Apache Geode Remote Code Execution Vulnerability (CNVD-2022-83595)

A remote code execution vulnerability exists in Apache Geode, the Apache Foundation's management platform for providing real-time and consistent access to data for data-intensive applications in distributed cloud architectures, which stems from a vulnerability to untrusted data deserialization wh...

Siemens SIMATIC WinCC OA Client Authentication Vulnerability

Siemens SIMATIC WinCC OA is a SCADA operating system from Siemens, Germany. It is used to control and monitor industrial applications. A security vulnerability exists in Siemens SIMATIC WinCC OA that stems from the application using only client-side authentication when both server-side...

Illumina Local Run Manager Access Control Error Vulnerability

Illumina Local Run Manager is an integrated solution from Illumina, Inc. Designed to create sequencing runs, monitor run status, analyze sequencing data, and view results, Illumina Local Run Manager is vulnerable to an access control error that could be exploited by remote attackers to gain...

SQL Injection Vulnerability in Panmicroeoffice8 (CNVD-2022-43843)

Panavision eoffice8 is a mobile office platform. A SQL injection vulnerability exists in Panmicroeoffice8, which can be exploited by attackers to obtain sensitive information from the database...

Fortinet FortiOS Access Control Error Vulnerability (CNVD-2022-50945)

Fortinet FortiOS is a dedicated security operating system for the FortiGate network security platform from Fortinet, Inc. Fortinet FortiOS versions 6.4.8 and earlier and 7.0.3 and earlier are vulnerable to an access control error that could be exploited by an authenticated attacker with a...

Microsoft Windows Print Spooler Elevation of Privilege Vulnerability (CNVD-2022-84605)

Microsoft Windows is an operating system for personal devices, Microsoft Windows Server is a server operating system, and Windows Print Spooler is one of the print spoolers. An elevation of privilege vulnerability exists in Microsoft Windows Print Spooler due to a flaw in the print spooler...

Microsoft SharePoint Server Spoofing Vulnerability (CNVD-2022-59593)

Microsoft SharePoint is a suite of enterprise business collaboration platforms from Microsoft Corporation USA. Microsoft SharePoint Server is vulnerable to spoofing and no details of the vulnerability are currently available...

Microsoft Windows Network File System Remote Code Execution Vulnerability (CNVD-2022-74601)

Microsoft Windows Network File System is a file sharing solution from Microsoft that allows you to transfer files between computers running Windows Server and UNIX operating systems using the NFS protocol. Network File System is vulnerable to a remote code execution vulnerability caused by a flaw...

Jenkins Pipeline Phoenix AutoTest Plugin XML External Entity Injection Vulnerability

Jenkins Pipeline is a set of plug-ins that support the implementation and integration of continuous delivery pipelines into Jenkins.The Jenkins Pipeline Phoenix AutoTest Plugin 1.3 and earlier versions are vulnerable to XML external entity injection, which can be exploited by remote attackers to...

Veeam Backup&Replication Access Control Error Vulnerability

Veeam Backup & Replication is a suite of data protection software from the Swiss company Veeam. The software provides backup, replication and recovery for VMware and Hyper-V VMs, physical and cloud environments. Veeam Backup&Replication is vulnerable to an Access Control Error vulnerability, no...

Sylius has an unspecified vulnerability (CNVD-2022-22317)

Sylius is an open source e-commerce platform based on the Symfony framework from the Polish company Sylius. sylius has a security vulnerability that stems from the possibility that an attacker-controlled page could load the website in an iframe. This would enable a clickjacking attack where an...

Cobbler Licensing Issue Vulnerability (CNVD-2022-20579)

Cobbler is a network installation server suite that is primarily used to quickly set up Linux network installation environments.An authorization issue vulnerability exists in versions of Cobbler prior to 3.3.2, which stems from the presence of incorrect authorization in the application. An attack...

Linux Kernel VirtIO Bluetooth driver denial of service vulnerability

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. A denial of service vulnerability exists in the Linux Kernel VirtIO Bluetooth driver, which is caused by a memory leak in the VirtIO Bluetooth driver memory leak in driver/Bluetooth/VirtIObt.c. A local...

UltraVNC has an unspecified vulnerability

UltraVNC is an open source remote terminal control software for the Windows platform. versions of UltraVNC prior to 1.3.8.0 have a security vulnerability in the DSM plug-in that can be exploited by a locally authenticated attacker to achieve Local Elevation of Privilege LPE on vulnerable systems...

Mattermost Server Buffer Overflow Vulnerability (CNVD-2022-65355)

Mattermost Server is an open source messaging platform from Mattermost, Inc. A buffer overflow vulnerability exists in Mattermost Server versions 6.3.2 and below, which stems from the fact that Mattermost Server's document extractor does not properly validate data boundaries when performing...

