Pluxml Code Injection Vulnerability

Pluxml is a free and open source content management system that does not require a database to work. A remote code execution vulnerability exists in Pluxml version v5.8.7, which can be exploited by an attacker to execute arbitrary code by inserting carefully crafted PHP code into a static page...

Google fscrypt command injection vulnerability

Google Fscrypt is an open source advanced tool from Google, Inc. Google fscrypt is vulnerable to command injection, which can be exploited by attackers to elevate privileges in certain situations...

Jenkins dbCharts Plugin Cross-Site Request Forgery Vulnerability

Jenkins plug-ins are plug-ins that provide appropriate functionality for Jenkins. Jenkins dbCharts Plugin cross-site request forgery vulnerability. The vulnerability allows an attacker to connect to a specified database via JDBC using specified credentials and determine whether a class is availab...

Google Android Access Control Error Vulnerability (CNVD-2022-13209)

Google Android is a Linux-based open source operating system from Google, Inc. A security vulnerability exists in Google Android, which stems from allowing untrusted applications to load arbitrary URLs and local files. No details of the vulnerability are currently available...

Foxit PDF Reader Buffer Overflow Vulnerability (CNVD-2022-13354)

Foxit PDF Reader is a PDF reader. Foxit PDF Reader handles a buffer overflow vulnerability in some Javascript methods, which can be exploited by a remote attacker to submit a special file request and trick the user into parsing it, which can crash the application or execute arbitrary code in the...

Google Tensorflow Buffer Overflow Vulnerability (CNVD-2022-09888)

Google TensorFlow is a set of end-to-end open source platform for machine learning from Google Google Inc. Google TensorFlow has a buffer overflow vulnerability, which stems from the fact that TensorFlow is vulnerable to heap OOB write attacks in er. No detailed vulnerability details are currentl...

Google Tensorflow numeric error vulnerability (CNVD-2022-09879)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A numerical error vulnerability exists in Google Tensorflow, which could be exploited by an attacker to create a TFLite model that triggers a division in the "BiasAndClamp" implementation. The...

Apache Tomcat permission permission and access control issues vulnerability

Apache Tomcat is a lightweight web application server from the Apache Foundation in the United States. The program implements support for Servlet and JavaServer Page JSP. Apache Tomcat is vulnerable to privilege permission and access control issues, and an attacker can bypass Apache Tomcat's...

Apache Karaf path traversal vulnerability

Apache Karaf is an open source, modern, multi-format, lightweight, powerful, OSGI-certified enterprise container that provides many features to help developers and users deploy applications more flexibly.A path traversal vulnerability exists in Apache Karaf. The vulnerability is related to the ob...

Google Chrome Security Feature Issue Vulnerability (CNVD-2022-15139)

Google Chrome is a web browser from Google, Inc. A security feature vulnerability exists in Google Chrome that could be exploited by attackers to bypass site quarantine via crafted HTML pages...

Unspecified Vulnerability in Mitsubishi Electric MC Works64

Mitsubishi Electric MC Works64 is a data acquisition and monitoring system SCADA from Mitsubishi Electric Japan. A security vulnerability exists in the Mitsubishi Electric MC Works64 that originates in ICONICS and the Mitsubishi Electric ICONICS product suite, where the FrameWorX server in the...

Jerryscript has an unspecified vulnerability (CNVD-2022-07248)

JerryScript, a lightweight JavaScript engine from the JerryScript project, has a security vulnerability in Jerryscript version 3.0.0, which stems from a buffer overflow in /jerry-core/ecma/base/ecma-lcache.c in ecma lcachelookup in /jerry-core/ecma/base/ecma-lcache.c. A stack-based buffer overflo...

nanoid information leakage vulnerability

nanoid is a small, secure, URL-friendly, unique string ID generator for JavaScript. nanoid is vulnerable, stemming from nanoid's vulnerability to information exposure via the valueOf function, which allows the last generated id to be reproduced. no details of the vulnerability are currently...

Apache Kylin permission permission and access control issues vulnerability

Apache Kylin is an open source distributed analytic data warehouse from the Apache Foundation. The product mainly provides SQL query interface and multidimensional analysis OLAP on top of Hadoop/Spark. Apache Kylin is vulnerable to permission and access control issues, which stem from the fact th...

mySCADA myPRO Operating System Command Injection Vulnerability

mySCADA myPRO is an HMI/SCADA system designed primarily for the visualization and control of industrial processes. An operating system command injection vulnerability exists in mySCADA myPRO, which can be exploited by an attacker to inject arbitrary operating system commands...

Unspecified Vulnerability in M-Files Web

M-Files Corporation M-Files Web is an intelligent information management platform from M-Files Corporation, USA. It is used to optimally support users in their daily work. A security vulnerability exists in M-Files Web that originates from M-Files Web allowing denial of service via overlapping...

