Siemens SIMATIC RFID Readers Mishandling Vulnerability

SIMATIC RF600 Readers are used for contactless identification of a variety of objects such as shipping containers, pallets, production goods, or often for recording bulk goods.SIMATIC RF1100 is an RFID-based solution for simple and versatile electronic authorization management.SIMATIC RF360R read...

OpenCart SQL Injection Vulnerability (CNVD-2024-30072)

OpenCart is an open source online store management system for creating and managing e-commerce websites. It is known for its user-friendliness and flexibility for online stores of different sizes. OpenCart suffers from an SQL injection vulnerability that stems from the presence of an SQL injectio...

Simple School Managment System SQL Injection Vulnerability (CNVD-2024-14035)

Simple School Managment System is Code-projects open source a simple school management system . Simple School Managment System version 1.0 SQL injection vulnerability , the vulnerability stems from the application lack of validation of external input SQL statement , an attacker can exploit the...

Microsoft Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Microsoft Windows Cloud Files Mini Filter Driver is a cloud file filter driver from Microsoft USA. An elevation of privilege vulnerability exists in Microsoft Windows Cloud Files Mini Filter Driver. An attacker can exploit this vulnerability to gain elevated privileges on the system...

HCL Technologies Compass Access Control Error Vulnerability

HCL Technologies Compass is a low-code change management software from HCL Technologies, USA. Manages the full range of testing activities and integration with developer tools. HCL Technologies Compass suffers from an Access Control Error vulnerability that stems from the application not disablin...

Fortinet FortiOS Access Control Error Vulnerability (CNVD-2023-98189)

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. An Access Control Error...

Siemens RUGGEDCOM APE1808 Product Family Inside BIOS Vulnerability

The RUGGEDCOM APE1808 is a utility-grade application hosting platform that allows you to deploy a range of commercial edge computing and cybersecurity applications in harsh industrial environments. An Inside BIOS vulnerability exists in the Siemens RUGGEDCOM APE1808 product family, which is cause...

Apache Airflow code issue vulnerability (CNVD-2023-85615)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow has a code issue vulnerability that can be exploited by an attacker ...

CrafterCMS is an open source headless CMS for enterprise-level websites and other content-driven digital experiences, especially those that are high-performance, large-scale and ultra-secure. CrafterCMS suffers from a cross-site scripting vulnerability in versions 3.1.0 through 3.1.27 and 4.0.0 through 4.0.2. The vulnerability is due to improper neutralization of inputs during page generation allowing for reflected XSS.No detailed vulnerability details are available at this time.

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Apache NiFi Remote Code Execution Vulnerability

Apache NiFi is an open source tool for building reliable and secure data pipelines. It supports collecting, aggregating and transferring data from a variety of sources and provides powerful data processing and transformation capabilities. A remote code execution vulnerability exists in Apache NiF...

Apache ShardingSphere Deserialization Vulnerability

The TeleAdapt RoomCast TA-2400 is an all-in-one, self-contained, top-of-the-line content streaming box for guest rooms from TeleAdapt UK. The TeleAdapt RoomCast TA-2400 suffers from an elevation of privilege vulnerability that is caused by improper access control of the Android Debug Bridge ADB. ...

Siemens SIMATIC STEP 7 V5 Remote Code Execution Vulnerability

SIMATIC PCS 7 is a centralized control system DCS that integrates components such as SIMATIC WinCC, SIMATIC Batch, SIMATIC Route control, OpenPCS 7, etc. SIMATIC S7-PM is an option package for SIMATIC STEP 7 V5.7, which offers the project range with the possibility of assigning message...

JerryScript parser_parse_function_arguments function denial of service vulnerability

JerryScript is a lightweight JavaScript engine Jerryscript project . A denial of service vulnerability exists in the JerryScript parserparsefunctionarguments function, which can be exploited by an attacker to cause a denial of service...

Google Chrome Code Execution Vulnerability (CNVD-2023-67083)

Google Chrome is a web browser from Google, an American company. A code execution vulnerability exists in Google Chrome prior to version 112.0.5615.137, which stems from an out-of-bounds memory access in the Service Worker API. An attacker could exploit this vulnerability to execute arbitrary cod...

Google Android elevation of privilege vulnerability (CNVD-2023-55365)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that originates from incorrect boundary checking of avdtscbhdlpktnofrag in the avdtscbact.cc component, which can be exploited by an attacker to elevate...

Google Android elevation of privilege vulnerability (CNVD-2023-55368)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that originates in the toUriInner obfuscation agent of the Intent.java component, which can be exploited by an attacker to elevate privileges...

Google Android elevation of privilege vulnerability (CNVD-2023-26070)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that originates from a privilege bypass in resolveAttributionSource of ServiceUtilities.cpp, which can be exploited by an attacker to gain elevated...

