Microsoft Power BI Spoofing Vulnerability

Microsoft Power BI is an interactive data visualization software from Microsoft USA that focuses on business intelligence. It is part of the Microsoft Power Platform. A spoofing vulnerability exists in Microsoft Power BI. An attacker can exploit this vulnerability to conduct spoofing attacks...

Siemens TIA Administrator Denial of Service Vulnerability

SIMATIC PCS neo is a distributed control system DCS.TIA Administrator is a web-based framework.Siemens Network Planner SINETPLAN supports you as a planner of PROFINET-based automation systems.TIA Portal is a PC A denial of service vulnerability exists in Siemens TIA Administrator, which can be...

ZoneMinder Cross-Site Scripting Vulnerability (CNVD-2022-57826)

ZoneMinder is an open source video surveillance software system. ZoneMinder 1.32.3 and earlier versions have a cross-site scripting vulnerability that stems from the fact that the program is not properly filtered and can be exploited by remote attackers with the 'newMonitorMethod' parameter to...

ZoneMinder Cross-Site Scripting Vulnerability (CNVD-2022-57841)

ZoneMinder is an open source video surveillance software system. ZoneMinder 1.32.3 and earlier versions have a cross-site scripting vulnerability that stems from the fact that the program is not properly filtered and can be exploited by remote attackers to execute arbitrary HTML or JavaScript cod...

Google Android permission permission and access control issue vulnerability (CNVD-2022-47676)

Google Android is a Linux-based open-source operating system from the U.S. company Google. Google Android is vulnerable to permission and access control issues, which can be exploited by attackers to cause local privilege escalation...

Siemens SINEC NMS Elevation of Privilege Vulnerability

Siemens SINEC NMS is a network management system NMS from Siemens Germany that can be used to centrally monitor, manage, and configure industrial networks with tens of thousands of devices, including security-related areas, 24 hours a day, 7 days a week. The vulnerability could be exploited to...

Google Tensorflow has an unspecified vulnerability (CNVD-2022-09901)

Google TensorFlow is an end-to-end open source platform for machine learning from Google Google Inc. Google Tensorflow has a security vulnerability that could be exploited by an attacker to cause a denial of service in the TensorFlow process...

Google Tensorflow Input Validation Error Vulnerability (CNVD-2022-09878)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. Google Tensorflow is vulnerable to an input validation error that could be exploited by an attacker to build a TFLite model that would result in an integer overflow in TfLiteIntArrayCreate...

Denial of Service Vulnerability in Multiple Siemens Industrial Products (CNVD-2022-10002)

SIMATIC Drive Controller family products are machines designed for production automation, combining the functionality of the SIMATIC S7-1500 CPU and the SINAMICS S120 drive control.SIMATIC S7-1200 CPU family products are designed for discrete and continuous control in industrial environments such...

PrinterLogic Web Stack Insecure Direct Object Reference (IDOR) Vulnerability (CNVD-2022-11105)

PrinterLogic Web Stack PrinterLogic Printer Installer is a native Web application from PrinterLogic, Inc. It enables the It department to manage and automatically create/propagate PrinterObjects and printer drivers across print environments from a single management console. PrinterLogic Web Stack...

Oracle MySQL Cluster Input Validation Error Vulnerability (CNVD-2022-07926)

Oracle MySQL Cluster is a write-scalable, real-time, ACID-compatible transactional database developed by Oracle Corporation USA. Oracle MySQL Cluster is vulnerable to an input validation error, which can be exploited by attackers to corrupt or delete data...

Caldera Arbitrary Code Execution Vulnerability

Caldera is a suite of software from the French company Caldera that provides color management, imaging and processing solutions for printer devices. An arbitrary code execution vulnerability exists in Caldera version 2.8.1. The vulnerability stems from the Human plugin passing an unfiltered name...

OnionShare has an unspecified vulnerability (CNVD-2022-06476)

OnionShare is an open source tool for securely and anonymously sharing files, hosting websites, and chatting with friends using the Tor network. Used to securely and anonymously share files, host websites, and chat with friends using the Tor network, OnionShare has a security vulnerability that...

Discourse has an unspecified vulnerability (CNVD-2022-05505)

Discourse is an open source community discussion platform that includes community, email, and chat room features. A security vulnerability exists in Discourse, which stems from the fact that users invited via email to a forum with "must approve users" enabled will automatically log in, bypassing...

Apache Kylin permission permission and access control issues vulnerability

Apache Kylin is an open source distributed analytic data warehouse from the Apache Foundation. The product mainly provides SQL query interface and multidimensional analysis OLAP on top of Hadoop/Spark. Apache Kylin is vulnerable to permission and access control issues, which stem from the fact th...

gif2apng buffer overflow vulnerability

gif2apng is a simple program that converts animations from GIF to APNG format. gif2apng suffers from a buffer overflow vulnerability that stems from an incorrect while loop in the product code, which can be exploited by an attacker to cause a buffer overflow...

