Stark Bank Data Forgery Issue Vulnerability (CNVD-2021-95644)

Stark Bank is a banking API for individual developers in Brazil that performs all banking operations through the API, simplifying and automating payments, facilitating reconciliations, and scaling operations. a data forgery issue vulnerability exists in Stark Bank python-ecdsa, which stems from t...

ZOHO ManageEngine Log360 Access Control Error Vulnerability

ZOHO ManageEngine Log360 is an integrated log management and Active Directory auditing and alerting solution from ZOHO USA. The solution helps you mitigate security threats, detect persistent attack attempts, detect suspicious user activity, and comply with regulatory requirements.ZOHO ManageEngi...

TinyXML Infinite Loop Vulnerability

TinyXML is a C++ XML parser that can be easily integrated into other programs. An infinite loop vulnerability exists in TiXmlParsingData::Stamp in tinyxmlparser.cpp in TinyXML 2.6.2 and earlier. An attacker can exploit this vulnerability to cause a denial of service via a specially crafted XML...

UReport Arbitrary File Creation Vulnerability

UReport is a high-performance pure Java reporting engine based on the Spring architecture. ureport version 2.2.9 contains an arbitrary file creation vulnerability. An attacker can exploit this vulnerability to execute arbitrary code...

Google TensorFlow buffer overflow vulnerability (CNVD-2021-64535)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A buffer overflow vulnerability exists in Google TensorFlow due to a lack of valid restrictions in tf.rawops.ResourceGather in the affected version, which could be exploited by an attacker to A crash ca...

Mozilla Rust Denial of Service Vulnerability (CNVD-2021-61401)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A denial-of-service vulnerability exists in Mozilla Rust's sklose disrustor, which stems from the fact that RingBuffer does not properly limit the number of variable references, and can be exploited by attackers...

Nextcloud Input Validation Error Vulnerability (CNVD-2022-20701)

An input validation error vulnerability exists in Nextcloud Server, which stems from the fact that DownloadResponse does not do security checks on uploaded file names, and could be exploited to trick users into downloading malicious files with normal file name...

Fortinet FortiMail Injection Vulnerability

Fortinet FortiMail is a set of e-mail security gateway products of the U.S. Fita Fortinet. The product provides e-mail security and data protection features. An injection vulnerability exists in Fortinet FortiMail due to a missing encryption step in the implementation of the hash digest algorithm...

Command execution vulnerability in TamronOS IPTV/VOD system (CNVD-2021-49564)

TamronOS IPTV/VOD system is a set of Linux kernel-based development of broadband operators, hotels, schools, live on-demand all-in-one solution, the system provides a variety of clients Android set-top box, TV, PC on-demand, cell phone on-demand to facilitate user access through different devices...

PowerISO Buffer Overflow Vulnerability

PowerISO is a powerful CD/DVD/BD image file processing tool from PowerISO that can open, extract, burn, create, edit, compress, encrypt, split and convert ISO files, and mount ISO files using internal virtual drives. PowerISO suffers from a buffer overflow vulnerability that originates from a...

Unauthorized Access Vulnerability in Portainer

Portainer is a graphical management tool for visualizing container images. With Portainer you can easily build, manage and maintain Docker environments. An unauthorized access vulnerability exists in Portainer. An attacker could exploit the vulnerability to obtain sensitive information...

Accela Civic Platform Cross-Site Scripting Vulnerability (CNVD-2021-61770)

Accela Civic Platform is a cloud-based solution for Accela's applications to modernize city systems for land management and code enforcement, increased citizen engagement and mobile information access. The vulnerability stems from the lack of proper validation of client-side data by the WEB...

IBM Application Gateway Information Disclosure Vulnerability

IBM Application Gateway is an application gateway from IBM America, Inc. It provides a containerized, secure Web Reverse Proxy that is designed to sit in front of your application and seamlessly add authentication and authorization protection to your application. An information disclosure...

Command Execution Vulnerability in VoIPmonitor

VoIPmonitor is an open source network packet sniffer with a commercial front-end for SIP RTP and RTCP VoIP protocols running on Linux. VoIPmonitor suffers from a command execution vulnerability that can be exploited by an attacker to gain control of the server...

WordPress WP Fastest Cache plugin path traversal vulnerability

WordPress Fastest Cache plugin is an application plugin for WordPress. A directory traversal vulnerability exists in versions of the WordPress WP Fastest Cache plugin prior to 0.9.1.7, which can be exploited by a remote attacker with administrator privileges to delete arbitrary files on the serve...

Skyworth Digital Technology RN510 Cross-Site Request Forgery Vulnerability

The RN510 is a dual-band wireless AC2100 access point from Skyworth Digital Technology. A cross-site request forgery vulnerability exists in /cgi-bin/net-routeadd.asp and /cgi-bin/sec-urlfilter.asp in the Skyworth Digital Technology RN510 version V.3.1.0.4. No detailed vulnerability details are...

