Netdata Command Injection Vulnerability

Netdata is a high-fidelity infrastructure monitoring and troubleshooting application open-sourced by Netdata. Netdata is vulnerable to a command injection vulnerability that stems from the fact that an attacker who is able to establish a streaming connection can execute arbitrary commands on the...

Siemens JT Open, JT Utilities and Solid Edge Memory Corruption Vulnerability

JT Open Toolkit is an application programming interface API for software developers who support JT, a publicly released data format developed by Siemens Digital Industry Software and widely used for communication, visualization, digital modeling and various other purposes.Solid Edge is a portfoli...

Microsoft PowerShell Remote Code Execution Vulnerability

PowerShell is a task automation and configuration management framework developed by Microsoft Corporation USA, consisting of a command line interface shell layer related manuscript language built from . exploit this vulnerability to bypass sandbox restrictions and execute arbitrary code on the...

Apache DolphinScheduler Input Validation Error Vulnerability

Apache DolphinScheduler, a distributed DAG visualization-based workflow task scheduling system from the Apache Foundation, is vulnerable to an input validation error in Apache DolphinScheduler, which stems from incorrect validation of the script alert plugin parameter. No detailed vulnerability...

Mozilla Firefox Competition Condition Issue Vulnerability (CNVD-2023-06511)

Mozilla Firefox is an open source Web browser from the Mozilla Foundation in the U.S. Mozilla Firefox is vulnerable to a contention issue that could be exploited by an attacker to gain root privileges and execute arbitrary code to gain privilege escalation...

IBM AIX Denial of Service Vulnerability (CNVD-2023-00804)

IBM AIX is an open standards-based UNIX operating system developed by International Business Machines IBM for the IBM Power architecture. IBM AIX suffers from a denial-of-service vulnerability that can be exploited by unauthorized local attackers to achieve a denial of service via the AIX SMB...

Google TensorFlow has an unspecified vulnerability (CNVD-2023-15772)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc...

chocolatey Python3 Permission Design Vulnerability

Python is an open source object-oriented programming language. A privilege design vulnerability exists in the Chocolatey Python3 package v3.11.0 and earlier versions, which originates from all users in the Authenticated users group having write access to the subfolder C:\Python311 and all files i...

AVEVA Edge DLL Hijacking Vulnerability

AVEVA Edge is a highly scalable and flexible HMI/SCADA software from AVEVA Software UK. A DLL hijacking vulnerability exists in AVEVA Edge 2020 R and prior versions, which could be exploited by an attacker to compromise the confidentiality, availability or integrity of a system. Details of the...

MOXA ARM-Based Computers Elevation of Privilege Vulnerability

MOXA ARM-Based Computers is a series of industrial computers from MOXA in China. An elevation of privilege vulnerability exists in Moxa ARM-Based Computers, which can be exploited by an attacker to gain root privileges...

SAP 3D Visual Enterprise Author .sldprt Buffer Overflow Vulnerability

SAP 3D Visual Enterprise Author is a desktop application for managing 2D, 3D, animation, video and audio assets from SAP. A buffer overflow vulnerability exists in SAP 3D Visual Enterprise Author version 9, which stems from a lack of proper memory management and can be exploited by an attacker to...

Slack Morphism Information Disclosure Vulnerability

Slack Morphism is a modern asynchronous client library for Rust that supports Slack Web, Events APIocket Mode, and Block Kit. versions prior to Slack Morphism 1.3.2 have an information disclosure vulnerability that stems from insufficient protection of sensitive information in the application,...

SAMSUNG Mobile devices ProfileSharingAccount access control error vulnerability

SAMSUNG Mobile devices is a series of Samsung mobile devices, including cell phones, tablets, etc. SAMSUNG Mobile devices Android S12 before 13.0.6.15, Android R11 13.0.6.14 has an access control error vulnerability, which originates from the existence of access control in ProfileSharingAccount i...

Rockwell Automation Factory Talk VantagePoint SQL Injection Vulnerability

Rockwell Automation Factory Talk VantagePoint is an advanced industrial application ecosystem from Rockwell Automation, Inc. The SQL injection vulnerability in Rockwell Automation Factory Talk VantagePoint stems from a failure to properly validate SQL statements entered by users when retrieving...

Bento4 Ap4StdCFileByteStream.cpp Denial of Service Vulnerability

Bento4 is an open source C++ library for reading and writing MP4 files. A denial of service vulnerability exists in Bento4 version 1.6.0-639, which originates in the AP4StdcFileByteStream::CreateAP4FileByteStream, char const , AP4FileByteStream::Mode, AP4ByteStream& function does not free or fail...

