seamless replication...

mongo-express code execution vulnerability

mongo-express is a lightweight web-based management interface for interactively managing MongoDB databases. A security vulnerability exists in mongo-express versions prior to 0.54.0. An attacker can exploit this vulnerability to execute code with the help of an endpoint using the toBSON method...

Total.js CMS Command Injection Vulnerability

Total.js CMS is a content management system CMS based on a NoSQL database. A command injection vulnerability in Total.js CMS version 12.0.0 can be exploited by an attacker to execute illegal commands...

AdPlug Buffer Overflow Vulnerability (CNVD-2019-32341)

AdPlug is an AdLib sound player library written in C++. A buffer overflow vulnerability exists in the 'Ca2mLoader::load' function of the a2m.cpp file in AdPlug version 2.3.1. The vulnerability stems from a networked system or product performing operations in memory without properly validating dat...

Advantech WebAccess/SCADA Arbitrary Code Execution Vulnerability

Advantech WebAccess/SCADA is a set of SCADA software based on browser architecture from Advantech, Taiwan, China. The software supports dynamic graphical display and real-time data control, and provides remote control and management of automation equipment. An arbitrary code execution vulnerabili...

Pivotal Software Spring Cloud Config Path Traversal Vulnerability

Pivotal Software Spring Cloud Config is a configuration management solution for distributed systems from Pivotal Software. The product mainly provides server and client support for external configuration in distributed systems. A path traversal vulnerability exists in Pivotal Software Spring Clou...

Portier SQL Injection Vulnerability

Portier is an access rights management application. A SQL injection vulnerability exists in Portier versions 4.4.4.2 and 4.4.4.6, which stems from the program failing to validate user input and can be exploited by remote attackers to execute SQL commands and steal encrypted passwords from super...

yaml-cpp denial of service vulnerability (CNVD-2019-01859)

yaml-cpp aka LibYaml-C++ is a C++ parser for use in YAML. A security vulnerability exists in the YAML::SingleDocParser of the singledocparser.cpp file in yaml-cpp version 0.6.2. A remote attacker can exploit this vulnerability to cause a denial of service with the help of the cpp file...

Apache Struts2 Remote Code Execution Vulnerability (CNVD-2016-02506 )

Apache Struts is an open source framework for creating enterprise Java Web applications. A remote code execution vulnerability exists in Struts2, which can be exploited by an attacker to execute arbitrary code on the server side of a server that initiates a dynamic method call...

librsync Limit Bypass Vulnerability

librsync is a free software library developed by software developer Martin Pool that implements the rsync remote-delta algorithm which enables fast and instantaneous updating of remote files over a network. A security restriction bypass vulnerability exists in versions of librsync prior to 1.0.0...

OpenClaw Information Disclosure Vulnerability (CNVD-2026-13370)

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from an information disclosure vulnerability. The vulnerability stems from the fact that skills.status may return raw parsed configuration values for the skills.config path via configChecks, which can be...

Samba OS Command Injection Vulnerability

Samba is Samba open source a standard Windows interoperability program suite for Linux and Unix. Samba suffers from an operating system command injection vulnerability that stems from a lack of proper validation or escaping of NetBIOS names in front-end WINS hook processing, which could lead to...

WordPress Inset plugin file inclusion vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A file inclusion vulnerability exists in the WordPress Inset plugin that stems from not doing effective filtering of local file resource calls, which can be exploited by an...

Apache Lucene Deserialization Vulnerability

Apache Lucene is the United States Apache Apache Foundation, a free open source search engine software library. Apache Lucene suffers from a deserialization vulnerability that arises from unsafe deserialization of serialized data received by an application from a user, which can be exploited by a...

F5 NGINX Plus and NGINX Open Source Denial of Service Vulnerabilities

NGINX is an HTTP and reverse proxy server, email proxy server and general purpose TCP/UDP proxy server. A denial of service vulnerability exists in F5 NGINX Plus and NGINX Open Source, which can be exploited by an unauthenticated, remote attacker to cause a denial of service...

Adobe RoboHelp Server Path Traversal Vulnerability

Adobe RoboHelp Server is a server-based application for FrameMaker and RoboHelp enterprise users. A path traversal vulnerability exists in Adobe RoboHelp Server, which can be exploited by an attacker to execute arbitrary code on the system by sending a specially crafted URL request that contains...