IBM Security Verify Governance Cross-Site Scripting Vulnerability

IBM Security Verify Governance is an identity and access management solution provided by IBM. It is a software system for managing and monitoring user identities, permissions and access. A cross-site scripting vulnerability exists in IBM Security Verify Governance, which can be exploited by an...

SAP PowerDesigner Input Validation Error Vulnerability

SAP PowerDesigner is a database design software from SAP Germany. An input validation error vulnerability exists in SAP PowerDesigner version 16.7, which stems from an inability to adequately validate a BPMN2 XML document imported from an untrusted source. An attacker could exploit this...

ASUS RT-AC86U Command Injection Vulnerability (CNVD-2023-70091)

RT-AC86U is an ASUS router with 2900M wireless rate, external antenna, and Gigabit LAN port for WAN access.RT-AC86U integrates ASUS AiProtection, which is equipped with Trend Micro's enterprise-grade network security for smart home networks, even if the connected device does not have anti-virus...

Apache Helix Deserialization Vulnerability

Apache Helix is a general-purpose cluster management framework from the Apache USA Foundation for automating the management of partitioning, replication, and distributed resources hosted on clusters of nodes. Apache Helix suffers from a deserialization vulnerability that stems from the ability to...

Siemens Tecnomatix Plant Simulation Stack Buffer Overflow Vulnerability (CNVD-2023-56536)

Siemens Tecnomatix Plant Simulation is an industrial control device from Siemens, Germany, that uses discrete-event simulation to analyze and optimize throughput and thereby improve manufacturing system performance. Siemens Tecnomatix Plant Simulation suffers from a stack buffer overflow...

Milesight UR32L set_openvpn_client function buffer overflow vulnerability (CNVD-2023-65481)

The Milesight UR32L is a 4G industrial router from China's Milesight. A buffer overflow vulnerability exists in the Milesight UR32L setopenvpnclient function, which can be exploited by an attacker to cause a buffer overflow and execute arbitrary code on the system, or cause an application to cras...

Apache Traffic Server Information Disclosure Vulnerability (CNVD-2023-71727)

Apache Traffic Server ATS is the United States Apache Apache Foundation's set of scalable HTTP proxy and caching server. Apache Traffic Server suffers from an information disclosure vulnerability that originates when the server exposes sensitive information to unauthorized participants. An attack...

JerryScript parser_parse_function_arguments function denial of service vulnerability

JerryScript is a lightweight JavaScript engine Jerryscript project . A denial of service vulnerability exists in the JerryScript parserparsefunctionarguments function, which can be exploited by an attacker to cause a denial of service...

Apache Linkis Code Execution Vulnerability (CNVD-2023-80566)

Apache Linkis is a library of the U.S. Apache Apache Foundation. Helps to easily connect various backend compute/storage engines. A code execution vulnerability exists in Apache Linkis 1.3.1 and earlier versions, which stems from a lack of valid filtered parameters, and can be exploited by an...

Fortinet FortiWeb Path Traversal Vulnerability (CNVD-2023-18293)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. A path traversal vulnerability exists that...

IBM AIX Denial of Service Vulnerability (CNVD-2023-00807)

IBM AIX is an open standards-based UNIX operating system developed by International Business Machines IBM for the IBM Power architecture. IBM AIX suffers from a denial-of-service vulnerability that can be exploited by unprivileged local attackers to cause a denial of service...

Siemens SCALANCE X-200RNA Switch Devices has an unspecified vulnerability

The SCALANCE X-204RNA Industrial Ethernet Access Point enables non-PRP endpoint devices to connect to a separate parallel network as needed.A security vulnerability exists in Siemens SCALANCE X-200RNA Switch Devices due to the web server of the affected device calculating session IDs and random...

APsystems Access Control Error Vulnerability

APsystems is a microinverter from APsystems, Inc. Combining high efficiency power conversion with a user-friendly monitoring interface, it brings you reliable and smart energy. An access control error vulnerability exists in APsystems ENERGY COMMUNICATION UNIT ECU-C Power Control Software version...

Insyde InsydeH2O Buffer Overflow Vulnerability

Insyde InsydeH2O is a C language source from Insyde Taiwan, China that implements the new technology "EFI/UEFI" specification, designed to replace the traditional BIOS Basic Input/Output System. Insyde A buffer overflow vulnerability exists in InsydeH2O 5.0 and later, 5.5 and earlier versions,...

Silverstripe framework cross-site scripting vulnerability

Silverstripe framework is an application from Silverstripe New Zealand. Empowering powerful digital teams by creating a platform for digital change. silverstripe framework 4.10.0 and previous versions contain a cross-site scripting vulnerability that stems from the use of jQuery 1.7.2, which is...

Google TensorFlow buffer overflow vulnerability (CNVD-2022-80680)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A buffer overflow vulnerability exists in Google TensorFlow, which stems from tf.rawops.ResizeNearestNeighborGrad's lack of length size validation of the input data. validation, an attacker could exploi...