Sensio Labs Twig Path Traversal Vulnerability

Sensio Labs Twig is a PHP templating engine from Sensio Labs, France, which supports custom tags and filters and creates DSLs. A path traversal vulnerability exists in Sensio Labs Twig 1.0.0 and later, versions prior to 1.44.7, 2.0.0 and later, versions prior to 2.15.3, and 3.0.0 and later,...

FFmpeg Buffer Overflow Vulnerability (CNVD-2022-70582)

FFmpeg is software developed by individual developers that performs recording, converting, and streaming functions for a wide range of audio and video formats. A buffer overflow vulnerability exists in FFmpeg where the size calculation in buildopengopkeypoints iterates over all entries in the loo...

Google TensorFlow Denial of Service Vulnerability (CNVD-2023-10608)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A denial-of-service vulnerability exists in Google TensorFlow, which stems from the fact that FakeQuantWithMinMaxVars will fail to assert if it is given a tensor of non-zero rank min or max. An attacker...

Google TensorFlow Denial of Service Vulnerability (CNVD-2023-10601)

Google TensorFlow is an end-to-end open source platform for machine learning from Google. Google TensorFlow has a denial-of-service vulnerability that can be exploited by attackers to trigger a denial-of-service attack...

PrestaShop Cross-Site Scripting Vulnerability (CNVD-2022-62230)

PrestaShop is an open source e-commerce solution from PrestaShop Inc. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. PrestaShop module 5.0.2 prior versions of cross-site scripting vulnerability, the vulnerability stems from t...

Google Android Buffer Overflow Vulnerability (CNVD-2023-25101)

Google Android is a Linux-based open-source operating system from Google, a U.S. company. The vulnerability stems from the failure of a network system or product to properly filter special elements of code segments during the construction of external input data. An attacker could exploit the...

F5 BIG-IP Health Check Configuration Elevation of Privilege Vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. An elevation of privilege vulnerability exists in the F5 BIG-IP health check configuration, which can be exploited by an...

FeehiCMS arbitrary file upload vulnerability

FeehiCMS is a Php-based CMS builder from Liufee Personal Developers.FeehiCMS version v2.1.1 is vulnerable to arbitrary file uploads. The vulnerability stems from the lack of valid validation of uploaded files by the application. An attacker can exploit the vulnerability to execute arbitrary code ...

Foxit PDF Reader Buffer Overflow Vulnerability (CNVD-2022-55639)

Foxit PDF Reader is China Foxit Foxit company a PDF reader. Foxit PDF Reader suffers from a buffer overflow vulnerability that originates from the application failing to properly validate the allocation boundaries of an object when handling certain JavaScript, which can be exploited by an attacke...

SAP BusinessObjects Business Intelligence Platform信息泄露漏洞（CNVD-2022-56944）

SAP BusinessObjects Business Intelligence Platform is a complete business analytics platform from SAP Germany. The platform combines market-leading SAP data integration products, data management products, and business intelligence BI products to eliminate system integration challenges and quickly...

SAP NetWeaver Portal Cross-Site Scripting Vulnerability (CNVD-2022-56965)

SAP NetWeaver Portal is a component of SAP NetWeaver architecture from SAP Germany. A cross-site scripting vulnerability exists in SAP NetWeaver Portal versions 7.30, 7.31, 7.40, and 7.50, which stems from a failure to adequately validate user-controlled input, and which can be exploited by an...

Huawei HarmonyOS Denial of Service Vulnerability (CNVD-2022-57611)

Huawei HarmonyOS is an operating system from Huawei, China. It provides a microkernel-based distributed operating system. A security vulnerability exists in the graphics component of Huawei HarmonyOS, stemming from the existence of a multi-threaded access database for the graphics acceleration...

SAP Business Objects Data Forgery Issue Vulnerability

SAP Business Objects is a business intelligence suite from SAP Germany. A security vulnerability exists in SAP Business Objects version 420 that stems from inadequate input validation. An attacker exploits the vulnerability to submit a malicious request...

WordPress Shortcodes and extra features for Phlox plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The WordPress plugin is an application plugin. WordPress Shortcodes and extra features for Phlox plugin versions prior to 2.9.8 contain a...

Jenkins Jigomerge Plugin信息泄露漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.Jenkins Jigomerge Plugin 0.9 and earlier...

IBM Curam Social Program Management会话固定漏洞

IBM Curam Social Program Management is an IBM business and technology solution that provides pre-built health and social program components, business processes, toolsets and interfaces on top of a dynamically configurable architecture. The vulnerability stems from the failure of the program to...

InvenTree File Upload Vulnerability

InvenTree is an open source inventory management system from InvenTree Open Source. Provides powerful low-level inventory control and parts tracking . A file upload vulnerability exists in InvenTree versions prior to 0.7.2, which stems from the application's lack of effective validation of upload...

