Microsoft Windows CD-ROM File System Driver Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the Windows CD-ROM File System Driver, which stems from the failure of a network system or product to properly filter special elements in the external input data used to construct code segments. The vulnerability can be exploited by an attacker to...

Dapr Dashboard Access Control Error Vulnerability

Dapr Dashboard is a web-based user interface for Dapr that allows users to view information, view logs of running Dapr applications, components, configurations, etc. Dapr Dashboard 0.1.0 and later, 0.10.0 and earlier versions have an access control error vulnerability that stems from the existenc...

Huawei HarmonyOS HW_KEYMASTER module input validation error vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a microkernel-based, fully distributed operating system. Huawei HarmonyOS version 2.0 is vulnerable to an input validation error that stems from a lack of checksum on read content in the HWKEYMASTER module. An attacker could...

Discourse-chat Cross-Site Scripting Vulnerability

Discourse is an open source community discussion platform that includes community, email, and chat room features. The platform includes community, email, and chat room features. discourse-chat versions prior to 0.9 have a cross-site scripting vulnerability, which stems from the fact that some par...

Strapi SQL Injection Vulnerability

Strapi is an open source content management system CMS. versions of Strapi prior to 3.6.10 and 4.0.0 and later, and prior to 4.1.10, contain a SQL injection vulnerability that stems from its incorrect handling of hidden attributes in admin API responses. An attacker could exploit the vulnerabilit...

Adobe Illustrator out-of-bounds read vulnerability (CNVD-2023-07320)

Adobe Illustrator is a software released by Adobe Systems, Inc. for graphics production. An out-of-bounds read vulnerability exists in Adobe Illustrator, which can be exploited by attackers to bypass mitigations such as ASLR and cause sensitive memory leaks...

Adobe InCopy out-of-bounds read vulnerability (CNVD-2023-05233)

Adobe InCopy is an application produced by Adobe for professional word processing. Adobe InCopy 17.3 and 16.4.2 and prior versions contain an out-of-bounds read vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the current user...

Siemens RUGGEDCOM ROS Denial of Service Vulnerability

Siemens RuggedCom ROS is an operating system used in the RuggedCom family of switches from Siemens, Germany. Siemens RUGGEDCOM ROS suffers from a denial-of-service vulnerability that could be exploited by an attacker to create a denial-of-service condition that lasts until the end of the attack...

Apache JSPWiki Cross-Site Scripting Vulnerability (CNVD-2022-83598)

Apache JSPWiki is an open source WikiWiki engine built on Java, Servlet and JSP from the Apache Foundation. security vulnerability exists in versions prior to Apache JSPWiki 2.11.3, which stems from a carefully crafted request on the WeblogPlugin that could trigger an XSS vulnerability, which cou...

Jenkins Recipe Plugin XML External Entity Injection Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project. jenkins Plugin is an application software. jenkins Recipe Plugin version 1...

Jenkins Build Notifications Plugin信息泄露漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.An information disclosure vulnerability...

NetSarang XLPD Elevation of Privilege Vulnerability

NetSarang XLPD is a remote printing tool from NetSarang, Inc. It is used to manage an organization's print jobs. An elevation of privilege vulnerability exists in NetSarang XLPD v7.0.0094 and prior versions, which stems from an application containing an un-referenced service path. An attacker can...

GLPI Information Disclosure Vulnerability (CNVD-2022-58232)

GLPI is an open source IT and asset management software. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridges and ink cartridges. An...

Contec SolarView Compact Remote Code Execution Vulnerability

Contec SolarView Compact is an application from Contec Japan, Inc. Contec SolarView Compact v6.0 contains a remote code execution vulnerability that stems from a failure of SolarImage.php to properly filter special elements of the construction snippet. An attacker could exploit this vulnerability...

WordPress Ultimate Member plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. WordPress Ultimate...

Embedthis Software Appweb Community Edition Denial of Service Vulnerability

Embedthis Software Appweb is a web server for embedded applications from Embedthis Software, Inc. A denial of service vulnerability exists in Embedthis Software Appweb Community Edition version 8.2.1, which originates in src/ http/http/httpLib.c, an attacker can use this vulnerability to crash th...

Mattermost Resource Management Error Vulnerability (CNVD-2022-65349)

Mattermost is an open source collaboration platform from Mattermost, Inc. A resource management error vulnerability exists in versions prior to Mattermost 6.6.0, which stems from uncontrolled consumption of resources and can be exploited by an attacker to crash the server via a specially crafted...

Illumina Local Run Manager File Upload Vulnerability

Illumina Local Run Manager is an integrated solution from Illumina, Inc. Designed to create sequencing runs, monitor run status, analyze sequencing data, and view results, Illumina Local Run Manager contains a file upload vulnerability that could be exploited by an attacker to upload any file typ...

