MindsDB Information Disclosure Vulnerability

MindsDB is an emerging low-code machine learning platform from MindsDB, Inc. An information disclosure vulnerability exists in MindsDB versions prior to 23.11.4.1, which stems from insufficient protection of sensitive information in file.py and can be exploited by an attacker to cause information...

Adobe ColdFusion Cross-Site Scripting Vulnerability (CNVD-2023-100311)

Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. Adobe ColdFusion cross-site scripting vulnerability, the vulnerability stems from the lack of effective...

Apache UIMA Deserialization Vulnerability

Apache UIMA is the United States Apache Apache Foundation, a componentized software architecture. Used to analyze large-volume unstructured information associated with end users. Apache UIMA version 3.5.0 before the existence of a deserialization vulnerability , the vulnerability stems from the...

Apache Airflow Information Disclosure Vulnerability (CNVD-2023-85611)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An information disclosure vulnerability exists in Apache Airflow version 2.7.0 and...

Apache Superset Authorization Issues Vulnerability

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset version 2.1.0 and prior versions have an authorization issue vulnerability that stems from incorrect authorization checks in SQLLab. An attacker can exploit the vulnerability to...

LibreNMS Cross-Site Scripting Vulnerability (CNVD-2023-64109)

LibreNMS is an open source network monitoring system based on PHP and MySQL from the LibreNMS community. The system features customizable alerts, auto-discovery of the network environment and automatic updates. A cross-site scripting vulnerability exists in LibreNMS versions prior to 23.8.0. The...

radare2 buffer overflow vulnerability (CNVD-2023-64112)

radare2 is a set of libraries and tools for working with binary files. A buffer overflow vulnerability exists in radare2 versions prior to 5.9.0, which originates from a boundary error when the program processes untrusted input. A remote attacker could exploit this vulnerability to execute...

Microsoft Azure Arc Elevation of Privilege Vulnerability

Microsoft Azure is a set of open, enterprise-grade cloud computing platforms from the U.S.-based Microsoft. A privilege full vulnerability exists in Microsoft Azure Arc. An attacker can exploit this vulnerability to gain elevated privileges on the system...

Apache Helix Deserialization Vulnerability

Apache Helix is a general-purpose cluster management framework from the Apache USA Foundation for automating the management of partitioning, replication, and distributed resources hosted on clusters of nodes. Apache Helix suffers from a deserialization vulnerability that stems from the ability to...

Milesight UR32L vtysh_ubus toolsh_excute.constprop.1 Functional Command Injection Vulnerability

The Milesight UR32L is a 4G industrial router from China's Milesight. The Milesight UR32L vtyshubus toolshexcute.constprop.1 feature suffers from a command injection vulnerability that can be exploited by an attacker to execute arbitrary commands on the system...

Huawei HarmonyOS and EMUI Buffer Overflow Vulnerability

Huawei HarmonyOS is an operating system from Huawei, a Chinese company. It provides a full-scenario distributed operating system based on a microkernel.Huawei EMUI is a user interface developed by Huawei based on the Android operating system. A buffer overflow vulnerability exists in Huawei...

Huawei HarmonyOS and EMUI Information Disclosure Vulnerability (CNVD-2023-61747)

Huawei HarmonyOS is an operating system from Huawei, a Chinese company. It provides a full-scenario distributed operating system based on a microkernel.Huawei EMUI is a user interface developed by Huawei based on the Android operating system. The Huawei HarmonyOS and EMUI information disclosure...

PHPOK Code Problem Vulnerability

PHPOK is an enterprise building system that supports expansion. PHPOK 5.7.140 version of the code problem vulnerability, the vulnerability stems from the existence of a file upload vulnerability, a remote attacker can use this vulnerability through the upload of the produced zip file to run...

JerryScript vm_loop Function Denial of Service Vulnerability

JerryScript is a lightweight JavaScript engine Jerryscript project . A denial of service vulnerability exists in the JerryScript vmloop function, which can be exploited by an attacker to cause a denial of service...

Google Chrome OS Inputs Code Execution Vulnerability

Google Chrome is a web browser from Google, an American company. A code execution vulnerability exists in Google Chrome OS Inputs, which can be exploited by an attacker to execute arbitrary code or cause a denial of service condition on a system...

Siemens Tecnomatix Plant Simulation Out-of-Bounds Read Vulnerability

Siemens Tecnomatix Plant Simulation is an industrial control device from Siemens, Germany. Using the function of discrete event simulation for production volume analysis and optimization, and thus improve the manufacturing system performance. A security vulnerability exists in versions prior to...

Siemens Tecnomatix Plant Simulation Out-of-Bounds Write Vulnerability (CNVD-2023-18936)

Siemens Tecnomatix Plant Simulation is an industrial control device from Siemens, Germany. Using the function of discrete event simulation for production volume analysis and optimization, and thus improve the manufacturing system performance. An out-of-bounds write vulnerability exists in Siemens...

