mruby code issue vulnerability (CNVD-2022-13378)

mruby is a lightweight implementation of the Ruby language. Homebrew mruby is vulnerable to code issues, and no detailed vulnerability details are available at this time...

Google TensorFlow numeric error vulnerability (CNVD-2022-14993)

TensorFlow is an end-to-end open source platform for machine learning from Google. Google TensorFlow is vulnerable to a numerical error that results from the fact that the cost estimator of certain convolution operations can be used to perform an operation divided by zero, and the function fails ...

karma cross-site scripting vulnerability

Karma is a simple tool. Allows JavaScript code to be executed in multiple real browsers. karma has a cross-site scripting vulnerability that stems from the DOM in NPM karma. no details of the vulnerability are currently available...

LibreCAD Denial Vulnerability

LibreCAD is an open source CAD Computer Aided Design application from the LibreCAD organization. A denial of service vulnerability in LibreCAD version 2.2.0, which originates from a null pointer dereference in the HATCH handling of libdxfrw, can be exploited by an attacker to crash the applicatio...

JerryScript ecma-helpers.c denial of service vulnerability

JerryScript, a lightweight JavaScript engine from the JerryScript project, has a denial-of-service vulnerability in version 3.0.0, which stems from a failed assertion in /jerry-core/ecma/base/ecma-helpers.c. An attacker could exploit this vulnerability to launch a denial of service...

Oracle Access Manager is vulnerable to input validation errors

Oracle Access Manager, an Oracle company, provides innovative new services to complement traditional access management functionality.Oracle Access Manager is vulnerable due to an input validation error in the OpenSSO Agent component. An attacker could exploit this vulnerability to execute arbitra...

Zoho ManageEngine Desktop Central MSP Licensing Issue Vulnerability

ZOHO ManageEngine Desktop Central MSP is a suite of desktop and mobile device management software for MSPs managed service providers from ZOHO. The software enables MSPs to remotely manage desktops, servers, and mobile devices in their customer networks and provides differentiated management...

Oracle Database Server has an unspecified vulnerability (CNVD-2021-84599)

Oracle Database Server is a relational database management system from Oracle Corporation USA. An unspecified vulnerability exists in the Oracle Database Enterprise Edition Unified Audit component of Oracle Database Server versions 12.1.0.2, 12.2.0.1, and 19c. An attacker could use this...

Spotweb Cross-Site Scripting Vulnerability

Spotweb is a Php-based Soptnet client that follows the Spotnet protocol from the Spotweb team.A cross-site scripting vulnerability exists in Spotweb 1.5.1 and below, which can be exploited by remote attackers to inject arbitrary Web scripts or HTML via the newpassword2 parameter...

Google TensorFlow Denial of Service Vulnerability (CNVD-2021-63073)

Google TensorFlow is an end-to-end open source machine learning platform. A security error vulnerability exists in Google TensorFlow versions prior to 2.6.0. A local attacker could exploit this vulnerability to cause a denial of service...

Advantech R-SeeNet File Inclusion Vulnerability

Advantech R-SeeNet is an industrial monitoring software from Advantech, Taiwan, China. The software is based on the snmp protocol for monitoring platforms and is available for Linux and Windows platforms.Advantech R-SeeNet suffers from a file inclusion vulnerability, which stems from the failure ...

Advanced SystemCare Ultimate Elevation of Privilege Vulnerability (CNVD-2021-57453)

Advanced SystemCare Ultimate, a Windows optimization suite from Iobit that analyzes system performance bottlenecks, is vulnerable to an elevation of privilege vulnerability in Advanced SystemCare Ultimate version 14.2.0.220. A local attacker can exploit this vulnerability by sending a malicious I...

Accela Civic Platform Information Disclosure Vulnerability

Accela Civic Platform is a cloud-based solution for Accela's application software to modernize city systems for land management and code enforcement, increased citizen engagement and mobile information access. information disclosure vulnerabilities exist in versions of Accela Civic Platform prior...

Synology DiskStation Manager Path Traversal Vulnerability

Synology DiskStation Manager DSM is an operating system for use on Network Storage Servers NAS from Synology Inc. of Taiwan, China. This operating system manages information such as data, files, photos, music, and more. A path traversal vulnerability exists in Synology DiskStation Manager version...

Unspecified Vulnerability in SOURCEFORGE Adminer

SOURCEFORGE Adminer is an application from the American SOURCEFORGE community. Provides database management in a single PHP file. A security vulnerability exists in Adminer versions 4.6.1 through 4.8.0, which stems from Adminer's use of the pdo extension to communicate with the database, and...

Unspecified Vulnerability in Rust (CNVD-2021-29837)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in telemetry crate for Rust 2021-02-17 and earlier versions, which stems from the loss of uninitialized memory if panics is called using misc::vecwithsize. No details of the...

ONLYOFFICE Document Server File Extension Handling Vulnerability

ONLYOFFICE Document Server is a free collaborative online office suite that includes viewers and editors for text, spreadsheets and presentations. ONLYOFFICE Document Server suffers from a file extension handling vulnerability that can be exploited by an attacker requesting data to control file...

