Spotweb Cross-Site Scripting Vulnerability (CNVD-2021-83616)

Spotweb is a Php-based Soptnet client that follows the Spotnet protocol from the Spotweb team. 1.5.1 and previous versions of Spotweb have a cross-site scripting vulnerability that can be exploited by attackers to execute JavaScript code on the client side...

LibreNMS Cross-Site Scripting Vulnerability (CNVD-2021-93896)

LibreNMS is a PHP/MYSQL/SNMP-based open source monitoring tool. a stored cross-site scripting vulnerability exists in API access pages in versions of LibreNMS prior to 21.3.0. The vulnerability stems from insufficient validation of the $api-description variable. An attacker could use this...

Google TensorFlow 'tf.raw_ops.NonMaxSuppressionV5' Denial of Service Vulnerability Vulnerability

Google TensorFlow is an end-to-end open source machine learning platform. A security vulnerability exists in tf.rawops.NonMaxSuppressionV5 in Google TensorFlow versions prior to 2.6.0. An attacker could exploit the vulnerability to cause a denial of service...

Linux kernel denial-of-service vulnerability (CNVD-2021-60517)

Linux kernel is the kernel used by the Linux Foundation's open source operating system, Linux. Linux kernel is vulnerable due to an out-of-bounds access to xdrsetpagebase in net/sunrpc/xdr.c. By executing many NFS 4.2 READPLUS operations, a remote attacker could exploit this vulnerability to atta...

Linux kernel denial-of-service vulnerability (CNVD-2021-60518)

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. Linux kernel is vulnerable due to a deadlock flaw in btrfs when there is not enough free space in system spaceinfo. A local attacker can exploit this vulnerability to cause a denial of service situation...

Ffmpeg out-of-bounds read/write vulnerability

FFmpeg is a complete solution for recording, converting, and streaming audio and video from the FFmpeg team. ffmpeg has an out-of-bounds read/write vulnerability in version 4.4 summary, which originates from FFmpeg's libavcodec dnxhddec.c not checking the return value of the init vlc function,...

Wireshark Input Validation Error Vulnerability (CNVD-2022-11206)

Wireshark formerly known as Ethereal is a suite of network packet analysis software from the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis. Wireshark suffers from an input validation error vulnerability that stems from...

WordPress College publisher Import plugin file upload vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.College publisher Import is a plugin for WordPress. A file upload vulnerability exists in WordPress College publisher...

Rust Resource Management Error Vulnerability (CNVD-2021-17263)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in scratchpad crate before 1.3.1 for Rust, which stems from the move elements function being able to use double free. no details of the vulnerability are currently available...

ONLYOFFICE Document Server File Extension Handling Vulnerability (CNVD-2021-17248)

ONLYOFFICE Document Server is a free collaborative online office suite that includes viewers and editors for text, spreadsheets and presentations. A file extension handling vulnerability exists in the ONLYOFFICE DocumentServer core module, which can be exploited by an attacker to remotely execute...

Tiki Authentication Bypass Vulnerability

Tiki is a suite of open source content management and portal applications from the Tiki community that can be used to create web applications, portals, corporate intranets, extranets, and more. An authentication bypass vulnerability exists in versions prior to Tiki 21.2, which stems from Tiki...

jQuery cross-site scripting vulnerability (CNVD-2021-28270)

jQuery is the United States John Resig programmer of a set of open source , cross-browser JavaScript library . The library simplifies the operation between HTML and JavaScript , and has a modular , plug-in extensions and other features . A cross-site scripting vulnerability exists in versions of...

Multiple Red Hat Products Security Feature Issue Vulnerabilities

Red Hat Ceph Storage and Red Hat OpenShift are both products of Red Hat, Inc. Red Hat Ceph Storage is a scalable, open software-defined storage platform.Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform that supports building, testing, deploying, and running applications....

IBM Spectrum Protect Plus Command Injection Vulnerability

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A command injection vulnerability exists in...

Sylius Environment Issues Vulnerabilities

Sylius is a set of Symfony framework based on open source e-commerce platform . An environmental issue vulnerability exists in Sylius. The vulnerability stems from an unreasonable environmental factor in a networked system or product. No detailed vulnerability details are provided at this time...

Artifex Software MuJS Buffer Overflow Vulnerability (CNVD-2016-10581)

Artifex Software MuJS is a lightweight JavaScript interpreter from Artifex Software, USA. Artifex Software MuJS 5000749f5afe3b956fc916e407309de840997f4a A buffer overflow vulnerability exists in the Spreplaceregexp function in previous versions, which can be exploited by an attacker to execute co...

vBulletin forumrunner/includes/moderation.php SQL Injection Vulnerability

VBulletin is a powerful, flexible and fully customizable suite of forum programs. A SQL injection vulnerability exists in the forumrunner/includes/moderation.php file in versions of vBulletin prior to 4.2.2 Patch Level 5 and prior to 4.2.3 Patch Level 1. A remote attacker can exploit this...