Huawei HarmonyOS Security Bypass Vulnerability (CNVD-2023-15717)

Huawei HarmonyOS is an operating system from Huawei, a Chinese company that provides a microkernel-based distributed operating system. A security bypass vulnerability exists in Huawei HarmonyOS, which stems from an improper interface permission verification in the application package management...

PbootCMS SQL Injection Vulnerability (CNVD-2023-11247)

PbootCMS is an open source enterprise building content management system CMS using PHP language developed by PbootCMS individual developers. A security vulnerability exists in PbootCMS version 3.0.5. An attacker can exploit the vulnerability to execute arbitrary SQL commands via a specially craft...

F5 BIG-IP HTTP/2 profile denial of service vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A denial of service vulnerability exists in the F5 BIG-IP HTTP/2 profile, when enabling the client HTTP/2 profile and HTTP MR...

SAP Bank Account Management Information Disclosure Vulnerability

SAP Bank Account Management is a bank account management system from SAP. An information disclosure vulnerability exists in the SAP Bank Account Management application, which stems from the fact that when a user clicks on a smart link to navigate to another application, personal data is displayed...

Apache DolphinScheduler Input Validation Error Vulnerability

Apache DolphinScheduler, a distributed DAG visualization-based workflow task scheduling system from the Apache Foundation, is vulnerable to an input validation error in Apache DolphinScheduler, which stems from incorrect validation of the script alert plugin parameter. No detailed vulnerability...

Mozilla Firefox Competition Condition Issue Vulnerability (CNVD-2023-06511)

Mozilla Firefox is an open source Web browser from the Mozilla Foundation in the U.S. Mozilla Firefox is vulnerable to a contention issue that could be exploited by an attacker to gain root privileges and execute arbitrary code to gain privilege escalation...

memos cross-site request forgery vulnerability

memos is an open source hosted memo center with knowledge management and social features. memos versions prior to 0.9.1 are vulnerable to cross-site request forgery. An attacker could exploit this vulnerability to perform cross-site request forgery attacks...

Apache Zeppelin Cross-Site Scripting Vulnerability (CNVD-2022-89420)

Apache Zeppelin is a Web-based open source notebook application from the Apache Foundation that supports interactive data analysis and collaborative documentation. The application supports interactive data analysis and collaborative documentation. versions of Apache Zeppelin prior to 0.8.2 contai...

Mozilla Firefox Memory Corruption Vulnerability (CNVD-2023-05213)

Mozilla Firefox is an open source web browser from the Mozilla Foundation. Mozilla Firefox is vulnerable to a memory corruption vulnerability that could be exploited by remote attackers to submit special web requests and trick users into parsing them, which could crash the application or execute...

SilverStripe Cross-Site Scripting Vulnerability

SilverStripe is New Zealand SilverStripe company's set of open source programming framework and content management system CMS. The system has support for multiple languages , cross-platform and other features . A cross-site scripting vulnerability exists in SilverStripe 4.11 and earlier versions...

Apache Airflow Information Disclosure Vulnerability (CNVD-2022-78863)

Apache Airflow is an open source platform for creating, managing and monitoring workflows from the Apache Foundation. The platform is scalable and dynamically monitored, etc. An information disclosure vulnerability exists in versions prior to Apache Airflow 2.3.1, which stems from the application...

Linux kernel resource management error vulnerability (CNVD-2022-74087)

Linux kernel is the kernel used by the Linux Foundation's open source operating system, Linux. Linux kernel is vulnerable to a memory misreference vulnerability that results from a mix-up in the program's instructions responsible for freeing memory. An attacker could exploit the vulnerability to...

Democritus Project d8s-asns democritus-csv code execution vulnerability

Democritus Project is a collection of simple, effective, modular, well-tested and well-documented features from Democritus. A backdoor vulnerability exists in Democritus Project d8s-asns version 0.1.0, which stems from the presence of a potential code execution package democritus-csv inserted by ...

SAP 3D Visual Enterprise Author .igs Buffer Overflow Vulnerability

SAP 3D Visual Enterprise Author is a desktop application for managing 2D, 3D, animation, video and audio assets from SAP. A buffer overflow vulnerability exists in SAP 3D Visual Enterprise Author version 9, which stems from a lack of proper memory management, and can be exploited by an attacker t...

TP-LINK AX10 Code Injection Vulnerability

TP-LINK AX10 is a router from TP-LINK, China. TP-LINK AX10 version 1.3.1 is vulnerable to a code injection vulnerability, which stems from the ability to execute arbitrary code via a specially crafted backup file. An attacker could use this vulnerability to generate illegal code segments that...

Apache Pulsar Proxy Input Validation Error Vulnerability

Apache Pulsar is an Apache Foundation distributed messaging platform for cloud environments that integrates messaging, storage, and lightweight functional computing. The software supports multi-tenancy, persistent storage, multi-room cross-regional data replication, with strong consistency, high...

