ONLYOFFICE Document Server File Extension Handling Vulnerability (CNVD-2021-17248)

ONLYOFFICE Document Server is a free collaborative online office suite that includes viewers and editors for text, spreadsheets and presentations. A file extension handling vulnerability exists in the ONLYOFFICE DocumentServer core module, which can be exploited by an attacker to remotely execute...

Microsoft Excel Remote Code Execution Vulnerability (CNVD-2021-08824)

Microsoft Excel is a word processing software in the Office suite. A security vulnerability exists in Microsoft Excel's handling of memory objects, which allows remote attackers to exploit the vulnerability by submitting a special file request and tricking the user into parsing it, which could...

Envoy has an unspecified vulnerability (CNVD-2021-58578)

Envoy is an open source distributed proxy server. security vulnerabilities exist in versions prior to Envoy 1.15.0. No details of the vulnerability are currently available...

Mozilla Rust Input Validation Error Vulnerability

Rust is a general-purpose, compiled programming language. An input validation error vulnerability exists in Mozilla Rust version 0.6.2, which originates in the nonlinearray implementation and can be exploited by an attacker to generate unaligned references for types with large alignment...

Unnamed Vulnerability in IOBit Unlocker

IOBit Unlocker is a file cleaning tool. A security vulnerability exists in the driver in IOBit Unlocker version 1.1.2. An attacker can exploit the vulnerability to unlock files and shut down a process even if the process is running with SYSTEM privileges...

Microsoft Win32k Elevation of Privilege Vulnerability (CNVD-2020-28432)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, U.S.A. Microsoft Windows is a set of operating systems for use on personal devices.Microsoft Windows Server is a set of server operating systems. win32k is the kernel part of one of the Windows subsystems, ...

Multiple Red Hat Products Security Feature Issue Vulnerabilities

Red Hat Ceph Storage and Red Hat OpenShift are both products of Red Hat, Inc. Red Hat Ceph Storage is a scalable, open software-defined storage platform.Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform that supports building, testing, deploying, and running applications....

Linear eMerge 50P/5000P File Upload Vulnerability

The Linear eMerge 50P/5000P is an access control security system managed through a browser from Nortek Security & Control. A file upload vulnerability exists in the Linear eMerge 50P/5000P. An attacker could use this vulnerability to upload a file with an arbitrary extension to a directory in the...

Jupyter Notebook Cross-Site Scripting Vulnerability (CNVD-2019-09602)

Jupyter Notebook is an open source web application that creates and shares documents containing live code, equations, visualizations, and narrative text. A cross-site scripting vulnerability exists in Jupyter Notebook versions prior to 5.7.1, which stems from a failure to set the content security...

Artifex Software MuJS Buffer Overflow Vulnerability (CNVD-2016-10581)

Artifex Software MuJS is a lightweight JavaScript interpreter from Artifex Software, USA. Artifex Software MuJS 5000749f5afe3b956fc916e407309de840997f4a A buffer overflow vulnerability exists in the Spreplaceregexp function in previous versions, which can be exploited by an attacker to execute co...

CloudBees Jenkins Cross-Site Scripting Vulnerability (CNVD-2015-07821)

CloudBees Jenkins is the open source continuous integration server. A cross-site scripting vulnerability exists in CloudBees Jenkins 1.638, LTS versions prior to 1.625.2, in the slave overview page, where a remote user with certain privileges can inject web script or HTML via a slave offline stat...

Schneider Electric SpaceLogic AS-P/AS-B Log Message Disclosure Vulnerability

The Schneider Electric SpaceLogic AS-P is an automation server from Schneider Electric France. The Schneider Electric SpaceLogic AS-P/AS-B suffers from a log message disclosure vulnerability that can be exploited by an attacker to cause SNMP credentials to be exposed...

Mozilla Firefox for iOS cross-site scripting vulnerability (CNVD-2024-12553)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A cross-site scripting vulnerability exists in Mozilla Firefox for iOS, which can be exploited by an attacker to execute script in a victim's web browser using a specially crafted URL in the security...

TP-LINK ER7206 wireguard VPN Command Injection Vulnerability

The TP-LINK ER7206 is a multi-function Gigabit router from China P&L TP-LINK. The TP-LINK ER7206 wireguard VPN configuration suffers from an input validation vulnerability that can be exploited by a remote attacker to submit a special request that can be used in an application context to execute...

PHPEMS Deserialization Vulnerability

PHPEMS is a PHP online mock exam system. PHPEMS suffers from a deserialization vulnerability that stems from unsafe deserialization processing of lib/session.cls.php when receiving serialized data submitted by a user, which can be exploited by an attacker to cause code execution...

Rockwell Automation FactoryTalk Services Platform Authorization Issue Vulnerability

Rockwell Automation FactoryTalk Services Platform is a suite of services platforms from Rockwell Automation that provides routine services for applications such as diagnostic information, health monitoring and real-time data access. A security vulnerability exists in Rockwell Automation FactoryTa...

