Google Chrome MediaStream Memory Misreference Vulnerability (CNVD-2023-69036)

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in Google Chrome MediaStream. An attacker can exploit this vulnerability to execute arbitrary code on the system or cause an application to crash...

Rockwell Automation ThinManager Path Traversal Vulnerability (CNVD-2023-64278)

Rockwell Automation ThinManager is a thin client management software from Rockwell Automation, Inc. It allows thin clients to be assigned to multiple remote desktop servers simultaneously. A path traversal vulnerability exists in Rockwell Automation Thinmanager Thinserver, which stems from the...

Google Android Framework Information Disclosure Vulnerability (CNVD-2024-13747)

Google Android is a Linux-based open source operating system from Google. An information disclosure vulnerability exists in Google Android Framework, which can be exploited by attackers to obtain sensitive information...

Linux kernel code issue vulnerability (CNVD-2023-56646)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux Kernel has a code issue vulnerability that stems from a flaw in the IPv6 module where arg.result is used inconsistently in fib6rulelookup, sometimes holding rt6info and...

Linux kernel resource management error vulnerability (CNVD-2023-48540)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. The Linux kernel suffers from a resource management error vulnerability that stems from the incorrect handling of per-CPU sequence counts during concurrent iptables rule...

Linksys E2000 Command Injection Vulnerability

The Linksys E2000 is a wireless router from Linksys USA. The Linksys E2000 1.0.06 firmware version suffers from a command injection vulnerability that stems from the fact that if an attacker gains web administrative privileges, he/she can inject commands into the post request parameters wlssid,...

ZOHO ManageEngine ADManager Plus Remote Command Vulnerability

ZOHO ManageEngine ADManager Plus is a set of Microsoft Active Directory management software designed for enterprise users using Windows domains from ZOHO, USA. A remote command vulnerability exists in ZOHO ManageEngine ADManager Plus, which can be exploited by attackers to perform command injecti...

Delta Electronics InfraSuite Device Master Authentication Error Vulnerability

Delta Electronics InfraSuite Device Master is Delta Electronics' device for simplifying and automating critical equipment monitoring. An authentication error vulnerability exists in Delta Electronics InfraSuite Device Master versions prior to 1.0.5, which can be exploited by an attacker to genera...

Linux kernel denial-of-service vulnerability (CNVD-2023-05410)

Linux kernel, the kernel used by the Linux Foundation's open source operating system Linux, is vulnerable to a denial-of-service attack in versions of Linux kernel prior to 6.1.6. In affected versions of the Linux kernel, a NULL pointer dereference error in the flow control subsystem allows an...

Google Chrome Forms Code Execution Vulnerability

Google Chrome is a web browser from Google, an American company. A code execution vulnerability exists in Google Chrome Forms, which can be exploited by an attacker to execute arbitrary code on a system or cause a denial of service...

Owncast SQL Injection Vulnerability

Git is a free, open source distributed version control system. A SQL injection vulnerability exists in versions prior to Owncast 0.0.13. An attacker can exploit this vulnerability to obtain sensitive database information...

Tenda AC1200 setWanPpoe function stack overflow vulnerability

Tenda AC1200 is a wireless router from Tenda China.A stack overflow vulnerability exists in the Tenda AC1200 setWanPpoe function. An attacker can exploit this vulnerability to cause a denial of service via specially crafted overflow data...

IBM Robotic Process Automation Resources Exposed to False Scope Vulnerability

IBM Robotic Process Automation is a robotic process automation product from International Business Machines IBM, Inc. It can help you automate more business and IT processes at scale with the ease and speed of traditional RPA.IBM Robotic Process Automation for Cloud Pak suffers from a resource...

Apache Dubbo Hession Deserialization Vulnerability

Apache Dubbo is a microservice development framework that provides two key capabilities for RPC communication and microservice governance.Apache Dubbo Hession is vulnerable to deserialization, which can be exploited by attackers to execute arbitrary code on the target server...

Veritas NetBackup pbx_exchange denial of service vulnerability

Veritas NetBackup is a storage service from Veritas that is used to provide backup and recovery capabilities for enterprise environments. Veritas NetBackup 8.2 and prior versions contain a denial-of-service vulnerability that could be exploited by an attacker with local access to send a construct...

Bento4 AP4_BitReader::ReadBits Buffer Overflow Vulnerability

Bento4 is an open source C++ library for reading and writing MP4 files. A buffer overflow vulnerability exists in Bento4 version v1.6.0-639, which stems from a heap overflow in the AP4BitReader::ReadBits function of the mp4mux component. An attacker could exploit the vulnerability to affect the...

Aruba Networks ArubaOS and Instant PAPI Protocol Buffer Overflow Vulnerability

ArubaOS is the network operating system for Aruba Mobility Controllers, Mobility Masters, and controller-managed access points APs. instantOS is an Arch Linux-based distribution. aruba networks ArubaOS and Instant PAPI The Aruba Networks ArubaOS and Instant PAPI protocols are vulnerable to a buff...