Unspecified vulnerability in Rust bronzedb-protocol crate

Rust bronzedb-protocol crate is browndb is a kv database. It is a re-export crate. a security vulnerability exists in Rust bronzedb-protocol crate, which stems from the fact that ReadKVExt can read data from an uninitialized memory location. No detailed vulnerability details are available at this...

mySCADA myPRO Operating System Command Injection Vulnerability

mySCADA myPRO is an HMI/SCADA system designed primarily for the visualization and control of industrial processes. An operating system command injection vulnerability exists in mySCADA myPRO, which can be exploited by an attacker to inject arbitrary operating system commands...

JT2Go and Teamcenter Visualization File Parsing Vulnerability (CNVD-2021-100365)

JT2Go, a 3D JT viewing tool, and Teamcenter Visualization software enable companies to enhance their Product Lifecycle Management PLM environments with a comprehensive family of visualization solutions. The software allows business users to access documents, 2D drawings and 3D models in a single...

WordPress Booking.com Banner Creator Plugin Cross-Site Scripting Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Booking.com Banner Creator plugin in version 1.4....

Apache Superset Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability exists in Apache Superset, a data visualization and data exploration platform from the Apache Foundation, U.S. The vulnerability stems from insufficient cleanup of user-supplied data on browser pages. An attacker could exploit the vulnerability to trick victim...

Adobe Photoshop Elements out-of-bounds write vulnerability

Adobe Photoshop Elements is a new image editing, photo retouching, and Web graphics solution from Adobe following Photoshop. Adobe Photoshop Elements 2021 build 19.0 and earlier versions contain an out-of-bounds write vulnerability that could be exploited by attackers to execute arbitrary code...

Apache Airflow Licensing Issue Vulnerability (CNVD-2022-62076)

Apache Airflow is an open source platform for creating, managing, and monitoring workflows from the Apache Foundation. The platform is scalable and dynamically monitored. Apache Airflow is vulnerable to an authorization issue that stems from a lack of authorization protection on the product's...

LibreNMS Cross-Site Scripting Vulnerability (CNVD-2021-93896)

LibreNMS is a PHP/MYSQL/SNMP-based open source monitoring tool. a stored cross-site scripting vulnerability exists in API access pages in versions of LibreNMS prior to 21.3.0. The vulnerability stems from insufficient validation of the $api-description variable. An attacker could use this...

Bento4 Heap Buffer Overflow Vulnerability

Bento4 is an open source C library for reading and writing MP4 files. Bento4 suffers from a heap buffer overflow vulnerability, which stems from a lack of proper boundary checking in the AP4StdcFileByteStream :: ReadPartial component of /StdC/Ap4StdCFileByteStream.cpp. An attacker could exploit...

WordPress Astra Pro Addon Plugin SQL Injection Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in WordPress Astra Pro Addon Plugin versions prior to 3.5.2, which stems...

Linux kernel denial-of-service vulnerability (CNVD-2021-60517)

Linux kernel is the kernel used by the Linux Foundation's open source operating system, Linux. Linux kernel is vulnerable due to an out-of-bounds access to xdrsetpagebase in net/sunrpc/xdr.c. By executing many NFS 4.2 READPLUS operations, a remote attacker could exploit this vulnerability to atta...

Liferay Portal and Liferay DXP code issue vulnerability

Liferay Portal and Liferay DXP are both products of Liferay, a J2EE-based portal solution that uses EJB and JMS technologies and serves as a web publishing and shared workspace, enterprise collaboration platform, social network, etc. Liferay DXP is a digital experience collaboration platform...

Corel Parallels Desktop Elevation of Privilege Vulnerability

A security vulnerability exists in Corel Parallels Desktop Toolgate, a suite of virtual machine software for the macOS platform from Corel Canada, stemming from uncontrolled memory allocation in the Toolgate component. An attacker could exploit the vulnerability to escalate privileges in the...

Nexus Control Panel Elevation of Privilege Vulnerability

Swisslog Healthcare Nexus Panel is a medical device from Swisslog Healthcare.An elevation of privilege vulnerability exists in versions prior to Nexus Control Panel 7.2.5.7. An attacker could exploit this vulnerability to gain root access to the device, which would allow access to all device...

Delta Electronics DIAScreen Buffer Overflow Vulnerability

A buffer overflow vulnerability exists in Delta Electronics DIAScreen, a smartphone builder from Delta Electronics, Taiwan, China, which stems from the vulnerability of DIAScreen to out-of-bounds write conditions. An attacker could exploit the vulnerability to cause a system crash or remote...

WordPress WooCommerce Blocks SQL plugin injection vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers.WooCommerce Blocks plugin is a WordPress open source application plugin.WooCommerce Blocks feature plugin version...

Advantech R-SeeNet telnet_form.php Cross-Site Scripting Vulnerability

Advantech R-SeeNet is an industrial monitoring software from Advantech Taiwan, China. The software is based on the snmp protocol for monitoring platforms and is available for Linux and Windows platforms.Advantech R-SeeNet telnetform.php in v2.4.12 contains a cross-site scripting vulnerability tha...

Apollos Apps licensing issue vulnerability

Apollos Apps is an open source platform for distributing church-related applications. Apollos Apps suffers from an authorization issue vulnerability that stems from the fact that new user registrations only need to know basic personal information about anyone name, birthday, gender, etc. in order...