Schneider Electric SpaceLogic AS-P/AS-B Log Message Disclosure Vulnerability

The Schneider Electric SpaceLogic AS-P is an automation server from Schneider Electric France. The Schneider Electric SpaceLogic AS-P/AS-B suffers from a log message disclosure vulnerability that can be exploited by an attacker to cause SNMP credentials to be exposed...

File Upload Vulnerability Exists in SysAid On-Premise

SysAid On-Premise is an IT Service Management ITSM and IT Asset Management ITAM solution designed to provide organizations with comprehensive, integrated IT management services. A file upload vulnerability exists in SysAid On-Premise that can be exploited by an attacker to gain server privileges...

Mozilla Firefox Memory Misreference Vulnerability (CNVD-2023-75343)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. The Mozilla Firefox memory misreference vulnerability can be exploited by a remote attacker to submit a special Web request that induces the user to parse it, which can crash the application...

Apache Superset REST API Authorization Issues Vulnerability

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset version 2.1.0 and prior versions suffer from an authorization issue vulnerability that stems from incorrect REST API permissions. An attacker can exploit this vulnerability to cau...

MongoDB Information Disclosure Vulnerability (CNVD-2023-68220)

MongoDB is a document-oriented database management system of the U.S. MongoDB company. An information disclosure vulnerability exists in MongoDB that stems from the possibility of incorrectly posting events containing authentication-related data to an application-configured command listener, whic...

Siemens Tecnomatix Plant Simulation Out-of-Bounds Write Vulnerability (CNVD-2023-85374)

Siemens Tecnomatix Plant Simulation is an industrial control device from Siemens, Germany. The power of discrete-event simulation is used to analyze and optimize throughput and thus improve manufacturing system performance. Siemens Tecnomatix Plant Simulation suffers from an out-of-bounds write...

Unspecified Vulnerability in Oracle MySQL Server (CNVD-2023-65501)

Oracle MySQL Server is a relational database from Oracle Corporation. A security vulnerability exists in Oracle MySQL Server version 8.0.33 and prior versions, which can be exploited by attackers to cause MySQL Server to hang or crash frequently and repeatedly...

PHPOK SQL Injection Vulnerability (CNVD-2023-64116)

PHPOK is an enterprise building system that supports expansion. PHPOK v.5.4 suffers from a SQL injection vulnerability that originates from allowing remote attackers to obtain sensitive information via the userlist function in the framerwork/phpokcall.php file. No detailed vulnerability details a...

Linux kernel resource management error vulnerability (CNVD-2023-51381)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux Kernel that originates from a confusion in the instructions responsible for freeing memory in driver/firewire in the...

Google Android Input Validation Error Vulnerability (CNVD-2023-43881)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an input validation error vulnerability that originates in the PowerVRSRVBridgePhysmemImportSparseDmaBuf component of the PowerVR kernel driver component where the lack of size checking means tha...

MediaWiki authorization error vulnerability (CNVD-2023-29701)

MediaWiki is a free and free-to-use web-based wiki engine from the MediaWiki Foundation, which can be used to deploy in-house knowledge management and content management systems. An authorization error vulnerability exists in the MediaWiki GrowthExperiments extension, which could be exploited by ...

Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability (CNVD-2023-35225)

Microsoft PostScript Printer Driver is a Microsoft standard printer driver for PostScript printers from Microsoft.Microsoft PCL6 Class Printer Driver is a printer driver from Microsoft. Microsoft PCL6 Class Printer Driver is a printer driver software from Microsoft. A remote code execution...

Adobe InCopy post-release use vulnerability

Adobe InCopy is a text editing software for authoring from Adobe. Adobe InCopy has a use-after-release vulnerability that can be exploited by attackers to bypass mitigations such as ASLR and cause sensitive memory leaks...

Mozilla Firefox Buffer Overflow Vulnerability (CNVD-2023-03062)

Mozilla Firefox is an open source web browser from the Mozilla Foundation. Mozilla Firefox suffers from a buffer overflow vulnerability that stems from an uninitialized pointer being freed in lginit. A remote attacker could exploit this vulnerability to execute arbitrary code...

Apache Kylin Command Injection Vulnerability

Apache Kylin is an open source distributed analytic data warehouse from the Apache Foundation. The product mainly provides Hadoop/Spark on top of the SQL query interface and multidimensional analysis OLAP and other functions. kylin has a command injection vulnerability, the vulnerability stems fr...

Google Android Denial of Service Vulnerability (CNVD-2022-89771)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from a denial of service vulnerability that can be exploited by attackers to cause a denial of service...

FFmpeg has unspecified vulnerabilities (CNVD-2022-77504)

FFmpeg, the FFmpeg team's complete solution for recording, converting, and streaming audio and video, suffers from a security vulnerability stemming from an unknown function in the file ibavcodec/rpzaenc.c of the QuickTime RPZA Video Encoder component, which could be exploited by an attacker to...