MariaDB Server Denial of Service Vulnerability

MariaDB is a database management system from the Mariadb Foundation and a branch version of MySQL that uses the Maria storage engine. a denial of service vulnerability exists in versions of MariaDB Server prior to 10.7, which originates in extra/mariabackup/dscompress.cc, and can be exploited to...

Erudika Para Cross-Site Scripting Vulnerability

Erudika Para is a command-line interface from the Bulgarian company Erudika. cross-site scripting vulnerability exists in versions prior to Erudika Para v1.45.11, which stems from a function in Utils.java that lacks filtering and escaping for user data. An attacker could use this vulnerability to...

Fidelis Network Deception Command Injection Vulnerability (CNVD-2022-59170)

Fidelis Network Deception is a security product from Fidelis USA. A security vulnerability exists in versions prior to Fidelis Network Deception 9.4.5, which stems from a problem with date in rconfig. An attacker with CLI user-level access could exploit the vulnerability to inject root-level...

QEMU Resource Management Error Vulnerability (CNVD-2022-84160)

QEMU Quick Emulator is a set of emulation processor software by Fabrice Bellard, a French personal developer. A denial of service vulnerability exists in versions prior to QEMU 7.0.0, which stems from EHCI's failure to verify that the buffer pointer overlaps with its MMIO region when transferring...

Microsoft Windows Win32k Elevation of Privilege Vulnerability (CNVD-2022-62516)

Microsoft Windows Win32k is a system file for Windows multi-user management from Microsoft Corporation USA. Microsoft Windows Win32k has an elevation of privilege vulnerability that could be exploited by attackers to execute arbitrary code with elevated privileges...

Microsoft Windows Defender Denial of Service Vulnerability

A denial-of-service vulnerability exists in Microsoft Windows Defender, a suite of antivirus software that comes with Windows from Microsoft. The vulnerability stems from a failure to properly handle incoming error messages, and can be exploited by attackers to cause a denial of service...

Microsoft Windows DNS Server Remote Code Execution Vulnerability (CNVD-2022-84606)

Microsoft Windows is a set of operating systems for personal devices used by the U.S. company Microsoft Microsoft. A remote code execution vulnerability exists in Microsoft Windows DNS Server, which can be exploited by attackers to execute arbitrary code on the system...

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CNVD-2022-60120)

Microsoft Edge is a web browser that comes with versions of Windows 10 and later, and an elevation of privilege vulnerability exists in Microsoft Edge Chromium-based. An attacker could exploit this vulnerability to elevate privileges...

Wasmtime Resource Management Error Vulnerability

Wasmtime, a Bytecode Consortium project, is a standalone wasm-optimized runtime for WebAssembly and WASI only. a resource management error vulnerability exists in Wasmtime, which stems from the fact that when running Wasm with externrefs and epoch interrupts are enabled in Wasmtime, a use after...

WordPress Narnoo Distributor plugin path traversal vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress plugin is a WordPress open source application plugin . A path traversal vulnerability exists in WordPress Narnoo...

Apache Gobblin Trust Management Issue Vulnerability

Apache Gobblin is a distributed data integration framework from the Apache Foundation USA. Used to simplify common aspects of big data integration, Apache Gobblin is vulnerable to a trust management issue that stems from Apache Gobblin trusting all certificates used for LDAP connections in...

Jenkins GitLab Authentication Plugin Information Disclosure Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.The Jenkins GitLab Authentication Plugin ...

Atom CMS SQL Injection Vulnerability

Atom CMS is a content management system. A SQL injection vulnerability exists in Atom CMS version 2.0, which stems from a missing validation of external input SQL statements in the id parameter of /admin/ajax/avatar.php. An attacker could use this vulnerability to execute illegal SQL commands to...

Unspecified vulnerability exists in abcm2ps (CNVD-2022-22268)

abcm2ps is a command-line program that converts music tunes from ABC music notation to PostScript or SVG. It can convert music tunes from ABC music notation to PostScript or SVG. abcm2ps v8.14.11 contains a security vulnerability that can be exploited by remote attackers to cause a denial of...

Shopware Information Disclosure Vulnerability (CNVD-2022-18524)

Shopware is a suite of open source e-commerce software from the German company Shopware.Shopware suffers from an information disclosure vulnerability that stems from not properly setting sensitive HTTP headers to be uncacheable. An attacker could exploit the vulnerability to cause the header to...

Siemens RUGGEDCOM ROS Heap Buffer Overflow Vulnerability

Siemens RuggedCom ROS is an operating system used in the RuggedCom family of switches from Siemens, Germany. Siemens RUGGEDCOM ROS suffers from a heap buffer overflow vulnerability that can be exploited by attackers to cause a heap overflow...