Siemens syngo Dynamics server-side request forgery vulnerability

Siemens syngo Dynamics is a cardiovascular imaging and information solution from Siemens, Germany. Designed to be a centralized digital hub for complete cardiovascular services, Siemens syngo Dynamics is vulnerable to server-side request forgery, which can be exploited by attackers to cause NTLM ...

IBM PowerVM Hypervisor Misconfiguration Vulnerability

IBM PowerVM Hypervisor is an application from International Business Machines IBM, Inc. Providing a secure and scalable virtualized environment, these applications are built on the advanced RAS capabilities and leading performance of the Power Systems platform. A misconfiguration vulnerability...

Aruba Networks ArubaOS Buffer Overflow Vulnerability (CNVD-2022-75544)

Aruba Networks ArubaOS, an operating system for Aruba Mobility-Defined Networks including mobile controllers and mobile access switches from Aruba Networks, is vulnerable to a buffer overflow vulnerability. An attacker could exploit this vulnerability to cause unauthenticated remote code executio...

Dell GeoDrive DLL Hijacking Vulnerability

Dell GeoDrive is a free application from Dell Inc. It provides access to Dell EMC ECS and Atmos storage from Microsoft Windows desktops and servers. A DLL hijacking vulnerability exists in Dell GeoDrive versions prior to 2.2.3, which can be exploited by an attacker to execute arbitrary code on a...

Patrik Dufresne Rdiffweb user redirection vulnerability

Patrik Dufresne Rdiffweb is a web application from the personal developer Patrik Dufresne, USA. Patrik Dufresne Rdiffweb is vulnerable to a user redirection vulnerability, which stems from the fact that the system does not handle target bounces properly and can be exploited to inject malicious...

Zinc delete user function cross-site scripting vulnerability

Zinc is a full-text indexing search engine open sourced by Zinc Labs. Zinc v0.1.9 and later, v0.3.1 and earlier versions have a cross-site scripting vulnerability that could be exploited by attackers to obtain sensitive information such as user credentials...

Apache Airflow Licensing Issue Vulnerability (CNVD-2022-76236)

Apache Airflow is the Apache Foundation's open source platform for creating, managing, and monitoring workflows. A security vulnerability exists in Apache Airflow versions 2.2.4 to 2.3.3, which stems from the vulnerability of the "database" web server session backend to session fixation. No detai...

Siemens Teamcenter Command Injection Vulnerability

Teamcenter software is a modern, adaptable product lifecycle management PLM system that connects people and processes across functional silos through digital threads to enable innovation.Siemens Teamcenter is vulnerable to a command injection vulnerability that could be exploited by attackers to...

Apple iOS and iPadOS GPU Driver Buffer Overflow Vulnerability

Apple iOS and Apple iPadOS are both products of Apple Inc. Apple iOS is an operating system developed for mobile devices.Apple iPadOS is an operating system for the iPad tablet computer. A buffer overflow vulnerability exists in iOS and iPadOS, which originates from a boundary error in the GPU...

Siemens PADS Standard/Plus Viewer越界读取漏洞

PADS Standard and Standard Plus provide PCB schematic design and layout functionality in an intuitive and easy-to-use environment.An out-of-bounds read vulnerability exists in Siemens PADS Standard/Plus Viewer, which could be exploited by an attacker to execute code in the context of the current...

Annotation Tool path traversal vulnerability

Annotation Tool is a Bonn activity map annotation tool open sourced by bonn-activity-maps. 2021-08-31 and earlier versions of Annotation Tool are vulnerable to a path traversal vulnerability that stems from a failure of Flask's sendfile function to properly filter special elements in a resource o...

EQS Integrity Line Cross-Site Scripting Vulnerability

EQS Integrity Line is a secure and anonymous reporting software from EQS Germany. EQS Integrity Line suffers from a cross-site scripting vulnerability that can be exploited by an attacker to execute JavaScript code on the client side...

VICIdial Cross-Site Scripting Vulnerability

Vicidial is a software suite from Vicidial, Inc. Designed to interact with the Asterisk open source Pbx phone system as a complete inbound/outbound contact center suite with inbound email support. A cross-site scripting vulnerability exists in VICIdial versions prior to 2.14b0.5, which stems from...

Multiple Dahua Products Denial of Service Vulnerabilities

Dahua IPC-HFW2XXX is a series of IP cameras, Dahua IPC-HDBW2XXX is a series of cameras, Dahua ASI7XXXX is a series of face recognition access controllers, and Dahua IPC-HFW2XXX is a series of IP cameras. A denial of service vulnerability exists in several Dahua products, which could be exploited ...

Mozilla Firefox Input Validation Error Vulnerability (CNVD-2023-68216)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. The input validation error vulnerability exists in Mozilla Firefox due to a lack of restriction and filtering of extensions in the drag-and-drop image feature. The vulnerability can be exploited to...