Apache log4net XXE Vulnerability

Apache log4net is the United States Apache Apache Software Foundation, a logging output tool. A security vulnerability exists in the parsing of log4net configuration files in Apache log4net versions prior to 2.0.8. An attacker can exploit this vulnerability to force the system to accept arbitrary...

mcollective Trust Management Issues Vulnerabilities

mcollective is a framework for building Server Orchestration and parallel work execution systems. A trust management issue vulnerability exists in mcollective. The vulnerability stems from the lack of an effective trust management mechanism in a networked system or product. An attacker could...

Alkacon OpenCms Local File Inclusion Vulnerability

Alkacon OpenCms is a set of open source content management system CMS developed using the Java language . A local file inclusion vulnerability exists in Alkacon OpenCms versions 10.5.4 and 10.5.5, which can be exploited by an attacker to access server resources...

BlogEngine path traversal vulnerability (CNVD-2019-18836)

BlogEngine is an open source ASP.NET blog system . The system supports Ajax comments , custom themes and so on. A path traversal vulnerability exists in BlogEngine 3.3.7 and earlier versions. The vulnerability stems from the failure of a network system or product to properly filter special elemen...

Wibu-Systems WibuKey Elevation of Privilege Vulnerability

Wibu-Systems WibuKey is a digital rights management DRM system from Wibu-Systems. A security vulnerability exists in the 0x8200E804 IOCTL handler in Wibu-Systems WibuKey version 6.40 Build 2400. An attacker can exploit the vulnerability by sending a specially crafted IRP request to corrupt memory...

Red Hat OpenShift Container Platform Denial of Service Vulnerability

Red Hat OpenShift Container Platform is an application platform from Red Hat that enables organizations to develop, deploy and manage existing container-based applications across physical, virtual and public cloud infrastructures. A denial of service vulnerability exists in Red Hat OpenShift...

WordPress Plainview Activity Monitor Plugin OS Command Injection Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . Plainview Activity Monitor plugin is used in one of the website user activity monitoring plugin . An operating syst...

The Sleuth Kit Buffer Overflow Vulnerability (CNVD-2017-28572)

The Sleuth Kit TSK is a collection of data forensic tools developed by software developer Brian Carrier. The tools are able to analyze file systems such as FAT, NTFS, UFS, etc. and provide detailed information about the file system, including deleted data. A buffer overflow vulnerability exists i...

IBM InfoSphere Information Server Information Disclosure Vulnerability (CNVD-2017-21256)

IBM InfoSphere Information Server is a set of data integration platforms from IBM in the United States. The platform can be used to integrate data information obtained from various sources. An information disclosure vulnerability exists in IBM InfoSphere Information Server versions 9.1, 11.3, and...

WordPress Mail Masta plugin SQL injection vulnerability (CNVD-2017-02398)

WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . A SQL injection vulnerability exists in the WordPress Mail Masta plugin, which originates when the program fails...

MCabber Security Bypass Vulnerability

MCabber is a small XMPP Jabber console client. A security bypass vulnerability exists in MCabber that could allow an attacker to perform a man-in-the-middle attack or emulate a trusted server...

Netgear Multiple Device Authentication Bypass Vulnerability

Netgear is a global leader in enterprise networking solutions and a champion of digital home networking applications. An authentication bypass vulnerability exists in several Netgear devices, which can be exploited by an attacker to launch a command injection attack by passing an input command li...

ISPConfig 'monitor/show_sys_state.php' SQL Injection Vulnerability

ISPConfig is a set of Linux-based open source hosting control panel, it can be used through the Web control panel to manage multiple servers, open a Web site, monitor server operating conditions and so on. The ISPConfig monitor/showsysstate.php script handles the 'server' parameter with a SQL...

WordPress Plugin NextScripts: Social Networks Auto-Poster Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress plugin NextScripts: Social Network...

Cisco IOS XE Wireless Controller Software Access Control Error Vulnerability

Cisco IOS XE Wireless Controller software is a wireless LAN controller from Cisco. The Cisco IOS XE Wireless Controller Software suffers from an Access Control Error vulnerability that stems from insufficient access control and can be exploited by an attacker to cause the deletion of arbitrary us...

Dell PowerEdge FX2 and Dell PowerEdge VRTX Buffer Overflow Vulnerability

The Dell PowerEdge FX2 and Dell PowerEdge VRTX are both products of Dell, Inc.The Dell PowerEdge FX2 is a 2U hybrid rackmount computing platform.The Dell PowerEdge VRTX is a mini server with a built-in storage system.... The Dell PowerEdge FX2 and Dell PowerEdge VRTX have a buffer overflow...

GNU Binutils xmalloc.c file memory leak vulnerability

GNU Binutils GNU Binary Utilities is a set of programming language utility programs developed by the American GNU community. The programs are primarily designed to work with target files in a variety of formats, and provide connectors, assemblers, and other tools for target files and archives. A...

