BusyBox Denial of Service Vulnerability

A security vulnerability exists in Busybox, a suite of applications containing several linux commands and tools developed by Denis Vlasenko, a Ukrainian developer. An attacker could cause a denial of service through this vulnerability...

Sourcecodester Engineers Online Portal Cross-Site Scripting Vulnerability

Sourcecodester Engineers Online Portal is an open source online portal. sourcecodester Engineers Online Portal in PHP is vulnerable to a cross-site scripting vulnerability. An attacker can exploit the vulnerability to run javascript commands via the addquiz.php quiz title and quiz description...

Oracle MySQL Cluster Input Validation Error Vulnerability (CNVD-2021-89939)

MySQL Cluster is a write-scalable, real-time, ACID-compatible transactional database designed to guarantee 99.999% availability. A security vulnerability exists in the Cluster: General component of MySQL Cluster 7.4.33, 7.5.23, 7.6.19, 8.0.26 and earlier versions. An attacker could exploit this...

Mozilla Rust Buffer Overflow Vulnerability (CNVD-2021-85297)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. Mozilla Rust is vulnerable to a buffer overflow vulnerability that can be exploited by attackers to cause a buffer overflow or heap overflow, among other things...

Vulnerability of the Siemens LOGO! CMR family and SIMATIC RTU 3000 family security feature issues

The LOGO! CMR family is a communication system for monitoring and controlling distributed devices and systems via text messages or e-mail.Siemens SIMATIC RTU3000C is a compact RTU from Siemens, Germany is a low-power remote terminal unit RTU for energy self-sufficiency. A vulnerability in the...

Siemens IFC adapter in NX use after release vulnerability

NX software is an integrated toolset that helps develop design, simulation and manufacturing solutions by supporting all aspects of product development. A use-after-release vulnerability exists in Siemens IFC adapter in NX, which can be exploited by an attacker to execute code in the context of t...

Mezzanine Cross-Site Scripting Vulnerability (CNVD-2021-67501)

Github Mezzanine, a content management platform, is vulnerable to a cross-site scripting vulnerability that originates from a cross-site scripting XSS vulnerability in Mezzanine v4.3.1. The vulnerability can be exploited to execute arbitrary code via the "Description" field of...

Tcpreplay Buffer Overflow Vulnerability (CNVD-2021-93920)

Tcpreplay is a set of GPLv3 licensed utilities for UNIX operating systems to edit and replay network traffic captured by tools such as tcpdump and Ethereal/Wireshark. The dochecksum function in checksum.c in Tcpreplay version 4.3.2 is vulnerable to a buffer overflow vulnerability. An attacker can...

Google TensorFlow buffer overflow vulnerability (CNVD-2021-64529)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A security vulnerability exists in Google TensorFlow that could be exploited to cause TensorFlow to terminate abnormally...

Google TensorFlow 'tf.raw_ops.NonMaxSuppressionV5' Denial of Service Vulnerability Vulnerability

Google TensorFlow is an end-to-end open source machine learning platform. A security vulnerability exists in tf.rawops.NonMaxSuppressionV5 in Google TensorFlow versions prior to 2.6.0. An attacker could exploit the vulnerability to cause a denial of service...

D-LINK DIR-3040 Information Disclosure Vulnerability (CNVD-2021-53338)

The D-LINK DIR-3040 is a router from D-Link, a Taiwan-based company that provides connectivity to the Internet.The D-LINK DIR-3040 is vulnerable to an information disclosure vulnerability that could be exploited by an attacker to send HTTP requests resulting in the disclosure of sensitive...

QEMU Denial of Service Vulnerability (CNVD-2021-39039)

QEMU Quick Emulator is a set of simulation processor software by Fabrice Bellard, a French individual developer. The software is fast and cross-platform. A security vulnerability exists in QEMU. The vulnerability stems from a memory leak in vhost-user-gpu/vhost-user-gpu.c. The vulnerability is...