Apache Airflow Authorization Problem Vulnerability (CNVD-2023-80561)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow suffers from an authorization issue vulnerability that stems from...

Apache Superset REST API Authorization Issues Vulnerability

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset version 2.1.0 and prior versions suffer from an authorization issue vulnerability that stems from incorrect REST API permissions. An attacker can exploit this vulnerability to cau...

Linux kernel resource management error vulnerability (CNVD-2023-48540)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. The Linux kernel suffers from a resource management error vulnerability that stems from the incorrect handling of per-CPU sequence counts during concurrent iptables rule...

Froxlor Resource Management Error Vulnerability

Froxlor is a set of lightweight server management software from the Froxlor team. A resource management error vulnerability exists in versions of Froxlor prior to 2.0.16 that stems from a failure to properly allocate resources. An attacker can exploit this vulnerability to cause a denial of servi...

Microsoft Exchange Server Remote Code Execution Vulnerability (CNVD-2023-18284)

Microsoft Exchange Server is the United States Microsoft Microsoft company's set of e-mail service program. It provides e-mail access, storage, forwarding, voice mail, e-mail filtering and screening. A remote code execution vulnerability exists in Microsoft Exchange Server. An attacker can exploi...

Adobe InCopy post-release use vulnerability

Adobe InCopy is a text editing software for authoring from Adobe. Adobe InCopy has a use-after-release vulnerability that can be exploited by attackers to bypass mitigations such as ASLR and cause sensitive memory leaks...

ASUS RT-AX82U Denial of Service Vulnerability

The ASUS RT-AX82U is a wireless router from the Chinese company ASUS. A denial of service vulnerability exists in ASUS RT-AX82U version 3.0.0.4.38649674-ge182230, which stems from improper input validation of the cfgserver cmprocessConnDiagPktList opcode of the router configuration service, which...

Google Android elevation of privilege vulnerability (CNVD-2023-18914)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by an attacker to gain elevated privileges on the system...

FlatPress Cross-Site Scripting Vulnerability (CNVD-2023-06527)

FlatPress is a Php-based blogging system from the FlatPress community that does not require database support. A cross-site scripting vulnerability exists in FlatPress, which stems from a problem with an unknown part of the admin/panels/entry/admin.entry.list.php file in the Admin Area component...

Apache Tomcat has an unspecified vulnerability

Apache Tomcat is a lightweight Web application server from the Apache Foundation. Apache Tomcat has a security vulnerability that could be exploited by an attacker to potentially compromise the confidentiality, availability, or integrity of the system. No details of the vulnerability are availabl...

IBM DB2 Denial of Service Vulnerability (CNVD-2022-78139)

IBM DB2 is a relational database management system from International Business Machines IBM of the United States. The system is implemented in UNIX, Linux, IBMi, z/OS, and Windows server versions.A denial-of-service vulnerability exists in IBM DB2 versions 9.7, 10.1, 10.5, 11.1, and 11.5. An...

Zettlr input validation error vulnerability

Zettlr is the most comprehensive editor for professionally editing Markdown files. version 2.3.0 of Zettlr is vulnerable to an input validation error, which stems from the fact that the application has no CSP policy and does not properly validate content before rendering markdown files, which cou...

Apache Dubbo Hession Deserialization Vulnerability

Apache Dubbo is a microservice development framework that provides two key capabilities for RPC communication and microservice governance.Apache Dubbo Hession is vulnerable to deserialization, which can be exploited by attackers to execute arbitrary code on the target server...

Multiple Fortinet products vulnerable to information leakage

Fortinet FortiManager and Fortinet FortiAnalyzer, both from Fortinet, are a centralized network security management platform. Fortinet FortiAnalyzer is a centralized network security reporting solution. The product is mainly used to collect network log data and analyze, report and archive...

Food Ordering Management System SQL Injection Vulnerability

Food Ordering Management System is a food ordering management system from Carlo Montero's personal developer. The Food Ordering Management System is vulnerable to SQL injection, which stems from the lack of validation of external input SQL statements by username, and can be exploited by attackers...

Apple OS Out-of-Bounds Write Vulnerability

iOS is a mobile operating system developed by Apple Inc. iPadOS full name: iPad Operating System is a family of mobile operating systems developed by Apple Inc. based on iOS. mac OS is a set of operating systems developed by Apple to run on the Macintosh series of computers. Apple iOS, iPadOS, an...

Adobe Acrobat Reader Input Validation Error Vulnerability

Adobe Acrobat Reader is a PDF viewer from the American company Audobee Adobe. The software is used to print, sign and annotate PDF. An input validation error vulnerability exists in Adobe Acrobat Reader that stems from improper input validation and can be exploited by an attacker to cause a memor...