Apache InLong Information Disclosure Vulnerability

Apache InLong is the United States Apache Apache Foundation's one-stop massive data integration framework. An information disclosure vulnerability exists in Apache InLong. An attacker can exploit this vulnerability to read arbitrary files on the system...

Adobe InCopy out-of-bounds read vulnerability (CNVD-2023-05225)

Adobe InCopy is a text editing software for authoring from Adobe. Adobe InCopy has an out-of-bounds read vulnerability that can be exploited by attackers to bypass mitigations such as ASLR and cause sensitive memory leaks...

Microsoft SharePoint Server Remote Code Execution Vulnerability (CNVD-2023-72202)

Microsoft SharePoint Server is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A remote code...

Siemens Mendix Email Connector Module Improper Access Control Vulnerability

Siemens Mendix Email Connector Module allows email to be sent and received on its own email server and adds new features such as sending signed and encrypted emails.A security vulnerability exists in Siemens Mendix Email Connector Module due to a version of the affected module that fails to...

GE CIMPLICITY HMI/SCADA Software has an unspecified vulnerability

GE CIMPLICITY HMI/SCADA Software is an automation industrial platform from General Electric GE, Inc. It provides true client-server visualization and control from a single machine to plant locations around the world to help manage operations and improve decision making.GE CIMPLICITY HMI/SCADA...

Google TensorFlow Input Validation Error Vulnerability (CNVD-2023-15781)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. Google TensorFlow is vulnerable to an input validation error that could be exploited by attackers to crash the program...

Apple iOS and iPadOS Arbitrary Code Execution Vulnerability

Apple iOS and Apple iPadOS are both products of Apple Inc. Apple iOS is an operating system developed for mobile devices. The vulnerability can be exploited to execute arbitrary code on the device with kernel privileges...

Oracle MySQL Shell Information Disclosure Vulnerability (CNVD-2023-01495)

Oracle MySQL Server is a relational database from Oracle Corporation. An information disclosure vulnerability exists in the Shell: Core Client component of Oracle MySQL. An attacker can exploit this vulnerability to corrupt the MySQL Shell and gain unauthorized access to a subset of MySQL...

Microsoft Windows Portable Device Enumerator Service Security Feature Bypass Vulnerability

Microsoft Windows is an operating system for personal devices from Microsoft Corporation USA.A security feature bypass vulnerability exists in Microsoft Windows Portable Device Enumerator Service, which could be exploited by an attacker to compromise the confidentiality, integrity, or The...

Adobe ColdFusion trust management issue vulnerability

Adobe ColdFusion is a rapid application development platform from Adobe, which includes an integrated development environment and scripting language. The platform includes an integrated development environment and scripting language.Adobe ColdFusion has a trust management issue vulnerability that...

Microsoft Windows Local Session Manager (LSM) Denial of Service Vulnerability

Microsoft Windows is a set of operating systems for personal devices from the U.S. Microsoft Windows Local Session Manager LSM has a denial-of-service vulnerability that can be exploited by attackers to launch denial-of-service attacks...

SAP 3D Visual Enterprise Author .sat Buffer Overflow Vulnerability

SAP 3D Visual Enterprise Author is a desktop application for managing 2D, 3D, animation, video and audio assets from SAP. A buffer overflow vulnerability exists in SAP 3D Visual Enterprise Author version 9, which stems from a lack of proper memory management and can be exploited by an attacker to...

SAP Manufacturing Execution Path Traversal Vulnerability

SAP Manufacturing Execution is an integrated Manufacturing Execution System MES solution for discrete manufacturing processes from SAP. Enables MES functionality to be customized specifically for the management and control of production environments. A path traversal vulnerability exists in SAP...

Singularity Image Format Encryption Problem Vulnerability

Singularity Image Format is a compressed squashfs file system from Singularity that has a block organization structure, including metadata and definition files for containers, first labels, partition contents, signatures if they exist, and, of course, the containers for the binaries themselves...

Caryll OTFCC otfccdump+0x4fe954 denial of service vulnerability

Caryll OTFCC is Caryll open source a C library and utility programs. Used to parse and write OpenType font files. A denial of service vulnerability exists in Caryll OTFCC, which originates from a segmentation conflict at /release-x64/otfccdump+0x4fe954. An attacker can exploit the vulnerability t...

QEMU Denial of Service Vulnerability (CNVD-2022-84158)

QEMU Quick Emulator is a set of emulated processor software from Fabrice Bellard, a French personal developer. QEMU has a denial of service vulnerability, which stems from a deadlock problem in its AHCI controller during a software reset ahciresetport while processing host-to-device registration...

Google Android elevation of privilege vulnerability (CNVD-2022-65640)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability. The vulnerability stems from incorrect programmatic calls to high-level native procedures. An attacker can exploit this vulnerability to gain elevated...