Subrion CMS Cross-Site Scripting Vulnerability (CNVD-2021-27920)

Subrion CMS is a PHP-based content management system CMS from the Subrion team. The system can be integrated into a website and supports a variety of extensions plugins and more. A cross-site scripting vulnerability exists in Subrion CMS 4.2.1 and earlier versions. The vulnerability can be...

Linux kernel post-release reuse vulnerability (CNVD-2021-24270)

The Linux kernel is a computer operating system kernel written in C and assembly language, compliant with the POSIX standard, and distributed under the GNU General Public License. A post-release reuse vulnerability exists in drivers/vhost/vdpa.c in Linux kernel versions prior to 5.11.9. The...

Projectworlds Online Book Store Project In Php SQL Injection Vulnerability

Projectworlds Online Book Store Project In Php is a Php-based online bookstore system from the Austrian company Projectworlds. Projectworlds Online Book Store Project In Php 1.0 is vulnerable to SQL injection. An attacker could exploit this vulnerability to dump the entire database on which the w...

Apache Airflow Encryption Problem Vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A security vulnerability exists in Apache Airflow versions prior to 1.10.13, which...

Tiki Authentication Bypass Vulnerability

Tiki is a suite of open source content management and portal applications from the Tiki community that can be used to create web applications, portals, corporate intranets, extranets, and more. An authentication bypass vulnerability exists in versions prior to Tiki 21.2, which stems from Tiki...

MikroTik RouterOS Integer Underflow Vulnerability

MikroTik RouterOS is a Linux-based router operating system developed by the Latvian company MikroTik. The system can be deployed in a PC to enable it to provide router functionality. An integer underflow vulnerability exists in the SMB server in versions of MikroTik RouterOS prior to 6.45.5, whic...

OpenSSH Input Validation Error Vulnerability

OpenSSH OpenBSD Secure Shell is a set of connection tools from the OpenBSD Project Group for secure access to remote computers. The tools are an open source implementation of the SSH protocol and support encryption of all transmissions, effectively blocking eavesdropping, connection hijacking, an...

OpenStack Keystone Code Issue Vulnerability

OpenStack is a cloud platform management program developed by the National Aeronautics and Space Administration NASA in collaboration with Rackspace in the U.S. OpenStack Keystone is a module used in OpenStack to manage the authentication, service rules, and service token functions. A security...

IBM Spectrum Protect Plus Command Injection Vulnerability

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A command injection vulnerability exists in...

Sylius Environment Issues Vulnerabilities

Sylius is a set of Symfony framework based on open source e-commerce platform . An environmental issue vulnerability exists in Sylius. The vulnerability stems from an unreasonable environmental factor in a networked system or product. No detailed vulnerability details are provided at this time...

Pivotal Software Spring Framework Cross-Site Request Forgery Vulnerability

Pivotal Software Spring Framework is the U.S. Pivotal Software's set of open source Java, JavaEE application framework. The framework helps developers build high-quality applications . A cross-site request forgery vulnerability exists in Pivotal Software Spring Framework versions 5.2.x prior to...

Pivotal Software Spring Cloud Config Path Traversal Vulnerability

Pivotal Software Spring Cloud Config is a configuration management solution for distributed systems from Pivotal Software. The product mainly provides server and client support for external configuration in distributed systems. A path traversal vulnerability exists in Pivotal Software Spring Clou...

vBulletin forumrunner/includes/moderation.php SQL Injection Vulnerability

VBulletin is a powerful, flexible and fully customizable suite of forum programs. A SQL injection vulnerability exists in the forumrunner/includes/moderation.php file in versions of vBulletin prior to 4.2.2 Patch Level 5 and prior to 4.2.3 Patch Level 1. A remote attacker can exploit this...