Belkin LINKSYS WRT160NL Command Execution Vulnerability

The Belkin LINKSYS WRT160NL is a wireless router from Belkin USA. A security vulnerability exists in Belkin Linksys WRT160NL 1.0.04.002US20130619, which stems from a failure to properly filter special characters, commands, etc. within it. A remote authenticated attacker could execute system...

Zeroshell command injection vulnerability

Zeroshell is a small open source Linux distribution for servers and embedded systems designed to provide web services. a command injection vulnerability exists in the /cgi-bin/kerbynet StartSessionSubmit parameter in Zeroshell 3.9.3. An attacker could execute system commands via shell...

libproxy buffer overflow vulnerability (CNVD-2020-58045)

libproxy is a library for individual developers that provides automatic configuration of proxies. A buffer overflow vulnerability exists in libproxy version 0.4.15, which stems from the fact that urls .cpp is susceptible to buffer overflows, as evidenced by a large PAC file with no content length...

Wireshark BLIPP Parser Denial of Service Vulnerability

Wireshark is a suite of network packet analysis software from the Wireshark team. A security vulnerability in the Wireshark BLIP parser's processing of messages allows remote attackers to exploit the vulnerability to submit special requests that can crash applications...

Apache HTTP Server Input Validation Error Vulnerability

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. An input validation error vulnerability exists in Apache HTTP Server versions 2.4.0 through 2.4.41. The vulnerability arises from ...

Opencast Encryption Issues Vulnerabilities

Opencast is a free and open source video management solution that is scalable, customizable and low cost. An encryption issue vulnerability exists in Opencast versions prior to 8.1 and prior to 7.6. The vulnerability stems from a network system or product that does not properly use the relevant...

mongo-express code execution vulnerability

mongo-express is a lightweight web-based management interface for interactively managing MongoDB databases. A security vulnerability exists in mongo-express versions prior to 0.54.0. An attacker can exploit this vulnerability to execute code with the help of an endpoint using the toBSON method...

Total.js CMS Command Injection Vulnerability

Total.js CMS is a content management system CMS based on a NoSQL database. A command injection vulnerability in Total.js CMS version 12.0.0 can be exploited by an attacker to execute illegal commands...

zzzcms zzzphp dynamic code execution vulnerability

zzzcms zzzphp is a content management system CMS. A security vulnerability exists in version V1.6.1 of zzzcms zzzphp, which stems from a lax filtering of search template parsing on the search page. An attacker can exploit this vulnerability to execute PHP code...

WibuKey Network server management WkbProgramLow Heap Overflow Vulnerability

WIBU-KEY is a software protection and license management system.WibuKey Network server management is a network service program. A heap overflow vulnerability in the WibuKey Network server management WkbProgramLow function allows remote attackers to exploit the vulnerability by submitting a...

Apache HTTP Server Denial of Service Vulnerability

Apache HTTP Server is the United States Apache Apache Software Foundation, an open source web server. The server is fast, reliable and can be expanded through a simple API. A security vulnerability exists in the HTTP/2 modhttp2 connection for httpd in Apache HTTP Server versions 2.4.17 through...

yaml-cpp denial of service vulnerability (CNVD-2019-01859)

yaml-cpp aka LibYaml-C++ is a C++ parser for use in YAML. A security vulnerability exists in the YAML::SingleDocParser of the singledocparser.cpp file in yaml-cpp version 0.6.2. A remote attacker can exploit this vulnerability to cause a denial of service with the help of the cpp file...

SPIP Remote Code Execution Vulnerability

SPIP is a free Web-based content publishing system. The system is primarily used for online collaboration. A remote code execution vulnerability exists in SPIP 3.1.2 and prior versions. An attacker could exploit this vulnerability to execute arbitrary code at an affected site...

TOTOLINK X15 Buffer Overflow Vulnerability

TOTOLINK X15 is a network wireless extender manufactured by China's Gion Electronics TOTOLINK. The TOTOLINK X15 suffers from a buffer overflow vulnerability that originates from improper handling of the submit-url parameter in the /boafrm/formParentControl file in the HTTP POST request handling...

Tenda AC9 formAdvSetMacMtuWan function wanMTU parameter buffer overflow vulnerability

Tenda AC9 is a wireless router from Tenda, a Chinese company. The Tenda AC9 suffers from a buffer overflow vulnerability that originates from the wanMTU parameter of the formAdvSetMacMtuWan function failing to properly validate the length of the input data, which can be exploited by an attacker t...

Mozilla Firefox and Thunderbird Information Disclosure Vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the U.S. Mozilla Thunderbird is a set of e-mail client software separate from the Mozilla Application Suite. Mozilla Firefox and Thunderbird have an information disclosure vulnerability that is caused by a CSP violation...

File Upload Vulnerability Exists in SysAid On-Premise

SysAid On-Premise is an IT Service Management ITSM and IT Asset Management ITAM solution designed to provide organizations with comprehensive, integrated IT management services. A file upload vulnerability exists in SysAid On-Premise that can be exploited by an attacker to gain server privileges...

