Jenkins Script Security Plugin Cross-Site Request Forgery Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project. jenkins Plugin is an application. jenkins Script Security Plugin...

Google Android Resource Management Error Vulnerability in Android (CNVD-2022-47667)

Google Android is a Linux-based open-source operating system from the U.S. company Google. Google Android is vulnerable to a resource management error that could be exploited by attackers to cause a local privilege escalation...

Adobe Prelude null pointer dereference vulnerability (CNVD-2021-92814)

Adobe Prelude is a video recording and capture tool designed for intuitive and efficient media organization and metadata entry to quickly tag and transcode video footage and quickly create rough cuts.Adobe Prelude 10.1 and earlier versions are vulnerable to a null pointer dereference. An attacker...

Russound XSourcePlayer Code Execution Vulnerability

XSourcePlayer is an audio player from Russound. A code execution vulnerability exists in Russound XSourcePlayer version 777D v06.08.03, which stems from a failure of the scriptRunner.cgi component to properly filter special elements of constructed snippets. An attacker can exploit the vulnerabili...

PHP Denial of Service Vulnerability

PHP is a scripting language that executes on the server side. A denial of service vulnerability exists in PHP versions prior to 7.4.31, 8.0.0 and later, 8.0.24 and earlier, and 8.1.0 and later, and 8.1.11 and earlier, which stems from the fact that the phar decompressor code recursively...

TOTOLINK N600R Command Injection Vulnerability (CNVD-2022-53557)

TOTOLINK N600R is a wireless router from Taiwan-based TOTOLINK, which is vulnerable to a command injection attack via the filename parameter in /setting/setUploadSetting...

H2 database code issue vulnerability

H2 database is an embeddable Rdbms written in Java . A code issue vulnerability exists in H2 database, which stems from the H2 database's getConnection method taking the driver's class name and the database's URL as parameters, which can be exploited by an attacker to pass the name of the JNDI...

Jenkins Beaker builder Plugin Cross-site Request Forgery Vulnerability (CNVD-2022-49788)

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. An attacker could use this vulnerability to connect to a specified URL by...

IBM Spectrum Protect Operations Center信息泄露漏洞（CNVD-2022-48933）

IBM Spectrum Protect Operations Center, an IBM company, provides visual control of the IBM Spectrum Protect environment. IBM Spectrum Protect Operations Center versions 8.1.12 and 8.1.13 are vulnerable to information disclosure vulnerability, which stems from the fact that account passwords may b...

Apache HTTP Server Server-Side Request Forgery Vulnerability

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. Apache HTTP Server suffers from a server-side request forgery vulnerability that can be exploited by an attacker to disclose NTLM...

Jenkins Convertigo Mobile Platform Plugin跨站请求伪造漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.A cross-site request forgery vulnerability...

Adobe InCopy Memory Out-of-Bounds Access Vulnerability (CNVD-2021-82416)

Adobe InCopy is a professional word processing program from Adobe, integrated with Adobe InDesign. Adobe InCopy 11.1 and earlier versions have a memory out-of-bounds access vulnerability that could be exploited by attackers to execute arbitrary code...

Microsoft Windows Backup Service Elevation of Privilege Vulnerability (CNVD-2023-02699)

Microsoft Windows Backup Service is an elevation of privilege vulnerability that can be exploited by attackers to elevate privileges...

Adobe Photoshop Buffer Overflow Vulnerability (CNVD-2022-20502)

Adobe Photoshop is a set of image processing software from the American company Audobee Adobe. The software is mainly used for processing pictures. Adobe Photoshop suffers from a buffer overflow vulnerability that can be exploited by an attacker to trigger arbitrary code execution...

Google Android has an unspecified vulnerability (CNVD-2022-53377)

Google Android is a Linux-based open source operating system from Google, Inc. A security vulnerability exists in Google Android, which stems from a placeCall in TelecomManager.java, where the application can keep itself running through foreground service importance due to a privilege bypass. The...

Product Show Room Site跨站脚本漏洞

Product Show Room Site is a product showroom site from Carlo Montero's personal developer. version 1.0 of Product Show Room Site is vulnerable to cross-site scripting, which stems from the fact that entering a special string into the Message text box leads to cross-site scripting. No details of t...

Unspecified Vulnerability in Apache HTTP Server (CNVD-2024-36387)

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. A security vulnerability exists in Apache HTTP Server that can be exploited by an attacker to map URLs to file system locations th...