Apache Zeppelin Cross-Site Scripting Vulnerability (CNVD-2024-17939)

Apache Zeppelin is a Web-based open source laptop application from the Apache USA Foundation. The program supports interactive data analysis and collaborative documentation. Apache Zeppelin suffers from a cross-site scripting vulnerability that stems from improper coding or escaping, which can be...

Google Chrome WebRTC Module Memory Misreference Vulnerability

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in the Google Chrome WebRTC module, which stems from a confusion in the instructions responsible for freeing memory in the WebRTC module. An attacker can exploit this vulnerability to execu...

Google Chrome Security Bypass Vulnerability (CNVD-2024-10263)

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome version 121.0.6167.85 and earlier versions, which stems from an improperly executed Autofill module. An attacker could exploit this vulnerability to bypass security restriction...

Mozilla Firefox Memory Misreference Vulnerability (CNVD-2023-75343)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. The Mozilla Firefox memory misreference vulnerability can be exploited by a remote attacker to submit a special Web request that induces the user to parse it, which can crash the application...

SAP PowerDesigner Code Injection Vulnerability (CNVD-2024-23328)

SAP PowerDesigner is a database design software from SAP Germany. A code injection vulnerability exists in SAP PowerDesigner version 16.7 that originates from allowing an unauthenticated attacker to inject VBScript code into a document. An attacker could exploit this vulnerability to cause...

Siemens Tecnomatix Plant Simulation Out-of-Bounds Write Vulnerability (CNVD-2023-85374)

Siemens Tecnomatix Plant Simulation is an industrial control device from Siemens, Germany. The power of discrete-event simulation is used to analyze and optimize throughput and thus improve manufacturing system performance. Siemens Tecnomatix Plant Simulation suffers from an out-of-bounds write...

Schneider Electric GP-Pro EX is a set of HMI interface editing and logic programming software from Schneider Electric (France). A buffer overflow vulnerability exists in Schneider Electric Pro-face GP-Pro EX. The vulnerability stems from improper manipulation of restrictions within memory buffer ranges and can be exploited by an attacker to cause memory corruption.

The NETGEAR R7100LG is a router from the American company NETGEAR. A hardware device that connects two or more networks and acts as a gateway between networks. The NETGEAR R7100LG version 1.0.0.78 suffers from a command injection vulnerability that stems from the password parameter in...

Apache Sling Input Validation Error Vulnerability

Apache Sling is the United States Apache Apache Foundation of a Java platform for open source Web framework. Designed to comply with JSR-170 content repository such as Apache Jackrabbit to create content-centric applications. An input validation error vulnerability exists in Apache Sling Commons...

Google Chrome V8 Type Obfuscation Vulnerability (CNVD-2023-28127)

Chrome is a free and fast Internet browser software developed by Google, Inc. with the goal of making Google Chrome is based on the more powerful JavaScript V8 Google Chrome is based on the more powerful JavaScript V8 engine, which improves the browser's processing speed. It supports multi-tab...

Siemens Mendix Forgot Password Module Information Disclosure Vulnerability

Siemens Mendix is a low-code application development platform from Siemens. The platform provides application development, testing, deployment and iteration. An information disclosure vulnerability exists in the Siemens Mendix Forgot Password module. The vulnerability stems from the fact that the...

Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability (CNVD-2023-28109)

Microsoft PostScript Printer Driver is a Microsoft standard printer driver for PostScript printers from Microsoft USA. Microsoft PCL6 Class Printer Driver is a printer driver software from Microsoft Corporation. Microsoft PostScript and PCL6 Class Printer Driver contains a remote code execution...

Linux kernel denial-of-service vulnerability (CNVD-2023-05410)

Linux kernel, the kernel used by the Linux Foundation's open source operating system Linux, is vulnerable to a denial-of-service attack in versions of Linux kernel prior to 6.1.6. In affected versions of the Linux kernel, a NULL pointer dereference error in the flow control subsystem allows an...