Siemens Climatix POL909 (AWM and AWB) Information Disclosure Vulnerability

Siemens Climatix AWB Advanced Web and BACnet Module, POL909 enables users of the Climatix 600 solution to connect to a BACnet IP network and implement and load customer web pages and features. Siemens Climatix AWM Advanced Web Module, POL909 enables users of the Climatix 600 solution to implement...

MaxSite CMS Cross-Site Scripting Vulnerability (CNVD-2022-33826) (CVE-2022-25413)

MaxSite CMS is a web content management system of the Russian MaxSite CMS open source project.MaxSite CMS 108 has a cross-site scripting vulnerability that can be exploited by attackers to perform cross-site scripting attacks via the ftags parameter in /admin/pageedit/3...

CuppaCMS SQL Injection Vulnerability (CNVD-2022-22322)

CuppaCMS is a content management system CMS.A SQL injection vulnerability exists in CuppaCMS, which stems from the lack of validation of externally entered SQL statements in the database-based application. An attacker could exploit this vulnerability to execute illegal SQL commands...

Reolink RLC-410W cgiserver.cgi denial of service vulnerability

Reolink Rlc-410W is a Wifi security camera from Reolink China.A denial of service vulnerability exists in Reolink RLC-410W in version v3.0.0.13620121102, which stems from the JSON parsing function of cgiserver.cgi not doing the correct handling of incoming error messages. An attacker could use th...

McAfee Agent Command Injection Vulnerability

The McAfee McAfee Agent MA is a set of client components from McAfee, Inc. that provides secure communications between ePolicy Orchestrator the antivirus management platform and managed products. A security vulnerability exists in the McAfee Agent that originates from allowing a local user to...

LibreCAD Buffer Overflow Vulnerability (CNVD-2022-08149)

LibreCAD is an open source CAD Computer Aided Design application from the LibreCAD organization. A buffer overflow vulnerability exists in LibreCAD 2.2.0-rc3 and earlier versions, which originates when a networked system or product performs an operation in memory without properly validating data...

Oracle MySQL Cluster Buffer Overflow Vulnerability (CNVD-2022-18211)

MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database designed to guarantee 99.999% availability. A buffer overflow vulnerability exists in Oracle MySQL Cluster, which can be exploited by an attacker to execute code in the context of a service account...

phpMyAdmin Cross-Site Scripting Vulnerability (CNVD-2022-08031)

phpMyAdmin is a free, web-based MySQL database management tool from the Phpmyadmin team. The tool is capable of creating and deleting databases, creating, deleting and modifying database tables, executing SQL script commands, etc. phpMyAdmin suffers from a cross-site scripting vulnerability that...

libspf2 buffer overflow vulnerability (CNVD-2022-19088)

libspf2 is a library that allows email systems such as Sendmail, Postfix, Exim, Zmailer, and MS Exchange to check SPF records and ensure that an email is authorized from its domain. This prevents email forgery commonly used by spammers, scammers and email viruses/worms. libspf2 suffers from a...

Zoho ManageEngine O365 Manager Plus Remote Code Execution Vulnerability

A security vulnerability exists in Zoho ManageEngine O365 Manager Plus, a software for auditing, monitoring and managing Office 365 from ZOHO, Inc. prior to Build 4416, which stems from an external input data during the construction of a code segment, and the network system or product fails to...

WordPress Contact Form Entries Plugin Security Vulnerability

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress Contact Form Entries Plugin has a cross-site scripting vulnerability in versions prior to 1.2.4, which stems from...

Samba competition condition issue vulnerability

Samba is a standard Windows interoperability suite for Linux and Unix. A post-link vulnerability exists in Samba file server that results from a symbolic link contention condition when creating directories. A remote authenticated user can create a directory on a Unix file system outside of the...

mruby has an unspecified vulnerability

mruby is a lightweight implementation of the Ruby language. mruby has a security vulnerability that stems from the fact that mruby is vulnerable to a heap-based buffer overflow attack. No details of the vulnerability are currently available...

Rust raw-cpuid crate has an unspecified vulnerability

Rust raw-cpuid crate is a library for parsing x86 CPUID instructions, written in rust, with no external dependencies. The implementation is very similar to the Intel CPUID manual description. The library only depends on libcore. versions prior to Rust raw-cpuid crate 9.1.1 have security...

Mozilla Rust rdiff crate file reading vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. rust rdiff crate has a security vulnerability in versions prior to 2021-02-03, which can be exploited to read data from uninitialized memory locations...

Mozilla Rust has an unspecified vulnerability (CNVD-2022-03129)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation.A security vulnerability exists in versions of Rust crypto2 crate prior to 2021-10-08, which stems from a possible unaligned read of u32 during Chacha20 encryption and decryption. No details of the vulnerability...