Jerryscript has an unspecified vulnerability (CNVD-2022-07248)

JerryScript, a lightweight JavaScript engine from the JerryScript project, has a security vulnerability in Jerryscript version 3.0.0, which stems from a buffer overflow in /jerry-core/ecma/base/ecma-lcache.c in ecma lcachelookup in /jerry-core/ecma/base/ecma-lcache.c. A stack-based buffer overflo...

WordPress Crisp Live Chat plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Crisp Live Chat plugin, which stems from a...

nanoid information leakage vulnerability

nanoid is a small, secure, URL-friendly, unique string ID generator for JavaScript. nanoid is vulnerable, stemming from nanoid's vulnerability to information exposure via the valueOf function, which allows the last generated id to be reproduced. no details of the vulnerability are currently...

Netgear RAX43 Command Injection Vulnerability

Netgear RAX43 is a wireless router from Netgear, Inc. A command injection vulnerability exists in Netgear RAX43, which stems from the inclusion of a command injection vulnerability. The readycloud cgi application is vulnerable to command injection in the name parameter. No details of the...

Fortinet FortiWeb Buffer Overflow Vulnerability (CNVD-2021-101138)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. A buffer overflow vulnerability exists that...

Commvault CommCell Remote Code Execution Vulnerability

Commvault CommCell enables fast, large-scale backup and recovery of virtual machines, structured and unstructured data.A remote code execution vulnerability exists in the DemoExecuteProcessOnGroup workflow in versions of Commvault CommCell prior to 11.25, which could be exploited by an attacker t...

Open Design Alliance Drawings SDK Resource Management Error Vulnerability

Open Design Alliance Drawings SDK is a software development kit for drawing design applications from Open Design Alliance, Inc. The development package provides access to data in .dwg and .dgn through a convenient, object-oriented API that provides a C API, support for repair files, support for t...

Google Chrome iframe sandbox security bypass vulnerability

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome iframe sandbox that stems from improper policy enforcement in the product's iframe sandbox. An attacker can exploit the vulnerability to bypass security restrictions...

VMware vCenter Server Permissions Licensing and Access Control Issues Vulnerability

VMware vCenter Server is a suite of server and virtualization management software from Vmware, Inc. The software provides a centralized platform for managing VMware vSphere environments, automating the implementation and delivery of virtual infrastructures. vCenter Server is vulnerable to...

Google TensorFlow heap allocation array out-of-bounds read vulnerability (CNVD-2021-85884)

Google TensorFlow is an end-to-end open source machine learning platform. an out-of-bounds read vulnerability exists in the shape inference function of SparseCountSparseOutput in versions prior to TensorFlow 2.7.0 for heap allocation arrays. No detailed vulnerability details are currently availab...

Unspecified Vulnerability in Fortinet FortiPortal

Fortinet FortiPortal is an advanced, feature-rich hosted security analysis and management support tool for Fortinet's FortiGate, FortiWiFi and FortiAP product lines, available as a virtual machine for MSPs. A security vulnerability in the customer database interface of Fortinet FortiPortal prior ...

Wire has unspecified vulnerabilities (CNVD-2022-10740)

Wire is a chat software from a personal developer. The software supports Web, WindowsiOS, Android, and OS X platforms, has group functionality, the ability to make voice calls, send photos, and its ingenious way of saying hello, PING. Wire has a security vulnerability that allows users of Wire by...

SuiteCRM path traversal vulnerability

SuiteCRM, a customer relationship management system from the SuiteCRM Suitecrm team, has a security vulnerability that could allow an attacker to include arbitrary files via the importFile parameter portion of the RefreshMapping import function...

Mozilla Rust Command Injection Vulnerability (CNVD-2021-85293)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. Mozilla Rust is vulnerable to a command injection vulnerability that can be exploited by attackers to cause data contention and memory corruption due to data contention...

Siemens SINEMA Server Lack of Authentication Vulnerability

Siemens SINEMA Server is a software developed for industrial applications by Siemens, Germany. It enables you to fully visualize and monitor your network. Siemens SINEMA Server has a security vulnerability that could be exploited by an attacker to obtain encoded system configuration backup files...

Mozilla Firefox Privilege Permission and Access Control Issue Vulnerability (CNVD-2021-90098)

Mozilla Firefox is an open source Web browser from the Mozilla Foundation, U.S. A permission permission and access control issue vulnerability exists in Mozilla Firefox for Android, which stems from Firefox allowing navigation via the intent:// protocol. A remote attacker could exploit the...

XWiki Platform cross-site request forgery vulnerability

XWiki Platform is a generic wiki platform that provides runtime services for applications built on it. XWiki Platform is vulnerable to cross-site request forgery, which can be exploited by attackers to reset the password of any user in XWiki via a spoofed URL...