Google TensorFlow Input Validation Error Vulnerability (CNVD-2023-10611)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. An input validation error vulnerability exists in Google TensorFlow, which stems from a segmentation error that occurs if QuantizedAdd is given a tensor of non-zero rank mininput or maxinput. An attacke...

Adobe Experience Manager Cross-Site Scripting Vulnerability (CNVD-2022-87164)

Adobe Experience Manager AEM is a content management solution from Adobe that can be used to build websites, mobile applications and forms. Adobe Experience Manager contains a cross-site scripting vulnerability that could be exploited by attackers to execute malicious JavaScript content in the...

Agile Point SQL Injection Vulnerability

Agile Point is Agile Point's solution for automating business processes and workflows and building custom applications, portals and SaaS solutions. Agile Point suffers from a SQL injection vulnerability. The vulnerability stems from the lack of validation of the EncodedData parameter in the...

Jenkins RocketChat Notifier Plugin信息泄露漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.An information disclosure vulnerability...

Huawei WS7200-10 Access Control Error Vulnerability

The Huawei ws7200-10 is a wireless router from the Chinese company Huawei HUAWEI. Huawei WS7200-10 11.0.2.13 suffers from an access control error vulnerability, which stems from a problem with user password authentication, and can be exploited by an attacker on a local area network LAN to obtain ...

LDAP Account Manager Cross-Site Scripting Vulnerability (CNVD-2022-53547)

LDAP Account Manager is a web front-end for managing entries e.g., users, groups, DHCP settings stored in the LDAP directory. cross-site scripting vulnerability exists in LDAP Account Manager LAM versions prior to 8.0, which stems from the fact that if the PHP OpenSSL extension is not installed o...

Flower Denial of Service Vulnerability

Flower is a Web-based, real-time monitoring and management of Celery distributed task queues. A denial of service vulnerability exists in the May 2, 2022 version of Flower and prior versions, which stems from being vulnerable to OAuth authentication bypass. An attacker can use this vulnerability ...

HUAWEI HarmonyOS multi-threaded resource contention vulnerability

HUAWEI HarmonyOS is an operating system from China's Huawei HUAWEI. HUAWEI HarmonyOS 2.0 suffers from a multi-threaded resource contention vulnerability, which stems from the existence of multi-threaded resource contention in the kernel emcom module, and can be exploited by attackers to cause...

WordPress Birthdays Widget plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Birthdays Widget plugin version 1.7.18 and earlier is vulnerable to a cross-site scripting...

Open Automation Software OAS Platform Access Control Error Vulnerability (CNVD-2022-58679)

Open Automation Software OAS Platform is an industrial Internet of Things IoT suite from Open Automation Software, Inc. Open Automation Software OAS Platform V16.00.0121 is vulnerable to an access control error that could be exploited by an attacker to make unauthenticated use of the REST API wit...

Google TensorFlow Input Validation Error Vulnerability (CNVD-2022-44174)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. An input validation error vulnerability exists in TensorFlow versions prior to 2.9.0, 2.8.1, 2.7.2, and 2.6.4, which stems from the fact that tf.rawops.SparseTensorToCSRSparseMatrix does not ful...

Foxit PDF Reader Annotation Remote Code Execution Vulnerability (CNVD-2023-07902)

Foxit PDF Reader is a PDF reader from Foxit China.A remote code execution vulnerability exists in Foxit PDF Reader Annotation, which can be exploited by attackers to execute code in the context of the current process...

Foxit PDF Reader Annotation Remote Code Execution Vulnerability (CNVD-2023-07867)

Foxit PDF Reader is a PDF reader from Foxit China.A remote code execution vulnerability exists in Foxit PDF Reader Annotation, which can be exploited by attackers to execute code in the context of the current process...

Simple Bus Ticket Booking System SQL Injection Vulnerability

Simple Bus Ticket Booking System, a bus ticket booking system, is vulnerable to a SQL injection vulnerability in version 1.0 of Simple Bus Ticket Booking System, which originates in the username and password parameters in /assets/partials/handleLogin.php. and password parameters in...

Directus Cross-Site Scripting Vulnerability (CNVD-2022-81371)

Directus is a live Api and application dashboard. Used to manage Sql database content, a cross-site scripting vulnerability existed prior to Directus version 9.7.0, which stems from the program's lack of data validation filtering of user-supplied data and output. An attacker could exploit this...

showdoc .shtml file upload vulnerability

showdoc is an open source tool for IT teams to share documents online. showdoc versions prior to v2.10.4 are vulnerable to file uploads, which stem from the lack of effective detection of .shtml file extensions in the application's file upload feature. An attacker could use this vulnerability to...

Palo Alto Networks Panorama缓冲区溢出漏洞

Palo Alto Networks Panorama is a solution that supports centralized management and configuration of firewalls from Palo Alto Networks, Inc. A security vulnerability exists in Palo Alto Networks Panorama Tools libpano13 v2.9.20, which stems from an out-of-bounds read in the panoParserFindOLine...