74cms Cross-Site Scripting Vulnerability (CNVD-2022-58892)

74cms is a PHP and MySQL-based online recruitment system from China Xunyi Technology. 74cms version v3.5.1 suffers from a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied and output data in path/company. An attacker could exploit the...

FFmpeg Buffer Overflow Vulnerability (CNVD-2022-62522)

FFmpeg is the Ffmpeg team's complete solution for recording, converting, and streaming audio and video. FFmpeg version 2.0 has a security vulnerability that could be exploited by attackers to cause a denial of service attack...

WordPress Simple Membership plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in versions of the WordPress Simple Membership plugin prior to...

WordPress plugin CP Image Store with Slideshow SQL Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The WordPress plugin is an application plugin. The WordPress plugin CP Image Store with Slideshow version 1.0.68 has a SQL injection...

Elitecms SQL Injection Vulnerability

Elitecms is a web content management from elitecms India. elitecms version 1.01 is vulnerable to SQL injection, which originates from admin/editsidebar.php?page=2 & sidebar The page sidebar parameter lacks validation for external input SQL statements, and an attacker could exploit the vulnerabili...

Mattermost Resource Management Error Vulnerability (CNVD-2022-65349)

Mattermost is an open source collaboration platform from Mattermost, Inc. A resource management error vulnerability exists in versions prior to Mattermost 6.6.0, which stems from uncontrolled consumption of resources and can be exploited by an attacker to crash the server via a specially crafted...

Open Automation Software OAS Platform Access Control Error Vulnerability (CNVD-2022-58679)

Open Automation Software OAS Platform is an industrial Internet of Things IoT suite from Open Automation Software, Inc. Open Automation Software OAS Platform V16.00.0121 is vulnerable to an access control error that could be exploited by an attacker to make unauthenticated use of the REST API wit...

ZKEACMS Cross-Site Scripting Vulnerability

ZKEACMS v3.5.2 is a cross-site scripting vulnerability that can be exploited by attackers to inject malicious JavaScript programs to steal other users' cookies, etc...

HUAWEI HarmonyOS Information Disclosure Vulnerability (CNVD-2022-50634)

HUAWEI HarmonyOS is an operating system from the Chinese company Huawei HUAWEI. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in the HUAWEI HarmonyOS security component, which stems from a serial number capture vulnerability in th...

F5 BIG-IP iControl SOAP Directory Traversal Vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, and remote access policy management. A directory traversal vulnerability exists in F5 BIG-IP iControl SOAP, which can be exploited by an attacker to send a crafted...

Linux kernel resource management error vulnerability (CNVD-2022-31767)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A resource management error vulnerability exists in versions of Linux kernel prior to 5.17.1, which stems from the fact that jbd2journalwaitupdates in fs/jbd2/transaction.c has...

Tyler Technologies Tyler Odyssey信息泄露漏洞

Tyler Technologies Tyler Odyssey is a court and judicial software system from Tyler Technologies, Inc. An information disclosure vulnerability exists in versions of Tyler Technologies Tyler Odyssey prior to 17.1.20, which stems from an insecure direct object reference issue in the platform. An...

Microsoft Windows Kernel Information Disclosure Vulnerability (CNVD-2022-65612)

The Microsoft Windows Kernel is the kernel of the Windows operating system from the American company Microsoft. An information disclosure vulnerability exists in Microsoft Windows Kernel. The vulnerability arises from errors in configuration, etc. in the operation of a networked system or product...

Microsoft SharePoint Server Spoofing Vulnerability (CNVD-2022-59593)

Microsoft SharePoint is a suite of enterprise business collaboration platforms from Microsoft Corporation USA. Microsoft SharePoint Server is vulnerable to spoofing and no details of the vulnerability are currently available...

Siemens SCALANCE W-1700 (11ac) Series Denial of Service Vulnerability (CNVD-2022-28499)

The SCALANCE W-1700 products are IEEE 802.11 compliant wireless communication devices. a denial of service vulnerability exists in the Siemens SCALANCE W-1700 11ac series, which can be exploited by an attacker to cause the entire device to crash for competing conditions...

WordPress UpdraftPlus WordPress Backup plugin跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. WordPress plugin is a WordPress open source application plugin. WordPress UpdraftPlus WordPress Backup plugin...

IBM Rational ClearCase GIT connector trust management issue vulnerability

IBM Rational ClearCase is a software configuration management solution from IBM Corporation. The solution provides version control, workspace management, parallel development support, and build auditing.A trust management issue vulnerability exists in IBM Rational ClearCase GIT connector version...

WordPress CleanTalk plugin cross-site scripting vulnerability (CNVD-2022-67605)

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress plugin is a WordPress application plugin. WordPress CleanTalk plugin 5.173 and earlier versions have a cross-sit...

TOTOLINK N600R Command Injection Vulnerability (CNVD-2022-53561)

TotoLink N600R is a wireless router from TotoLink, a Taiwan-based company. TotoLink N600R is vulnerable to command injection, which can be exploited by attackers via the pingCheck function...