RabbitMQ Cross-Site Scripting Vulnerability (CNVD-2021-49048)

RabbitMQ is a multi-protocol message broker. A cross-site scripting vulnerability exists in RabbitMQ versions prior to RabbitMQ 3.8.18 for rabbitmq-server. The vulnerability stems from the program not properly filtering the tag. An attacker can exploit this vulnerability to execute JavaScript cod...

Siemens SCALANCE XM-400 and XR-500 Devices Denial of Service Vulnerability

SCALANCE X switches are used to connect industrial components such as programmable logic controllers PLCs or human machine interfaces HMIs. A denial of service vulnerability exists in the Siemens SCALANCE XM-400 and XR-500 Devices, which can be exploited by an attacker to create a permanent denia...

Tenda G1 and G3 OS Command Injection Vulnerability

Tenda G1 and G3 is a router from Tenda, China. Tenda G1 and G3 is vulnerable to OS command injection, which can be exploited to execute arbitrary OS commands via a crafted "action umountUSBPartition" request. operating system commands via a crafted "action umountUSBPartition" request...

Siemens Nucleus Product IPv6 Stack Denial of Service Vulnerability (CNVD-2021-28696)

The Nucleus NET module includes a range of standards-compliant networking and communications protocols, drivers and utilities to provide full-featured networking support in any embedded device.Nucleus RTOS provides a highly scalable microkernel-based real-time operating system designed for...

Microsoft Hyper-V RemoteFX vGPU Buffer Overflow Vulnerability (CNVD-2020-45323)

Microsoft Windows is a popular operating system. A buffer overflow vulnerability exists in Microsoft Hyper-V RemoteFX vGPU. An attacker can exploit this vulnerability by running a specially crafted application on a virtual machine operating system to execute arbitrary code on the host operating...

Tortoise ORM SQL Injection Vulnerability

Tortoise ORM is an open source object-relational mapper . A SQL injection vulnerability exists in MySQL in Tortoise ORM versions prior to 0.15.23 and prior to 0.16.6. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based applications. An attacker...

ThemeREX Addons Remote Code Execution Vulnerability

WordPress plugin ThemeREX Addons is a plugin that works with various ThemeREX themes, featuring several theme enhancements and widgets that extend the functionality of the theme in question. A remote code execution vulnerability exists in versions of ThemeREX Addons prior to 2020-03-09. The...

Rumpus FTP Web File Manager Cross-Site Scripting Vulnerability

Rumpus FTP Web File Manager is a file transfer server. A cross-site scripting vulnerability exists in the login page in Rumpus FTP Web File Manager version 8.2.9.1. The vulnerability stems from a lack of proper validation of client data by the web application. An attacker can exploit this...

Libntlm Buffer Overflow Vulnerability

Libntlm is an NTLM NT LAN Manager authentication library. A buffer overflow vulnerability exists in Libntlm 1.5 and earlier versions, which can be exploited by an attacker to cause a buffer overflow or heap overflow, among other things...

AjentiCP Cross-Site Scripting Vulnerability

AjentiCP is a hosting management panel. A cross-site scripting vulnerability exists in AjentiCP 1.2.23.13 and earlier versions. A remote attacker can exploit this vulnerability to execute malicious JavaScript code in a user's browser...

XiongMai uc-httpd Buffer Overflow Vulnerability

XiongMai uc-httpd is a HTTP protection program for cameras and other products from XiongMai. A buffer overflow vulnerability exists in version 1.0.0 of XiongMai uc-httpd. An attacker can exploit this vulnerability to cause a denial of service via the Web camera reader interface...

WordPress Blappsta Mobile App plugin SQL Injection Vulnerability

WordPress Blappsta Mobile App plugin is a plugin that converts WordPress websites into native iOS and Android mobile apps. The WordPress Blappsta Mobile App plugin suffers from a SQL injection vulnerability that stems from the application missing validation of SQL statements in the nhynaacomments...

Google Android Information Disclosure Vulnerability (CNVD-2025-28666)

Google Android is a Linux-based open source operating system from Google. Google Android has an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

D-Link DIR-825 Buffer Overflow Vulnerability

The D-Link DIR-825 is a router from China-based AUO D-Link. The D-Link DIR-825 suffers from a buffer overflow vulnerability that originates from the incorrect operation of the parameter pingipaddr in the file pingresponse.cgi, which can be exploited by an attacker to crash the system by corruptin...