Multiple Siemens products incorrectly zero-terminated vulnerabilities

The Nucleus NET module integrates a range of standards-compliant networking and communications protocols, drivers and utilities to provide full-featured networking support in any embedded device. A security vulnerability exists in several Siemens products, which stems from the DHCP client...

Six Apart Movable Type Command Injection Vulnerability

Six Apart Movable Type is an application from Six Apart, Inc. A command injection vulnerability exists in Six Apart Movable Type due to incorrect input validation in the Movable Type XMLRPC API, which can be exploited by an unauthenticated remote attacker to execute arbitrary operating system...

Eclipse Mosquitto License Issue Vulnerability

Eclipse Mosquitto is a set of open source messaging agent software from the Eclipse Foundation. eclipse Mosquitto has a security vulnerability that stems from the fact that in Eclipse mosquito versions 2.0 through 2.0.11, when using the dynamic security plugin, if a client is unsubscribed from a...

Linux kernel denial-of-service vulnerability (CNVD-2021-60515)

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. Linux kernel is vulnerable due to a null pointer dereference and OOPS flaw in arch/powerpc/perf/core-book3s.c. By sending a constructed perf record command, an authenticated local attacker can exploit th...

Multiple Vulnerabilities in Cisco Small Business RV340 and Cisco Small Business

The Cisco Small Business RV340 and the Cisco Small Business are both products of Cisco, Inc.The Cisco Small Business RV340 is a router. Cisco Small Business RV340 is a router, a hardware device that connects two or more networks and acts as a gateway between networks.Cisco Small Business is a...

Google TensorFlow suffers from an unspecified vulnerability (CNVD-2021-46660)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A security vulnerability exists in TensorFlow 2.4.2,2.3.3,2.2.3,2.1.4, which stems from a lack of validation between the parameters tf.rawops.Conv3DBackprop. This results in a heap buffer...

Unspecified Vulnerability in JerryScript (CNVD-2021-42984)

JerryScript is a lightweight JavaScript engine . A security vulnerability exists in the parserparseobjectinitializer in js-parser-expr.c:3230 in JerryScript version 2.2.0. No details of the vulnerability are provided at this time...

IBM Application Gateway Information Disclosure Vulnerability

IBM Application Gateway is an application gateway from IBM America, Inc. It provides a containerized, secure Web Reverse Proxy that is designed to sit in front of your application and seamlessly add authentication and authorization protection to your application. An information disclosure...

Linux kernel competitive conditions issue vulnerability (CNVD-2021-43551)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel versions prior to 5.5.11 suffer from a contention condition issue vulnerability that stems from an issue found in kmemcacheallocbulk in mm/slub.c. slowpath lacks t...

Teclib GLPI Injection Vulnerability

Teclib GLPI is an open source IT asset management suite from the French company Teclib. The suite includes features such as device status management, asset inventory storage, management processes and work log management. Teclib GLPI has an injection vulnerability. An attacker could exploit this...

Unspecified Vulnerability in Saml2 Authentication services for ASP.NET

Saml2 Authentication services for ASP.NET is a SAML Security Assertion Markup Language authentication service for ASP.NET. A security vulnerability exists in the method of token authentication in Saml2 Authentication services for ASP.NET versions 1.0.2 and 2.0.0 through 2.6.0. An attacker could...

Apache HTTP Server Input Validation Error Vulnerability

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. An input validation error vulnerability exists in Apache HTTP Server versions 2.4.0 through 2.4.41. The vulnerability arises from ...

Kiali Trust Management Issues Vulnerabilities

Kiali is an open source, visual management tool for the Istio microservices architecture. A trust management issue vulnerability exists in the default configuration file in versions of Kiali prior to 1.15.1. The vulnerability stems from the fact that the file comes with a hard-coded encryption ke...

Rumpus FTP Web File Manager Cross-Site Scripting Vulnerability

Rumpus FTP Web File Manager is a file transfer server. A cross-site scripting vulnerability exists in the login page in Rumpus FTP Web File Manager version 8.2.9.1. The vulnerability stems from a lack of proper validation of client data by the web application. An attacker can exploit this...

WordPress Cross-Site Scripting Vulnerability (CNVD-2019-31831)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress has a cross-site scripting vulnerability that can be exploited by attackers to execute client-side...

Xpdf heap buffer overflow vulnerability (CNVD-2019-21456)

Xpdf is an open source PDF reader from Foo Labs. The product supports decoding LZW compressed format files and read encrypted PDF files. A buffer overflow vulnerability exists in the SampledFunction::transform of the Function.cc file in Xpdf version 4.01.01. The vulnerability originates when a...

Mathias Kettner Check_MK Information Disclosure Vulnerability

Mathias Kettner CheckMK is an open-source, general-purpose Nagios/Icinga monitoring system data collection plug-in from Mathias Kettner, Germany, which collects data from operating system and network components by employing a new methodology and supports the automated detection of monitoring item...