Sophos Firewall Code Execution Vulnerability

Sophos Firewall is a firewall from Sophos UK. A code execution vulnerability exists in Sophos Firewall 19.0.1 and prior versions, which fails to properly filter special elements of constructed snippets in User Portal and Webadmin. An attacker can exploit the vulnerability to cause arbitrary code...

Google TensorFlow Input Validation Error Vulnerability (CNVD-2023-10611)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. An input validation error vulnerability exists in Google TensorFlow, which stems from a segmentation error that occurs if QuantizedAdd is given a tensor of non-zero rank mininput or maxinput. An attacke...

Google Chrome Resource Management Error Vulnerability (CNVD-2022-81243)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a Resource Management Error vulnerability that originates from a confusion in the instructions of the program responsible for freeing memory in Frames. An attacker could exploit this vulnerability to cause...

Apache Flume input validation error vulnerability

Apache Flume is a distributed, reliable and available service from the Apache Foundation, USA. Used to efficiently collect, aggregate, and move large amounts of log data, versions of Apache Flume prior to 1.4.0 through 1.10.0 contain a security vulnerability that stems from vulnerability to remot...

Microsoft Visual Studio Remote Code Execution Vulnerability (CNVD-2022-67839)

Microsoft Visual Studio is a family of development tools from Microsoft Corporation USA and is a largely complete development toolset that includes most of the tools needed throughout the software lifecycle.Microsoft Visual Studio is vulnerable to remote code execution. An attacker could exploit...

H3C Magic R200 Buffer Overflow Vulnerability (CNVD-2022-54321)

H3C Magic R200 is a router from China New Huasan H3C.A security vulnerability exists in the H3C Magic R200 R200V200R004L02 version, which stems from the HOST parameter of doping.asp that was found to contain a stack overflow. No details of the vulnerability are currently available...

Apache Jetspeed-2 Input Validation Error Vulnerability

Apache Jetspeed-2 is a very open and customizable portal platform from the Apache USA Foundation. Apache Jetspeed-2 suffers from an input validation error vulnerability that stems from Apache Jetspeed-2 failing to adequately filter untrusted user input by default, which can be exploited by an...

74cms Cross-Site Scripting Vulnerability (CNVD-2022-58895)

74cms is a PHP and MySQL-based online recruitment system from China Xunyi Technology. 74cmsSE version v3.5.1 contains a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied data and output from path/job. An attacker could exploit this vulnerabili...

JerryScript buffer overflow vulnerability

JerryScript, a lightweight JavaScript engine from the Jerryscript project, is vulnerable to a buffer overflow vulnerability in JerryScript version 2.4.0, which stems from ecma-helpers.c:326 in ecmagetlexenvtype when handling untrusted input a boundary error occurs. A remote attacker could exploit...

WordPress Google Tag Manager plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Swftools out-of-bounds write vulnerability (CNVD-2022-62215)

Swftools is a set of utilities for working with Adobe Flash files SWF files. An out-of-bounds write vulnerability exists in Swftools 2020-12-22 and prior versions, which stems from a heap buffer overflow in the function swfGetD64 located in rfxswf.c. The vulnerability is caused by a heap buffer...

Cisco Common Services Platform Collector Cross-Site Scripting Vulnerability (CNVD-2022-64197)

Cisco Common Services Platform Collector CSPC is a common services platform data collector from Cisco USA. The product analyzes network performance and identifies risks and vulnerabilities by polling basic inventory and configuration data from Cisco devices.Cisco Common Services Platform Collecto...

TOTOLINK N600R Command Injection Vulnerability (CNVD-2022-53550)

TOTOLINK N600R is a wireless router from TOTOLINK, Taiwan, China.The TOTOLINK N600R V5.3c.7159B20190425 firmware version is vulnerable to command injection, which can be exploited by attackers via the /setting/CloudACMunualUpdate in the filename parameter in /setting/CloudACMunualUpdate to conduc...

Adobe InDesign Code Execution Vulnerability

Adobe InDesign is a set of layout and editing applications from the American company Audobee Adobe. A code execution vulnerability exists in Adobe InDesign. The vulnerability arises from a networked system or product that does not properly validate data boundaries when performing operations in...

Delta Electronics DIAEnergie SQL Injection Vulnerability (CNVD-2022-36026)

Delta Electronics DIAEnergie is an industrial energy management system for monitoring and analyzing energy consumption in real time, calculating energy consumption and load characteristics, optimizing equipment performance, improving production processes and maximizing energy efficiency. Delta...

Tyler Technologies Tyler Odyssey信息泄露漏洞

Tyler Technologies Tyler Odyssey is a court and judicial software system from Tyler Technologies, Inc. An information disclosure vulnerability exists in versions of Tyler Technologies Tyler Odyssey prior to 17.1.20, which stems from an insecure direct object reference issue in the platform. An...