Jenkins Convertigo Mobile Platform Plugin信息泄露漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project. jenkins Plugin is an application. jenkins Convertigo Mobile Platform Plug...

Jenkins WMI Windows Agents Plugin Buffer Overflow Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.A buffer overflow vulnerability exists in...

Siemens Industrial Product Denial of Service Vulnerability (CNVD-2022-87982)

SIMATIC Drive Controllers for the automation of production machines combine the functionality of SIMATIC S7-1500 CPUs with that of SINAMICS S120 drive controls.SIMATIC ET 200SP Open Controller is the PC-based version of the SIMATIC S7-1500 controller. Includes optional visualization features and...

Linux kernel elevation of privilege vulnerability (CNVD-2022-69204)

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. Linux kernel is vulnerable to an elevation of privilege vulnerability, which stems from watchqueue triggering a memory corruption in the Linux kernel that could be exploited by an attacker to gain elevat...

HTMLMinifier Denial of Service Vulnerability

HTMLMinifier is a Javascript-based HTML compressor/minifier . A denial of service vulnerability exists in HTMLMinifier version 4.0.0, which stems from the program's improper use of regular expressions, and can be exploited by an attacker to cause a denial of service by sending specially crafted...

Rocket.Chat Cross-Site Scripting Vulnerability (CNVD-2022-70579)

Rocket.Chat is an open source team chat software. Chat suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the chat window, which can be exploited by an attacker to manipulate its style, block functionality, and...

Google Android elevation of privilege vulnerability (CNVD-2022-50276)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by an attacker to gain elevated privileges...

Jenkins SSH Plugin Permissions and Access Control Issues Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.The Jenkins SSH Plugin 2.6.1 and earlier...

HUAWEI HarmonyOS code issue vulnerability (CNVD-2022-47648)

HUAWEI HarmonyOS is an operating system from the Chinese company Huawei HUAWEI. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in HUAWEI HarmonyOS 2.0, which stems from a null pointer and array out-of-bounds vulnerability in the...

WordPress Code Snippets Extended跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. WordPress Code...

Google Android elevation of privilege vulnerability (CNVD-2023-55375)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that originates from a logic error in the multiple methods code of the PackageInstallerSession.java component, which can be exploited by an attacker to...

Fast Food Ordering System SQL Injection Vulnerability (CNVD-2022-48945)

Fast Food Ordering System is a fast food ordering system from Carlo Montero's personal developer. version 1.0 of Fast Food Ordering System is vulnerable to SQL injection, which originates from /ffos/admin/categories/managecategory .php?id=The page lacks validation for external input SQL statement...

Adobe Media Encoder Memory Corruption Vulnerability (CNVD-2022-50236)

Adobe Media Encoder is an audio and video encoding application from the American company Audobee Adobe. A memory corruption vulnerability exists in Adobe Media Encoder version 15.4 and earlier versions, which can be exploited by an attacker to execute arbitrary code in the context of the current...

Apache HTTP Server Code Issue Vulnerability

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. A code issue vulnerability exists in Apache HTTP Server that stems from a null pointer reference error in the product. The...

CasaOS Encryption Issues Vulnerabilities

CasaOS is a simple, easy-to-use and elegant open source home cloud system. A cryptographic issue vulnerability exists in versions of CasaOS prior to 0.4.4. The vulnerability stems from a poor choice of JWT algorithm and can be exploited by an attacker to craft arbitrary JWTs and access functions...

Google Android elevation of privilege vulnerability (CNVD-2022-50277)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by an attacker to elevate privileges...

JoomShaper SP Page Builder Lite suffers from a SQL Injection Vulnerability

SP Page Builder is a free page builder component that users can use to design and edit website page content on joomla sites. JoomShaper SP Page Builder Lite suffers from a SQL injection vulnerability that can be exploited by an attacker to obtain sensitive database information...

Mozilla Firefox Elevation of Privilege Vulnerability (CNVD-2023-17318)

Mozilla Firefox is an open source Web browser from the Mozilla Foundation in the U.S. An elevation of privilege vulnerability exists in versions of Mozilla Firefox prior to 96.0. An attacker could exploit this vulnerability to elevate privileges by making the program search for system libraries i...

Microsoft Visual Studio Code Remote Code Execution Vulnerability (CNVD-2023-72223)

Microsoft Visual Studio Code is an open source code editor from Microsoft USA. A remote code execution vulnerability exists in Microsoft Visual Studio Code, which can be exploited by an attacker to execute arbitrary code on a system...