WordPress plugin Elementor Website cross-site scripting vulnerability

WordPress is a set of blogging platform developed using PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress plugin Elementor Website 3.5.5 and previous versions have a cross-site scripting vulnerability, which can be exploited by attackers to...

npm Devcert Denial of Service Vulnerability

Devcert is a package for SSL development from npm, Inc. A denial of service vulnerability exists in versions prior to Devcert 1.2.1, which stems from triggering an exponential ReDoS regular expression denial of service in the Devcert package. An attacker could exploit this vulnerability to cause ...

SPIP remote code execution vulnerability

SPIP is a Web-based content publishing system used primarily for online collaboration. A remote code execution vulnerability exists in versions of SPIP prior to 3.2.8, which are primarily used for online collaboration. The vulnerability stems from the oups parameter of /ecrire not properly...

WordPress WPQA plugin access control error vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plug-in. An access control error vulnerability exists in versions of WordPress WPQA plugin prior to 5.2, whic...

WordPress Pricing Table plugin SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plug-in. A SQL injection vulnerability exists in versions prior to WordPress Pricing Table s plugin 3.6.1, which stem...

trudesk Denial of Service Vulnerability

trudesk is an open source helpdesk/ticketing solution. A denial of service vulnerability exists in trudesk versions prior to 1.2.2, which stems from a lack of validation for password length and can be exploited by an attacker to cause a denial of service via a long password...

InHand Networks InRouter302 Input Validation Error Vulnerability (CNVD-2022-59186)

InHand Networks InRouter Series is a series of routers from InHand Networks, Inc. InHand Networks InRouter302 version V3.5.4 is vulnerable to an input validation error that originates in the libnvram.so nvramimport function userdefineinit function in the userdefinetimeoutnvram variable has...

Asus DSL-N14U-B1 Denial of Service Vulnerability

The ASUS DSL-N14U-B1 is a router device from Asus China. A denial of service vulnerability exists in the Asus DSL-N14U-B1 version 1.1.2.3805. The vulnerability stems from a failure to properly handle incoming error messages and can be exploited by a remote attacker to cause a denial of service Do...

Microsoft Visual Studio Code Remote Code Execution Vulnerability (CNVD-2022-60132)

Microsoft Visual Studio Code is an open source code editor from Microsoft USA. A remote code execution vulnerability exists in Microsoft Visual Studio Code, which arises from a failure of a networked system or product to properly filter specific elements of externally entered data during the...

Pixelimity cross-site scripting vulnerability

Pixelimity is a PHP-based CMS Content Management System.A cross-site scripting vulnerability exists in Pixelimity version 1.0, which stems from a lack of data validation filtering of user-supplied and output data in the Title field of admin/pages.php. An attacker could exploit the vulnerability t...

Apache Struts Remote Code Execution Vulnerability (CNVD-2023-02478)

A remote code execution vulnerability exists in Apache Struts, an open source web application architecture for developing Java EE web applications from the Apache Foundation, which stems from the use of mandatory OGNL evaluation in tag attributes for untrusted user input. An attacker could exploi...

Fortinet FortiWAN SQL Injection Vulnerability

Fortinet FortiWan is a network appliance from Fortinet, Inc. It is used to perform load balancing and fault tolerance across different networks. SQL injection vulnerability exists in versions prior to Fortinet FortiWAN 4.5.9, which stems from a program that does not properly filter special elemen...

Pagekit SQL Injection Vulnerability

Pagekit is a modular, lightweight CMS content management system. pagekit has a SQL injection vulnerability, which can be exploited by attackers to execute illegal SQL commands to steal sensitive data from the database...

Reolink Rlc-410W Denial of Service Vulnerability (CNVD-2022-37386)

Reolink Rlc-410W is a Wifi security camera from Reolink China.A denial of service vulnerability exists in Reolink RLC-410W, which can be exploited by attackers to cause a reboot via a compiled HTTP request...

Jenkins Proxmox Plugin Information Disclosure Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.Jenkins Proxmox Plugin 0.5.0 and earlier...

Microweber Cross-Site Scripting Vulnerability (CNVD-2022-21818)

Microweber is a drag-and-drop online store management system from the Microweber community in the United States. The system includes modules for adding products, images, etc. A cross-site scripting vulnerability exists in Microweber 1.2.11 and earlier versions, which stems from a lack of filterin...

Jenkins GitLab Authentication Plugin User Redirection Vulnerability

Jenkins is a Jenkins open source application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.A user redirection vulnerability exists in Jenkins GitLab Authentication Plugin 1.13 and earlier versions, which stems fr...

Fortinet FortiPortal Security Feature Issue Vulnerability

Fortinet FortiPortal is an advanced, feature-rich managed security analysis and management support tool for Fortinet's FortiGate, FortiWiFi, and FortiAP product lines, available as a virtual machine for use by MSPs. versions, a security feature issue vulnerability exists that stems from the use o...