Envoy integer overflow vulnerability

Envoy is an open source distributed proxy server. versions prior to Envoy 1.71.1 are vulnerable to integer overflow, which can be exploited by an attacker with an excessive grpc-timeout value to cause an unexpected timeout calculation...

Command Execution Vulnerability in VoIPmonitor

VoIPmonitor is an open source network packet sniffer with a commercial front-end for SIP RTP and RTCP VoIP protocols running on Linux. VoIPmonitor suffers from a command execution vulnerability that can be exploited by an attacker to gain control of the server...

SiCKRAGE Cross-Site Scripting Vulnerability

SickRage is an automated video library manager for TV programs. A reflected cross-site scripting vulnerability exists in SiCKRAGE versions 9.3.54.dev1 - 10.0.11.dev1. The vulnerability stems from the quicksearch feature not properly validating user input. An attacker can use this vulnerability to...

Linux kernel input validation error vulnerability (CNVD-2021-21917)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from an input validation error vulnerability that can be exploited by attackers to cause users to crash their systems or potentially escalate their...

Cisco NX-OS Denial of Service Vulnerability (CNVD-2021-12829)

Cisco NX-OS is the network operating system for the Cisco Nexus family of Ethernet switches and the MDS family of Fibre Channel storage area network switches. A denial of service vulnerability exists in the Protocol Independent Multicast PIM feature of the Cisco NX-OS, which can be exploited by a...

SmartFoxServer Code Injection Vulnerability

SmartFoxServer is a software development program for rapid development of multiplayer games and applications via Adobe Flash/Flex/Air, Unity, HTML5, iOS, Universal Windows Platform, Android, Java, C ++, etc. SmartFoxServer is a software development program from SmartFoxServer, USA. The software...

phpMyAdmin SQL Injection Vulnerability (CNVD-2021-45286)

phpMyAdmin is a PHP written, Web-based MySQL and MariaDB open source management tools. A SQL injection vulnerability exists in SearchController in phpMyAdmin. An attacker can exploit this vulnerability to inject malicious SQL into queries...

D-Link DCS-2530L and DCS-2670L Information Disclosure Vulnerability

The DCS-2530L and DCS-2670L are Full HD 180-degree Wi-Fi cameras from D-Link. A security vulnerability exists in cgi-bin/ddnsenc.cgi in the D-Link DCS-2530L and DCS-2670L. An attacker can exploit this vulnerability to obtain the administrator password via the /config/getuser endpoint...

PuTTY Information Disclosure Vulnerability

PuTTY is a suite of free Telnet, Rlogin and SSH client software from Simon Tatham Software Developers. The software is primarily used for remote administration of Linux systems. A security vulnerability exists in PuTTY versions 0.68 through 0.73. An attacker could exploit the vulnerability to...

NVIDIA Virtual GPU Manager and guest drivers vGPU input validation error vulnerability

NVIDIA Virtual GPU Manager is an NVIDIA virtual GPU management software from NVIDIA. vGPU is one of the virtual FPU components. An input validation error vulnerability exists in NVIDIA Virtual GPU Manager and guest drivers vGPU plug-in, which can be exploited by an attacker to elevate privileges...

jQuery cross-site scripting vulnerability (CNVD-2021-28270)

jQuery is the United States John Resig programmer of a set of open source , cross-browser JavaScript library . The library simplifies the operation between HTML and JavaScript , and has a modular , plug-in extensions and other features . A cross-site scripting vulnerability exists in versions of...

Sonatype Nexus Repository Manager Command Execution Vulnerability (CNVD-2020-28477)

Sonatype Nexus Repository Manager NXRM is a Maven repository manager from Sonatype USA. A command execution vulnerability exists in Sonatype Nexus Repository Manager. An attacker can exploit this vulnerability to execute arbitrary code with the help of a malicious request...

Ignite Realtime Openfire Cross-Site Scripting Vulnerability (CNVD-2020-18551)

Ignite Realtime Openfire is a real-time collaboration RTC server licensed under the open source Apache license. A cross-site scripting vulnerability exists in Ignite Realtime Openfire 4.4.1. An attacker can exploit this vulnerability to conduct a cross-site scripting attack via the...

rack-cors gem for Ruby directory traversal vulnerability

rack-cors is Rack middleware for handling cross-domain resource sharing CORS. A directory traversal vulnerability in the rack-cors gem for Ruby prior to version 1.0.4, which stems from resource matching failing to ensure that pathnames are in a canonical format, can be exploited by an attacker to...

nfdump Integer Overflow Vulnerability

nfdump is a toolset for collecting and processing netflow and sflow data sent by netflow/sflow compatible devices. An integer overflow vulnerability in the Processipfixtemplatewithdraw function in ipfix.c in nfdump 1.6.17 and earlier can be exploited by a remote attacker to cause the process to...

Cobbler Cross-Site Scripting Vulnerability

Cobbler is a network installation server suite that makes it possible to quickly set up a Linux network installation environment. A cross-site scripting vulnerability exists in cobbler-web in Cobbler 2.0.0+ and prior versions. A remote attacker can exploit this vulnerability by sending an...