Out-of-bounds write vulnerability in multiple Adobe products (CNVD-2022-46968)

Adobe Acrobat is a set of PDF file editing and conversion tools.Adobe Reader is a set of PDF document reading software. Multiple Adobe products have out-of-bounds write vulnerabilities that can be exploited by an attacker to execute arbitrary code in the context of the current user...

Apache Apisix Input Validation Error Vulnerability

Apache Apisix is a cloud-native microservices API gateway service from the Apache Foundation. The software is based on OpenResty and etcd, with dynamic routing and plugin hot-loading for API management in microservices systems. An attacker could use this vulnerability to bypass the bodyschema...

gradio arbitrary code injection vulnerability

gradio is an open source framework. gradio is vulnerable to arbitrary code injection. The vulnerability automatically runs these commands and can be exploited by an attacker to run arbitrary commands on a user's computer...

Jenkins Folder-based Authorization Strategy Plugin Cross-Site Scripting Vulnerability

Jenkins and Jenkins Plugin are both products of Jenkins, which is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. The plugin fails to escape the role name displayed on the configuration form, which can ...

FreeTAKServer-UI Cross-Site Scripting Vulnerability

FreeTAKServer-UI is an open source FTS web interface from the FreeTAKTeam. FreeTAKServer-UI has a cross-site scripting vulnerability that originates from the Callsign parameter, and no detailed vulnerability details are currently available...

Google Android permission permission and access control issue vulnerability (CNVD-2022-47678)

Google Android is a Linux-based open-source operating system from the U.S. company Google. Google Android is vulnerable to permission and access control issues, which can be exploited by attackers to cause local privilege escalation...

Siemens Climatix POL909 (AWM and AWB) Cross-Site Scripting Vulnerability (CNVD-2022-17788)

Siemens Climatix AWB Advanced Web and BACnet Module, POL909 enables users of the Climatix 600 solution to connect to a BACnet IP network and implement and load customer web pages and features. Siemens Climatix AWM Advanced Web Module, POL909 enables users of the Climatix 600 solution to implement...

Siemens SINEC NMS SQL Injection Vulnerability (CNVD-2022-17792)

Siemens SINEC NMS is a network management system NMS from Siemens Germany that is used to centrally monitor, manage, and configure industrial networks with tens of thousands of devices 24/7, including security-related areas.A SQL injection vulnerability in Siemens SINEC NMS allows a privileged,...

Google fscrypt command injection vulnerability

Google Fscrypt is an open source advanced tool from Google, Inc. Google fscrypt is vulnerable to command injection, which can be exploited by attackers to elevate privileges in certain situations...

Jenkins dbCharts Plugin Cross-Site Request Forgery Vulnerability

Jenkins plug-ins are plug-ins that provide appropriate functionality for Jenkins. Jenkins dbCharts Plugin cross-site request forgery vulnerability. The vulnerability allows an attacker to connect to a specified database via JDBC using specified credentials and determine whether a class is availab...

Google TensorFlow buffer overflow vulnerability (CNVD-2022-11507)

Google TensorFlow is an end-to-end open source platform for machine learning from Google Google. Google Tensorflow has a buffer overflow vulnerability, which stems from the implementation of ReverseSequence's shape inference does not fully validate the value of batch dim, and an attacker can...

Google Android Access Control Error Vulnerability (CNVD-2022-13209)

Google Android is a Linux-based open source operating system from Google, Inc. A security vulnerability exists in Google Android, which stems from allowing untrusted applications to load arbitrary URLs and local files. No details of the vulnerability are currently available...

Google Tensorflow numeric error vulnerability (CNVD-2022-09879)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A numerical error vulnerability exists in Google Tensorflow, which could be exploited by an attacker to create a TFLite model that triggers a division in the "BiasAndClamp" implementation. The...

Apache Tomcat permission permission and access control issues vulnerability

Apache Tomcat is a lightweight web application server from the Apache Foundation in the United States. The program implements support for Servlet and JavaServer Page JSP. Apache Tomcat is vulnerable to privilege permission and access control issues, and an attacker can bypass Apache Tomcat's...

Apache Karaf path traversal vulnerability

Apache Karaf is an open source, modern, multi-format, lightweight, powerful, OSGI-certified enterprise container that provides many features to help developers and users deploy applications more flexibly.A path traversal vulnerability exists in Apache Karaf. The vulnerability is related to the ob...

Google Chrome Security Feature Issue Vulnerability (CNVD-2022-15139)

Google Chrome is a web browser from Google, Inc. A security feature vulnerability exists in Google Chrome that could be exploited by attackers to bypass site quarantine via crafted HTML pages...

Unspecified Vulnerability in Mitsubishi Electric MC Works64

Mitsubishi Electric MC Works64 is a data acquisition and monitoring system SCADA from Mitsubishi Electric Japan. A security vulnerability exists in the Mitsubishi Electric MC Works64 that originates in ICONICS and the Mitsubishi Electric ICONICS product suite, where the FrameWorX server in the...