IBM Cognos Controller File Upload Vulnerability (CNVD-2025-01788)

IBM Cognos Controller is a suite of business intelligence and planning solutions from International Business Machines IBM. The product features process automation, financial audit control, and the creation and management of financial reports. A file upload vulnerability exists in IBM Cognos...

Adobe ColdFusion Access Control Error Vulnerability (CNVD-2024-21156)

Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. Adobe ColdFusion suffers from an Access Control Error vulnerability, which arises from the presence of...

Mozilla Firefox Denial of Service Vulnerability (CNVD-2024-10437)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A denial of service vulnerability exists in Mozilla Firefox, which can be exploited by attackers to cause the browser to crash...

Gila CMS Area Parameter SQL Injection Vulnerability

Gila CMS is an open source content management system CMS based on PHP and MySQL. A SQL injection vulnerability exists in Gila CMS 1.15.4 and earlier versions, which stems from the application's lack of validation of externally entered SQL statements. The vulnerability can be exploited by a remote...

Siemens User Management Component (UMC) Classic Buffer Overflow Vulnerability

Opcenter Quality is a quality management system QMS that enables organizations to safeguard compliance, optimize quality, reduce the cost of defects and rework, and achieve operational excellence by improving process stability. simatic pcs neo is a distributed control system DCS. the SINUMERIK...

Siemens Tecnomatix Plant Simulation Out-of-Bounds Write Vulnerability (CNVD-2023-71239)

Siemens Tecnomatix Plant Simulation is an industrial control device from Siemens, Germany. The power of discrete-event simulation is used to analyze and optimize throughput and thus improve manufacturing system performance. Siemens Tecnomatix Plant Simulation suffers from an out-of-bounds write...

Apache ShardingSphere Deserialization Vulnerability

The TeleAdapt RoomCast TA-2400 is an all-in-one, self-contained, top-of-the-line content streaming box for guest rooms from TeleAdapt UK. The TeleAdapt RoomCast TA-2400 suffers from an elevation of privilege vulnerability that is caused by improper access control of the Android Debug Bridge ADB. ...

Siemens Tecnomatix Plant Simulation Heap Buffer Overflow Vulnerability (CNVD-2023-56538)

Siemens Tecnomatix Plant Simulation is an industrial control device from Siemens, Germany, that uses discrete-event simulation to analyze and optimize throughput and thereby improve manufacturing system performance. Siemens Tecnomatix Plant Simulation suffers from a heap buffer overflow...

Cisco Webex Meetings Cross-Site Scripting Vulnerability (CNVD-2023-62934)

Cisco Webex Meetings is a set of video conferencing solutions from Cisco USA. Cisco Webex Meetings suffers from a cross-site scripting vulnerability that stems from a lack of effective filtering and escaping of user-supplied data, which can be exploited by an attacker to execute arbitrary Web...

Trend Micro Apex One elevation of privilege vulnerability (CNVD-2023-65417)

Trend Micro Apex One is an endpoint protection software from Trend Micro. An elevation of privilege vulnerability exists in Trend Micro Apex One, which can be exploited by a local attacker to elevate privileges and write arbitrary values to specific entries...

Cisco Identity Services Engine Input Validation Error Vulnerability

Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. An input validation error vulnerability exists ...

Google Android Information Disclosure Vulnerability (CNVD-2023-26068)

Google Android is a Linux-based open source operating system from Google. Google Android has an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

Apache Superset Cross-Site Request Forgery Vulnerability

A cross-site request forgery vulnerability exists in Apache Superset, a data visualization and data exploration platform from the Apache Foundation. The vulnerability stems from the failure of two legacy REST APIs for granting and requesting access to properly validate user input, which could be...

Netdata Command Injection Vulnerability

Netdata is a high-fidelity infrastructure monitoring and troubleshooting application open-sourced by Netdata. Netdata is vulnerable to a command injection vulnerability that stems from the fact that an attacker who is able to establish a streaming connection can execute arbitrary commands on the...

Siemens JT Open, JT Utilities and Solid Edge Memory Corruption Vulnerability

JT Open Toolkit is an application programming interface API for software developers who support JT, a publicly released data format developed by Siemens Digital Industry Software and widely used for communication, visualization, digital modeling and various other purposes.Solid Edge is a portfoli...

Microsoft PowerShell Remote Code Execution Vulnerability

PowerShell is a task automation and configuration management framework developed by Microsoft Corporation USA, consisting of a command line interface shell layer related manuscript language built from . exploit this vulnerability to bypass sandbox restrictions and execute arbitrary code on the...

Apache DolphinScheduler Input Validation Error Vulnerability

Apache DolphinScheduler, a distributed DAG visualization-based workflow task scheduling system from the Apache Foundation, is vulnerable to an input validation error in Apache DolphinScheduler, which stems from incorrect validation of the script alert plugin parameter. No detailed vulnerability...