Oracle MySQL Cluster Input Validation Error Vulnerability (CNVD-2022-17688)

Oracle MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database developed by Oracle Corporation. Oracle MySQL Cluster is vulnerable to an input validation error, which can be exploited by attackers to execute arbitrary code...

mruby out-of-bounds read vulnerability

mruby is a lightweight implementation of the Ruby language. Homebrew mruby 3.2 suffers from an out-of-bounds read vulnerability, for which no detailed vulnerability details are currently available...

microweber has an unspecified vulnerability (CNVD-2022-13203)

Microweber is an online store management system from the US Microweber community that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. Microweber has a security vulnerability, and no details of the vulnerability are available at this time...

MCMS of Jiangxi Minsoft Technology Co., Ltd. has unspecified vulnerabilities

Mcms is a complete open source J2ee system from Jiangxi Mingsoft Technology Co. Mcms v5.1 version has a SQL injection vulnerability, which can be exploited by attackers to perform sql injection via /ms/cms/content/list.do...

SAP Business Objects Web Intelligence跨站脚本漏洞

SAP Business Objects Web Intelligence is a centralized suite from SAP, a German company used for data reporting, visualization and sharing. SAP Business Objects Web Intelligence is vulnerable to a cross-site scripting vulnerability that could be exploited by attackers to compromise vulnerable...

Apache Karaf code issue vulnerability (CNVD-2022-14707)

Apache Karaf is the United States Apache Apache Foundation for the deployment of applications and components of a lightweight OSGi Java Dynamic Modular System container. Apache Karaf suffers from a code issue vulnerability that stems from insecure input validation when handling serialized data,...

WordPress Buttonizer-Smart Floating Action Button plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. buttonizer-Smart Floating Action Button plugin has a cross-site scripting vulnerability in versions prior to 2.5.5,...

Fortinet FortiClient for Windows License Error Vulnerability

Fortinet FortiClient is a fabric agent from Fortinet USA, Inc. It is used to provide protection, compliance and secure access in a single modular lightweight client.Fortinet FortiClient for Windows 7.0.0, versions 6.4.6 and earlier and 6.2.8 and earlier are vulnerable to an authorization error. A...

Redash has an unspecified vulnerability

Redash is a data integration and analysis solution from the Israeli company Redash. The product supports data integration, data visualization, query editing, and data sharing.Redash 10.0.0 and earlier versions contain a security vulnerability that could be exploited by an attacker to spoof sessio...

Snipe-IT Cross-Site Scripting Vulnerability (CNVD-2022-19842)

Snipe-IT is an open source IT asset/license management system. Snipe-IT has a cross-site scripting vulnerability that stems from the product's web generation page not validating the input data, which could be exploited by an attacker to cause client-side code execution...

Open Design Alliance Drawings SDK Resource Management Error Vulnerability

Open Design Alliance Drawings SDK is a software development kit for drawing design applications from Open Design Alliance, Inc. The development package provides access to data in .dwg and .dgn through a convenient, object-oriented API that provides a C API, support for repair files, support for t...

Siemens Sentron Powermanager Local Code Execution Vulnerability

Siemens Sentron Powermanager is a power management software from Siemens, a German company. A local code execution vulnerability exists in Siemens Sentron Powermanager, which stems from an affected application assigning incorrect access rights to a specific folder containing configuration files. ...

Apache Traffic Server Heap Buffer Overflow Vulnerability

Apache Traffic Server, referred to as ATS or TS, is a high-performance, modular HTTP proxy and caching server. stats-over-http plugin in Apache Traffic Server version 9.1.0 is vulnerable to a heap buffer overflow. An attacker could exploit this vulnerability to overwrite memory...

Oracle VM VirtualBox Denial of Service Vulnerability (CNVD-2021-81788)

Oracle VM VirtualBox is a virtual machine management software from Oracle. A denial of service vulnerability exists in the Core component of Oracle VM VirtualBox versions prior to 6.1.28, which can be exploited by an attacker to cause Oracle VM VirtualBox to hang or crash frequently and repeatedl...

TinyXML Infinite Loop Vulnerability

TinyXML is a C++ XML parser that can be easily integrated into other programs. An infinite loop vulnerability exists in TiXmlParsingData::Stamp in tinyxmlparser.cpp in TinyXML 2.6.2 and earlier. An attacker can exploit this vulnerability to cause a denial of service via a specially crafted XML...

Matrix Information Breach Vulnerability

Matrix is an ambitious new ecosystem for open federated instant messaging and VoIP. Matrix suffers from an information disclosure vulnerability that stems from the product not doing valid authentication of access user privileges. An attacker could access members' sensitive information via another...