Jenkins EasyQA Plugin Cross-Site Request Forgery Vulnerability (CNVD-2022-49793)

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. Jenkins Plugin is an application that provides hundreds of plug-ins to support building, deploying, and automating any project. Jenkins EasyQA Plugin 1.0 and earlier versions are vulnerable to cross-site...

Jenkins Beaker builder Plugin跨站请求伪造漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. An attacker could use this vulnerability to connect to a specified URL by...

HUAWEI EMUI and Magic UI Authorization Issue Vulnerability

HUAWEI EMUI and Magic UI is an Android-based mobile operating system developed by the Chinese company Huawei HUAWEI. HUAWEI EMUI and Magic UI suffers from an authorization issue vulnerability that stems from a lack of authorization in a system component, which can be exploited by an attacker to...

Unspecified Vulnerability in Apache HTTP Server (CNVD-2025-16614)

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. An unspecified vulnerability exists in Apache HTTP Server that stems from insufficient escaping of user-supplied data by modssl,...

ZTE ZXMP M721 Privilege and Access Control Vulnerability

The ZTE ZXMP M721 is a metro edge OTN Optical Transport Network device from ZTE Corporation ZTE in China.The ZTE ZXMP M721 has a privilege and access control vulnerability, which stems from the fact that the folder privilege viewed by sftp is 666, which is inconsistent with the actual privilege,...

Adobe Illustrator 2021 out-of-bounds read vulnerability

Adobe Illustrator 2021 is a vector drawing software. Adobe Illustrator 2021 25.2.3 and earlier versions contain an out-of-bounds read vulnerability when handling specially crafted files. An attacker could exploit this vulnerability to cause a memory leak...

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An information disclosure vulnerability exists in WordPress WP Cerber Security 9.0 and prior versions, which stems from incorrect validation of the value provided for the author parameter in the ~/cerber-load.php file. An attacker can exploit the vulnerability to launch a user enumeration attack.

FlyteAdmin is a control plane for Flyte open source. Responsible for managing entities tasks, workflows, startup plans and managing workflow execution. An information disclosure vulnerability exists in Flyte FlyteAdmin versions prior to 1.1.44, which stems from the fact that users who enable the...

IBM Sterling Partner Engagement Manager信息泄露漏洞

IBM Sterling Partner Engagement Manager is an automated management tool from IBM Corporation. IBM Sterling Partner Engagement Manager version 6.2.0 is vulnerable to an information disclosure vulnerability that could be exploited by a remote, authenticated attacker to obtain sensitive information ...

QSAN Storage Manager Path Traversal Vulnerability (CNVD-2021-48972)

QSAN Storage Manager is a NAS operating system from Quantium Technologies Incorporated QSAN. A path traversal vulnerability exists in QSAN Storage Manager. The vulnerability stems from the product's getImage function not validating the path parameter in the URL, which allows an attacker to downlo...

Google Chrome 'ContainerNode::notifyNodeInsertedInternal' memory misreference vulnerability

Google Chrome is a web browser developed by the American company Google Google. A memory misreference vulnerability exists in the 'ContainerNode:: notifyNodeInsertedInternal' function in the WebKit/Source/core/dom/ContainerNode.cpp file in the DOM implementation of Google Chrome prior to version...

Samsung SecSoterService information disclosure vulnerability

Samsung SecSoterService is a service for Samsung Samsung mobile devices. Samsung SecSoterService is vulnerable to an information disclosure vulnerability that stems from the improper use of unique device IDs in unprotected SecSoterService, which could be exploited by an attacker to unauthorized...

Linux kernel resource management error vulnerability (CNVD-2022-68575)

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. Linux kernel is vulnerable to resource management errors, which can be exploited by attackers to force the reuse of freed memory areas in the Linux kernel via nci request to trigger a denial of service a...

ABB MicroSCADA Pro SYS600 Code Execution Vulnerability

ABB MicroSCADA Pro SYS600 is a suite of monitoring and data acquisition software from ABB Switzerland. The software is used for substation automation, SCADA electrical, distribution management applications and industrial power management. ABB MicroSCADA Pro SYS600 suffers from a code execution...

Apache XML Graphics Batik Server-Side Request Forgery Vulnerability

Apache XML Graphics Batik is a Java-based application from the Apache Foundation that is primarily used to process images in SVG format.Apache XML Graphics Batik is vulnerable to server-side request forgery, which is caused by a flaw in the DefaultScriptSecurity function. An attacker could exploi...