FFmpeg Code Problem Vulnerability (CNVD-2024-31520)

FFmpeg is a complete solution for recording, converting and streaming audio and video from the FFmpeg team. FFmpeg has a code issue vulnerability that stems from the vp3decodeframe function in its libavcodec/vp3.c file that does not reasonably check the return result of the avmalloc function, whi...

Siemens Teamcenter Visualization and JT2Go Heap Buffer Overflow Vulnerability

Siemens Teamcenter Visualization is a software that provides team collaboration capabilities for designing 2D and 3D scenes. Siemens JT2GO is a JT file viewer. Siemens Teamcenter Visualization and JT2Go are vulnerable to a heap buffer overflow vulnerability that could be exploited by an attacker ...

WordPress Contact Form 7 Database Addon plugin CSV Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A CSV injection vulnerabili...

Siemens syngo Dynamics server-side request forgery vulnerability

Siemens syngo Dynamics is a cardiovascular imaging and information solution from Siemens, Germany. Designed to be a centralized digital hub for complete cardiovascular services, Siemens syngo Dynamics is vulnerable to server-side request forgery, which can be exploited by attackers to cause NTLM ...

Dolibarr ERP/CRM Access Control Error Vulnerability

Dolibarr ERP/CRM is a web-based enterprise resource planning ERP and customer relationship management CRM system from the French Dolibarr Foundation. The system can be used to manage products, inventory, invoices, orders, etc. An access control error vulnerability exists in Dolibarr ERP/CRM 15.0....

Apache Commons JXPath Buffer Overflow Vulnerability (CNVD-2022-73689)

Apache Commons JXPath is a Java-based implementation of XPath 1.0 from the Apache Foundation, U.S.A. A buffer overflow vulnerability exists in Apache Commons JXPath, which is caused by a stack buffer overflow when parsing XPath. A remote attacker could exploit this vulnerability to cause a denial...

Bento4 AP4_BitReader::ReadBits Buffer Overflow Vulnerability

Bento4 is an open source C++ library for reading and writing MP4 files. A buffer overflow vulnerability exists in Bento4 version v1.6.0-639, which stems from a heap overflow in the AP4BitReader::ReadBits function of the mp4mux component. An attacker could exploit the vulnerability to affect the...

Discourse input validation error vulnerability

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. versions of Discourse prior to 2.8.9, and prior to 2.9.0.beta10, contain an input validation error vulnerability that could be exploited by an attacker to add large text load...

NIC Knot Resolver Denial of Service Vulnerability

Knot Resolver is a cached DNS resolver implementation that includes a resolver library and daemon. A denial of service vulnerability exists in NIC Knot Resolver versions prior to 5.5.3. The vulnerability stems from not properly handling incoming error messages and can be exploited by a remote...

Rdiffweb Title Denial of Service Vulnerability

Rdiffweb is a web application by Patrik Dufresne, an individual developer in the USA. Provides quick access to your archives through an efficient web interface. A denial of service vulnerability exists in Rdiffweb versions prior to 2.4.8, which stems from the "title" parameter when adding an SSH...

Apache Geode Remote Code Execution Vulnerability (CNVD-2022-83595)

A remote code execution vulnerability exists in Apache Geode, the Apache Foundation's management platform for providing real-time and consistent access to data for data-intensive applications in distributed cloud architectures, which stems from a vulnerability to untrusted data deserialization wh...

Siemens SIMATIC WinCC OA Client Authentication Vulnerability

Siemens SIMATIC WinCC OA is a SCADA operating system from Siemens, Germany. It is used to control and monitor industrial applications. A security vulnerability exists in Siemens SIMATIC WinCC OA that stems from the application using only client-side authentication when both server-side...

Illumina Local Run Manager Access Control Error Vulnerability

Illumina Local Run Manager is an integrated solution from Illumina, Inc. Designed to create sequencing runs, monitor run status, analyze sequencing data, and view results, Illumina Local Run Manager is vulnerable to an access control error that could be exploited by remote attackers to gain...