TCL LinkHub Mesh Wi-Fi OS Command Injection Vulnerability

TCL LinkHub Mesh Wi-Fi is a router from TCL Corporation.TCL LinkHub Mesh Wi-Fi is vulnerable to an operating system command injection vulnerability that originates in the confsrv ucloudaddnode function and can be exploited by attackers to cause arbitrary command execution...

WordPress plugin Google Maps cross-site request forgery vulnerability

WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin Google Maps 1.2.1 and previous versions have a cross-site request forgery vulnerability, which can be exploited by attacke...

MiniCMS Cross-Site Scripting Vulnerability (CNVD-2022-58395)

MiniCMS is content management system. A cross-site scripting vulnerability exists in MiniCMS version V1.11, which stems from a lack of checksum filtering of user-supplied and output data on the post-edit.php page. An attacker can exploit this vulnerability to execute JavaScript code on the client...

Dominion Voting Systems ImageCast X has an unspecified vulnerability (CNVD-2022-77546)

Dominion Voting Systems ImageCast X is an intuitive and configurable face-to-face voting solution from Dominion Voting Systems, Inc. A security vulnerability exists in Dominion Voting Systems ImageCast X that could be exploited by an attacker to obtain sensitive information and perform privileged...

Oracle E-Business Suite Access Control Error Vulnerability

Oracle Corporation Oracle is the world's largest provider of information management software and services, founded in 1977, headquartered in Redwood shore, California, United States, open to the world oracle certification. Oracle E-Business Suite E-Business Suite is the United States Oracle Oracl...

Apache Tomcat Request Obfuscation Vulnerability

Apache Tomcat is the United States Apache Apache Foundation of a lightweight Web application server. The program implements the Servlet and JavaServer Page JSP support. Apache Tomcat suffers from a request obfuscation vulnerability that stems from the fact that if a Web application sends a...

WordPress plugin Web To Print Shop : uDraw arbitrary file reading vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress plugin Web To Print Shop: An arbitrary file reading vulnerability exists in versions of uDraw prior...

Tyler Technologies Tyler Odyssey信息泄露漏洞

Tyler Technologies Tyler Odyssey is a court and judicial software system from Tyler Technologies, Inc. An information disclosure vulnerability exists in versions of Tyler Technologies Tyler Odyssey prior to 17.1.20, which stems from an insecure direct object reference issue in the platform. An...

Microsoft Power BI Spoofing Vulnerability

Microsoft Power BI is an interactive data visualization software from Microsoft USA that focuses on business intelligence. It is part of the Microsoft Power Platform. A spoofing vulnerability exists in Microsoft Power BI. An attacker can exploit this vulnerability to conduct spoofing attacks...

Siemens TIA Administrator Denial of Service Vulnerability

SIMATIC PCS neo is a distributed control system DCS.TIA Administrator is a web-based framework.Siemens Network Planner SINETPLAN supports you as a planner of PROFINET-based automation systems.TIA Portal is a PC A denial of service vulnerability exists in Siemens TIA Administrator, which can be...

ZoneMinder Cross-Site Scripting Vulnerability (CNVD-2022-57826)

ZoneMinder is an open source video surveillance software system. ZoneMinder 1.32.3 and earlier versions have a cross-site scripting vulnerability that stems from the fact that the program is not properly filtered and can be exploited by remote attackers with the 'newMonitorMethod' parameter to...

ZoneMinder Cross-Site Scripting Vulnerability (CNVD-2022-57841)

ZoneMinder is an open source video surveillance software system. ZoneMinder 1.32.3 and earlier versions have a cross-site scripting vulnerability that stems from the fact that the program is not properly filtered and can be exploited by remote attackers to execute arbitrary HTML or JavaScript cod...

Google Android permission permission and access control issue vulnerability (CNVD-2022-47676)

Google Android is a Linux-based open-source operating system from the U.S. company Google. Google Android is vulnerable to permission and access control issues, which can be exploited by attackers to cause local privilege escalation...

Siemens SINEC NMS Elevation of Privilege Vulnerability

Siemens SINEC NMS is a network management system NMS from Siemens Germany that can be used to centrally monitor, manage, and configure industrial networks with tens of thousands of devices, including security-related areas, 24 hours a day, 7 days a week. The vulnerability could be exploited to...

Expat has an unspecified vulnerability (CNVD-2022-18356)

Expat is a fast streaming XML parser written in C. A security vulnerability exists in Expat prior to 2.4.5, which stems from a lack of certain encoding validations in xmltokimpl.c. No detailed vulnerability details are currently available...

Google Tensorflow has an unspecified vulnerability (CNVD-2022-09901)

Google TensorFlow is an end-to-end open source platform for machine learning from Google Google Inc. Google Tensorflow has a security vulnerability that could be exploited by an attacker to cause a denial of service in the TensorFlow process...

Google Tensorflow Input Validation Error Vulnerability (CNVD-2022-09878)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. Google Tensorflow is vulnerable to an input validation error that could be exploited by an attacker to build a TFLite model that would result in an integer overflow in TfLiteIntArrayCreate...