ARM mbed TLS denial of service vulnerability

ARM mbed TLS is a product from ARM UK that provides secure communication and encryption for mbed products. ARM mbed TLS suffers from a denial of service vulnerability that stems from an unrestricted calculation performed by mbedtlsmpiexpmod. An attacker could exploit this vulnerability to provide...

Google TensorFlow Information Disclosure Vulnerability (CNVD-2021-63059)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc...

Microsoft Visual Studio Spoofing Vulnerability (CNVD-2021-54406)

Microsoft Visual Studio is a family of development tools from Microsoft Corporation USA and is a largely complete development toolset that includes most of the tools needed throughout the software lifecycle. An attacker could exploit this vulnerability with a specially crafted website to spoof...

Wireshark Input Validation Error Vulnerability (CNVD-2022-11206)

Wireshark formerly known as Ethereal is a suite of network packet analysis software from the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis. Wireshark suffers from an input validation error vulnerability that stems from...

Google TensorFlow Numeric Error Vulnerability

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow 2.4.2, 2.3.3, 2.2.3, 2.1.4 suffers from a number error vulnerability that can be exploited by an attacker to trigger undefined behavior via a null pointer bound to...

Google Android iaxxx-codec.c elevation of privilege vulnerability

Google Android is a Linux-based open source operating system from the Google Open Handheld Consortium Google. Google Android iaxxx-codec.c suffers from an elevation of privilege vulnerability. An attacker can exploit this vulnerability to cause a local elevation of privilege...

WordPress College publisher Import plugin file upload vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.College publisher Import is a plugin for WordPress. A file upload vulnerability exists in WordPress College publisher...

GitLab Access Control Error Vulnerability (CNVD-2021-22453)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab after version...

Npm ps-kill command injection vulnerability

Npm ps-kill is an application from Npm, Inc. Npm ps-kill is vulnerable to command injection, which can be exploited by attackers to execute arbitrary commands...

Rust Resource Management Error Vulnerability (CNVD-2021-17263)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in scratchpad crate before 1.3.1 for Rust, which stems from the move elements function being able to use double free. no details of the vulnerability are currently available...

ONLYOFFICE Document Server File Extension Handling Vulnerability (CNVD-2021-17248)

ONLYOFFICE Document Server is a free collaborative online office suite that includes viewers and editors for text, spreadsheets and presentations. A file extension handling vulnerability exists in the ONLYOFFICE DocumentServer core module, which can be exploited by an attacker to remotely execute...

Microsoft Excel Remote Code Execution Vulnerability (CNVD-2021-08824)

Microsoft Excel is a word processing software in the Office suite. A security vulnerability exists in Microsoft Excel's handling of memory objects, which allows remote attackers to exploit the vulnerability by submitting a special file request and tricking the user into parsing it, which could...

Envoy has an unspecified vulnerability (CNVD-2021-58578)

Envoy is an open source distributed proxy server. security vulnerabilities exist in versions prior to Envoy 1.15.0. No details of the vulnerability are currently available...

Mozilla Rust Input Validation Error Vulnerability

Rust is a general-purpose, compiled programming language. An input validation error vulnerability exists in Mozilla Rust version 0.6.2, which originates in the nonlinearray implementation and can be exploited by an attacker to generate unaligned references for types with large alignment...

Unnamed Vulnerability in IOBit Unlocker

IOBit Unlocker is a file cleaning tool. A security vulnerability exists in the driver in IOBit Unlocker version 1.1.2. An attacker can exploit the vulnerability to unlock files and shut down a process even if the process is running with SYSTEM privileges...

Microsoft Win32k Elevation of Privilege Vulnerability (CNVD-2020-28432)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, U.S.A. Microsoft Windows is a set of operating systems for use on personal devices.Microsoft Windows Server is a set of server operating systems. win32k is the kernel part of one of the Windows subsystems, ...

Multiple Red Hat Products Security Feature Issue Vulnerabilities

Red Hat Ceph Storage and Red Hat OpenShift are both products of Red Hat, Inc. Red Hat Ceph Storage is a scalable, open software-defined storage platform.Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform that supports building, testing, deploying, and running applications....

Rumpus FTP Web File Manager Cross-Site Scripting Vulnerability

Rumpus FTP Web File Manager is a file transfer server. A cross-site scripting vulnerability exists in the login page in Rumpus FTP Web File Manager version 8.2.9.1. The vulnerability stems from a lack of proper validation of client data by the web application. An attacker can exploit this...

Linear eMerge 50P/5000P File Upload Vulnerability

The Linear eMerge 50P/5000P is an access control security system managed through a browser from Nortek Security & Control. A file upload vulnerability exists in the Linear eMerge 50P/5000P. An attacker could use this vulnerability to upload a file with an arbitrary extension to a directory in the...