Arbitrary File Read Vulnerability in DPtech SSL VPN of Hangzhou Dipu Technology Co.

Ltd. is a high-tech enterprise integrating R&D, production and sales in the field of network, security and application delivery. Ltd. DPtech SSL VPN suffers from an arbitrary file read vulnerability, which can be exploited by attackers to obtain sensitive information...

Milesight UR32L vtysh_ubus toolsh_excute.constprop.1 Functional Command Injection Vulnerability (CNVD-2023-65490)

The Milesight UR32L is a 4G industrial router from China's Milesight. The Milesight UR32L vtyshubus toolshexcute.constprop.1 feature suffers from a command injection vulnerability that can be exploited by an attacker to execute arbitrary commands on the system...

Apache Airflow JDBC Provider Code Execution Vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. A code execution vulnerability exists in Apache Airflow JDBC Provider, which can be exploited by an attacker to execute arbitrary code on a system...

Online Computer and Laptop Store Arbitrary File Upload Vulnerability

Online Computer and Laptop Store is an online computer and laptop store from Carlo Montero's personal developer. Online Computer and Laptop Store v1.0 is vulnerable to arbitrary file uploads. The vulnerability stems from a lack of validation of uploaded files in the...

Microsoft PostScript and PCL6 Class Printer Driver Elevation of Privilege Vulnerability

Microsoft PostScript Printer Driver is a Microsoft standard printer driver for PostScript printers from Microsoft USA. Microsoft PCL6 Class Printer Driver is a printer driver software from Microsoft Corporation. Microsoft PostScript and PCL6 Class Printer Driver contains an elevation of privilege...

IBM Observability with Instana Access Control Error Vulnerability

IBM Observability with Instana is a powerful application performance monitoring solution from International Business Machines IBM that enables faster performance tracking and incident resolution.IBM Observability with Instana suffers from an access control error vulnerability that stems from the...

Apache Dubbo code issue vulnerability (CNVD-2023-25935)

Apache Dubbo is the United States Apache Apache Foundation of a lightweight Java-based RPC Remote Procedure Call framework. The product provides interface-based remote calling , fault tolerance and load balancing and automatic service registration and discovery. A code issue vulnerability exists ...

Apache Kylin Command Injection Vulnerability

Apache Kylin is an open source distributed analytic data warehouse from the Apache Foundation. The product mainly provides Hadoop/Spark on top of the SQL query interface and multidimensional analysis OLAP and other functions. kylin has a command injection vulnerability, the vulnerability stems fr...

Google TensorFlow Input Validation Error Vulnerability (CNVD-2023-15776)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. An input validation error vulnerability exists in Google TensorFlow, which stems from an empty input to SparseFillEmptyRowsGrad. The vulnerability can be exploited to cause the program to crash...

Nextcloud has an unspecified vulnerability (CNVD-2022-77502)

A security vulnerability exists in Nextcloud Desktop Client, an open source self-hosted file synchronization and sharing communication application platform from Nextcloud Germany, which stems from the fact that its desktop client could be tricked into opening/executing local files when clicking o...

Unspecified Vulnerability in FFmpeg (CNVD-2022-78137)

FFmpeg is a complete solution for recording, converting and streaming audio and video from the FFmpeg team. A security vulnerability exists in FFmpeg, which originates from an unknown function in the file ibavcodec/rpzaenc.c of the QuickTime RPZA Video Encoder component, which can be exploited by...

OTFCC Heap Buffer Overflow Vulnerability (CNVD-2023-10590)

OTFCC is Caryll open source a C library and utility programs. Used to parse and write OpenType font files. OTFCC suffers from a heap buffer overflow vulnerability that originates from a boundary error in /release-x64/otfccdump+0x4adb11 when handling untrusted input. An attacker could exploit the...

Django denial of service vulnerability

Django is the Django Foundation's set of open source web application framework based on the Python language. The framework includes an object-oriented mapper, view system, template system, etc. A denial-of-service vulnerability exists in Django, which stems from improper handling of certain...

Nasm buffer overflow vulnerability (CNVD-2022-69151)

Nasm is an open source programming tool software. A buffer overflow vulnerability exists in Nasm v2.16, which stems from the inclusion of a stack overflow in the Ndisasm component. No detailed vulnerability details are provided at this time...

Bytebase licensing issue vulnerability

Bytebase is Bytebase's open source web-based, zero-configuration, dependency-free database schema change and version control management tool for DevOps teams. projects", which can be exploited by an attacker to view "projects" created by "Admin"...

Caryll OTFCC otfccdump+0x4fe954 denial of service vulnerability

Caryll OTFCC is Caryll open source a C library and utility programs. Used to parse and write OpenType font files. A denial of service vulnerability exists in Caryll OTFCC, which originates from a segmentation conflict at /release-x64/otfccdump+0x4fe954. An attacker can exploit the vulnerability t...