Zettlr input validation error vulnerability

Zettlr is the most comprehensive editor for professionally editing Markdown files. version 2.3.0 of Zettlr is vulnerable to an input validation error, which stems from the fact that the application has no CSP policy and does not properly validate content before rendering markdown files, which cou...

Apache Commons JXPath Buffer Overflow Vulnerability (CNVD-2022-73689)

Apache Commons JXPath is a Java-based implementation of XPath 1.0 from the Apache Foundation, U.S.A. A buffer overflow vulnerability exists in Apache Commons JXPath, which is caused by a stack buffer overflow when parsing XPath. A remote attacker could exploit this vulnerability to cause a denial...

Food Ordering Management System SQL Injection Vulnerability

Food Ordering Management System is a food ordering management system from Carlo Montero's personal developer. The Food Ordering Management System is vulnerable to SQL injection, which stems from the lack of validation of external input SQL statements by username, and can be exploited by attackers...

Apache Pulsar Trust Management Issue Vulnerability

Apache Pulsar is an Apache Foundation distributed messaging platform for cloud environments that integrates messaging, storage, and lightweight functional computing. The software supports multi-tenancy, persistent storage, multi-room cross-regional data replication, with strong consistency, high...

ZZCMS sendmailto.php SQL Injection Vulnerability

ZZCMS is a content management system CMS by the ZZCMS team in China. A SQL injection vulnerability exists in ZZCMS version 2022, which originates from /admin/sendmailto.php?tomail=&groupid= lack of validation of externally entered SQL statements. An attacker can exploit the vulnerability to execu...

Rdiffweb Title Denial of Service Vulnerability

Rdiffweb is a web application by Patrik Dufresne, an individual developer in the USA. Provides quick access to your archives through an efficient web interface. A denial of service vulnerability exists in Rdiffweb versions prior to 2.4.8, which stems from the "title" parameter when adding an SSH...

ISC BIND Denial of Service Vulnerability (CNVD-2024-16843)

ISC BIND is the United States ISC company's set of open source software that implements the DNS protocol. ISC BIND suffers from a denial-of-service vulnerability that stems from a flaw in the resolver code that could cause naming to take an inordinate amount of time to process large delegates,...

Apache Geode Remote Code Execution Vulnerability (CNVD-2022-83595)

A remote code execution vulnerability exists in Apache Geode, the Apache Foundation's management platform for providing real-time and consistent access to data for data-intensive applications in distributed cloud architectures, which stems from a vulnerability to untrusted data deserialization wh...

Oracle MySQL Input Validation Error Vulnerability (CNVD-2022-88288)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. An input validation error vulnerability exists in Oracle MySQL, which can be exploited by an attacker to cause certain unauthorized update, insert, o...

TCL LinkHub Mesh Wi-Fi OS Command Injection Vulnerability

TCL LinkHub Mesh Wi-Fi is a router from TCL Corporation.TCL LinkHub Mesh Wi-Fi is vulnerable to an operating system command injection vulnerability that originates in the confsrv ucloudaddnode function and can be exploited by attackers to cause arbitrary command execution...

Fastjson code execution vulnerability

Fastjson is a Java-based fast JSON parser/generator. versions prior to Fastjson 1.2.83 have a security vulnerability that stems from the ease of bypassing the default autoType off restriction to deserialize untrusted data, which is exploited by attackers to cause code execution...

Swftools out-of-bounds write vulnerability (CNVD-2022-62213)

Swftools is a set of utilities for working with Adobe Flash files SWF files. An out-of-bounds write vulnerability exists in Swftools 2020-12-22 and prior versions, which stems from a heap buffer overflow in function swfFontExtractDefineTextCallback located in swftext.c. The vulnerability is cause...

Dolibarr Cross-Site Scripting Vulnerability (CNVD-2022-71638)

Dolibarr is an ERP/CRM system with plug-and-play modules and a well-established ecosystem with customizations and service providers worldwide. version 12.0.5 of Dolibarr suffers from a cross-site scripting vulnerability that can be exploited by attackers to cause cross-site scripting XSS attacks...

Microsoft Windows Push Notifications Elevation of Privilege Vulnerability

Microsoft Windows Push Notifications is a push notification service from Microsoft Corporation USA. It provides a reliable way to deliver new updates.Microsoft Windows Push Notifications suffers from an elevation of privilege vulnerability. The vulnerability stems from improper handling of...

Microsoft SharePoint Server Spoofing Vulnerability (CNVD-2022-59593)

Microsoft SharePoint is a suite of enterprise business collaboration platforms from Microsoft Corporation USA. Microsoft SharePoint Server is vulnerable to spoofing and no details of the vulnerability are currently available...

Fortinet FortiClient for Windows权限提升漏洞

Fortinet FortiClient is a mobile endpoint security solution from Fortinet, Inc. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance, and two-factor authentication when connected to a FortiGate firewall appliance. executable file in the FortiClient installer...