WordPress plugin CDI cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

SAP BusinessObjects BW Publisher Service Elevation of Privilege Vulnerability

SAP BusinessObjects BW Publisher Service is a model-driven data warehouse product from SAP Germany. An elevation of privilege vulnerability exists in versions 420 and 430 of the SAP BusinessObjects BW Publisher Service, which stems from the use of search paths that contain un-referenced elements,...

Unspecified vulnerability in Dell BSAFE Crypto-C Micro Edition and Dell BSAFE Micro Edition Suite (CNVD-2022-84613)

Dell BSAFE Micro Edition Suite is a development kit that provides encryption, certificate and transport layer security for c/c applications, devices, systems, etc. Dell BSAFE is a security software product that supports encryption algorithms, certificate chain authentication and transport layer...

Jenkins Deployment Dashboard信息泄露漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project. jenkins Plugin is an application. an information disclosure vulnerability...

Apache Superset Access Control Error Vulnerability

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset suffers from an Access Control Error vulnerability that stems from improper access restrictions. A remote attacker could exploit the vulnerability to bypass implemented security...

74cmsSE SQL Injection Vulnerability (CNVD-2022-61443)

74cmsSE is a free open source professional recruitment system based on PHP MYSQL. 74cmsSE suffers from a SQL injection vulnerability, which originates from a keyword parameter in /home /jobfairol/resumelist that lacks validation for external input SQL statements. An attacker could use this...

NUUO Network Video Recorder Cross-Site Scripting Vulnerability

NUUO Network Video Recorder is a network video recorder from NUUO in Taiwan, China. A cross-site scripting vulnerability exists in NUUO Network Video Recorder NVRsolo v03.06.02, which can be exploited by an attacker to execute JavaScript code on the client side...

YouDianCMS SQL Injection Vulnerability (CNVD-2022-59019)

YouDianCMS is a website CMS. A SQL injection vulnerability exists in YouDianCMS v9.5.0, which originates from the lack of validation of the IdList parameter at /App/Lib/Action/Home/ApiAction.class.php against external SQL input. This vulnerability can be exploited to execute illegal SQL commands ...

TOTOLINK N600R Command Injection Vulnerability (CNVD-2022-53552)

TOTOLINK N600R is a wireless router from Taiwan-based TOTOLINK, China.A command injection vulnerability exists in TOTOLINK N600R, which can be exploited by attackers to conduct command injection attacks via the devicemac parameter in /setting/setDeviceName...

Microsoft Windows Remote Procedure Call Runtime Remote Code Execution Vulnerability

Microsoft Windows Remote Procedure Call Runtime is a technology used to create distributed client/server programs from Microsoft Corporation USA.Microsoft Windows Remote Procedure Call Runtime is vulnerable to remote code execution vulnerability. The vulnerability stems from the failure of a...

F5 BIG-IP iControl REST Authentication Bypass Vulnerability

F5 BIG-IP is an application delivery platform that integrates traffic management, DNS, inbound and outbound rules, web application firewall, web gateway, load balancing and other functions. F5 BIG-IP iControl REST authentication bypass vulnerability, the vulnerability is due to the authentication...

Pivotal Spring Security Oauth Resource Management Error Vulnerability

A resource management error vulnerability exists in Pivotal Spring Security OAuth, a login system from Pivotal, Inc. that provides support for adding OAuth1 and OAuth2 functionality to Spring Web applications. The vulnerability stems from improper handling of a large number of message requests. A...

Cisco IOS XE AppNav-XE Denial of Service Vulnerability

Cisco IOS XE is a set of operating systems developed by Cisco for its network devices.A denial-of-service vulnerability exists in Cisco IOS XE AppNav-XE, which can be exploited by attackers to cause the device to reload...

Microsoft Windows Kernel Information Disclosure Vulnerability (CNVD-2022-65612)

The Microsoft Windows Kernel is the kernel of the Windows operating system from the American company Microsoft. An information disclosure vulnerability exists in Microsoft Windows Kernel. The vulnerability arises from errors in configuration, etc. in the operation of a networked system or product...

Microsoft Windows Defender Denial of Service Vulnerability

A denial-of-service vulnerability exists in Microsoft Windows Defender, a suite of antivirus software that comes with Windows from Microsoft. The vulnerability stems from a failure to properly handle incoming error messages, and can be exploited by attackers to cause a denial of service...

Wasmtime Resource Management Error Vulnerability

Wasmtime, a Bytecode Consortium project, is a standalone wasm-optimized runtime for WebAssembly and WASI only. a resource management error vulnerability exists in Wasmtime, which stems from the fact that when running Wasm with externrefs and epoch interrupts are enabled in Wasmtime, a use after...