CloudBees Jenkins Cross-Site Scripting Vulnerability (CNVD-2015-07821)

CloudBees Jenkins is the open source continuous integration server. A cross-site scripting vulnerability exists in CloudBees Jenkins 1.638, LTS versions prior to 1.625.2, in the slave overview page, where a remote user with certain privileges can inject web script or HTML via a slave offline stat...

Apple macOS Denial of Service Vulnerability (CNVD-2026-19032)

Apple macOS is a specialized operating system developed by Apple for Mac computers. A denial of service vulnerability exists in Apple macOS, which can be exploited by an attacker to cause an application to cause an unexpected system termination...

TOTOLINK A3100R setParentalRules function buffer overflow vulnerability

TOTOLINK A3100R is a series of wireless routers from China's Gion Electronics TOTOLINK. TOTOLINK A3100R suffers from a buffer overflow vulnerability that stems from the urlKeyword parameter in setParentalRules failing to correctly validate the length size of the input data, no details of the...

Adobe Commerce Security Bypass Vulnerability (CNVD-2025-03630)

Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. A security bypass vulnerability exists in Adobe Commerce, which can be exploited by an attacker to cause a security feature bypass...

TP-LINK ER7206 wireguard VPN Command Injection Vulnerability

The TP-LINK ER7206 is a multi-function Gigabit router from China P&L TP-LINK. The TP-LINK ER7206 wireguard VPN configuration suffers from an input validation vulnerability that can be exploited by a remote attacker to submit a special request that can be used in an application context to execute...

Google Chrome WebRTC Module Memory Misreference Vulnerability

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in the Google Chrome WebRTC module, which stems from a confusion in the instructions responsible for freeing memory in the WebRTC module. An attacker can exploit this vulnerability to execu...

Google Chrome Security Bypass Vulnerability (CNVD-2024-10241)

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome version 121.0.6167.85 and earlier versions due to an improper implementation in an accessibility feature. An attacker can exploit the vulnerability to bypass security...

Apache Tomcat Open Redirect Vulnerability (CNVD-2023-80565)

Apache Tomcat is the United States Apache Apache Foundation of a lightweight Web application server. The program implements the Servlet and JavaServer Page JSP support. An open redirection vulnerability exists in Apache Tomcat, which stems from the FORM authentication feature not handling target...

PrestaShop path traversal vulnerability (CNVD-2023-64630)

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. A path traversal vulnerability exists in PrestaShop versions prior to 8.1.1, which...

Apache Helix Deserialization Vulnerability

Apache Helix is a general-purpose cluster management framework from the Apache USA Foundation for automating the management of partitioning, replication, and distributed resources hosted on clusters of nodes. Apache Helix suffers from a deserialization vulnerability that stems from the ability to...

Siemens Tecnomatix Plant Simulation Stack Buffer Overflow Vulnerability (CNVD-2023-56536)

Siemens Tecnomatix Plant Simulation is an industrial control device from Siemens, Germany, that uses discrete-event simulation to analyze and optimize throughput and thereby improve manufacturing system performance. Siemens Tecnomatix Plant Simulation suffers from a stack buffer overflow...

Gitea Input Validation Error Vulnerability (CNVD-2023-60472)

Gitea is a lightweight Go-based git service developed by the Gitea community. An input validation error vulnerability exists in Gitea versions prior to 1.19.4, which stems from improper input validation of the program. An attacker can exploit this vulnerability to obtain sensitive information...

Unspecified Vulnerability in Oracle MySQL Server (CNVD-2023-65514)

Oracle MySQL Server is a relational database from Oracle Corporation. Oracle MySQL Server has a security vulnerability that can be exploited by attackers to cause a takeover of MySQL Server...

IBM Aspera Faspex Deserialization Vulnerability

IBM Aspera is an IBM FASP protocol-based fast file transfer and streaming solution from International Business Machines IBM. IBM Aspera Faspex version 4.4.2 Patch Level 1 and prior versions contain a deserialization vulnerability that stems from a YAML deserialization flaw. An attacker could use...

Siemens SINEC INS Path Traversal Vulnerability (CNVD-2023-02707)

SINEC INS Infrastructure Network Services is a web-based application that combines various network services in a single tool. This simplifies the installation and management of all network services related to industrial networks.A path traversal vulnerability exists in Siemens SINEC INS, which...

Apache Airflow OS Command Injection Vulnerability (CNVD-2022-83588)

Apache Airflow is an open source platform for creating, managing, and monitoring workflows from the Apache Foundation. The platform features scalable and dynamic monitoring. Apache Airflow is vulnerable to an operating system command injection vulnerability, which stems from an improper...

Billing System Project getOrderReport.php SQL Injection Vulnerability

Billing System Project is a billing system project by Mayuri K. Individual developer. Billing System Project v1.0 suffers from a SQL injection vulnerability that stems from a lack of validation of the endDate parameter in getOrderReport.php against an externally entered SQL statement. An attacker...