ASUS AiCloud Improper Authentication Control Vulnerability

AiCloud is a cloud service from ASUS, designed to provide easy access to the data inside the router's back-up devices such as USBs or PCs, as well as uploading, downloading, playing music online, browsing documents online, sharing links to Facebook, and setting up Smart Sync to synchronize with t...

Linux kernel bnxt driver code issue vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. The Linux kernel suffers from a code issue vulnerability that stems from the bnxt driver not properly recalculating network device characteristics after XDP is disabled, which...

Unspecified Vulnerability in FreeImage (CNVD-2024-39258)

FreeImage is FreeImage open source a cross-platform for supporting popular graphic image formats open source library . A security vulnerability exists in FreeImage that stems from a stack buffer overflow in the Load function of PluginXPM.cpp when processing XPM files in libfreeimage. No detailed...

Unspecified Vulnerability in Oracle VM VirtualBox (CNVD-2024-20437)

Oracle Virtualization and Oracle VM VirtualBox are both products of Oracle Corporation.Oracle Virtualization is a suite of virtualization solutions. The product is used to unify the management of the entire hardware and software system from the application to the disk, can be achieved from the...

Formatting String Error Vulnerability in Multiple Fortinet Products

Fortinet FortiOS is a dedicated security operating system on the FortiGate network security platform.Fortinet FortiProxy is a secure network proxy that protects employees from cyberattacks by combining a variety of detection technologies, such as Web filtering, DNS filtering, DLP, anti-virus,...

Google Chrome WebRTC Module Memory Misreference Vulnerability

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in the Google Chrome WebRTC module, which stems from a confusion in the instructions responsible for freeing memory in the WebRTC module. An attacker can exploit this vulnerability to execu...

Google Android Code Execution Vulnerability (CNVD-2024-07123)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from a code execution vulnerability that is caused by the use of callbackthreadevent after release in the comAndroidbluetoothbtserviceAdapterService.cpp script. An attacker can exploit this...

Mattermost Denial of Service Vulnerability (CNVD-2023-9448306)

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a denial of service vulnerability that stems from an inability to properly limit the characters allowed in different fields of a block in Mattermost Boards, which can be exploit...

FreeImage ofLoad function buffer overflow vulnerability

FreeImage is a cross-platform open source library for supporting popular graphic image formats. A buffer overflow vulnerability exists in the FreeImage ofLoad function, which can be exploited by an attacker to execute arbitrary code on a system or cause a denial of service attack...

Apache Airflow code issue vulnerability (CNVD-2023-85615)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow has a code issue vulnerability that can be exploited by an attacker ...

Linux Kernel Denial of Service Vulnerability (CNVD-2023-64507)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A denial of service vulnerability exists in the Linux Kernel, which originates from a null pointer dereference issue in fs/jfs/jfsdmap.c, a component of the Journaling File...

Microsoft Outlook Spoofing Vulnerability

Microsoft Outlook is a suite of e-mail applications from the American company Microsoft. Microsoft Outlook has a spoofing vulnerability that can be exploited by attackers to conduct spoofing attacks...

ZKTeco BioTime Password Reset Vulnerability

ZKTeco BioTime is a powerful web-based time and attendance management software from ZKTeco, China. A password reset vulnerability exists in ZKTeco BioTime, which can be exploited by an attacker to arbitrarily reset the administrator's password via a crafted web request...

Apache Sling JNDI Injection Vulnerability

Apache Sling is the United States Apache Apache Foundation of a Java platform for open source Web framework. Designed to meet the JSR-170 content repository such as Apache Jackrabbit to create content-centric applications. Apache Sling JCR Base versions prior to 3.1.12 JNDI injection vulnerabilit...

F5 BIG-IP HTTP/2 profile denial of service vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A denial of service vulnerability exists in the F5 BIG-IP HTTP/2 profile, when enabling the client HTTP/2 profile and HTTP MR...

Metabase Information Disclosure Vulnerability (CNVD-2023-06473)

Metabase is an open source data analytics platform from Metabase Inc. Metabase is vulnerable to an information disclosure vulnerability that stems from exposing sensitive information to an unauthorized user. No details of the vulnerability are currently available...

IBM AIX Denial of Service Vulnerability (CNVD-2023-00810)

IBM AIX is an open standards-based UNIX operating system developed by International Business Machines IBM for the IBM Power architecture. IBM AIX suffers from a denial-of-service vulnerability that can be exploited by unprivileged local attackers to cause a denial of service...

Microsoft SharePoint Server Remote Code Execution Vulnerability (CNVD-2022-89421)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft Corporation USA. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information.A remo...

Microsoft SharePoint Server Remote Code Execution Vulnerability (CNVD-2023-72202)

Microsoft SharePoint Server is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A remote code...