JerryScript /js-parser-mem.c Denial of Service Vulnerability

JerryScript is a lightweight JavaScript engine from the JerryScript project.JerryScript has a denial-of-service vulnerability in version 3.0.0, which stems from an assertion failure in /parser/js/js-parser-mem.c. An attacker could use this vulnerability to launch a denial of service...

OnionShare out-of-bounds read vulnerability

OnionShare is an open source tool for securely and anonymously sharing files, hosting websites, and chatting with friends using the Tor network. OnionShare is vulnerable to an out-of-bounds read vulnerability that could be exploited by attackers to conduct denial-of-service attacks...

Google Android Information Disclosure Vulnerability (CNVD-2022-05479)

Google Android is a Linux-based open-source operating system from Google, Inc. Google Android is vulnerable to an information disclosure vulnerability that stems from a configuration error in the network system or product during operation. An attacker could use the vulnerability to obtain sensiti...

ILM OpenEXR Buffer Overflow Vulnerability

ILM OpenEXR is an image file format from Industrial Light and Magic ILM for high dynamic range HDR images. ILM OpenEXR is vulnerable to a buffer overflow vulnerability that can be exploited by attackers to cause a buffer overflow...

Rust flumedb crate has an unspecified vulnerability

Rust flumedb crate is a new architecture in which the Sunrise choir sink is a rewrite of JavaScript flumedb into rust to gain better performance and flexibility. a security vulnerability exists in Rust flumedb crate that stems from the fact that readentry can read data from an uninitialized memor...

MongoDB Server Denial of Service Vulnerability (CNVD-2021-101988)

Mongodb Server is an open source NoSQL database from Mongodb, Inc. The database provides collection-oriented storage, dynamic query, data replication and automatic failover, etc. A denial-of-service vulnerability exists in MongoDB Server, which can be exploited by an attacker with basic CRUD...

WordPress Pixel Cat plugin cross-site request forgery vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blogging sites on PHP and MySQL servers. Pixel Cat Plugin is a WordPress open source application plugin. WordPress Pixel Cat Plugins has a cross-site reques...

Fortinet FortiOS Trust Management Issue Vulnerability (CNVD-2021-100290)

Fortinet FortiOS is a security operating system from Fortinet, Inc. that is designed to be used on the FortiGate network security platform. A security vulnerability exists in Fortinet FortiOS, which stems from the use of hard-coded encryption keys that could allow an attacker to retrieve the keys...

TYPO3 HTTP header injection vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Typo3 association.TYPO3 suffers from an HTTP header injection vulnerability that stems from the lack of valid validation for HTTP host headers and is vulnerable to host spoofing. No detailed...

Google TensorFlow Input Validation Error Vulnerability (CNVD-2022-09874)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow suffers from an input validation error vulnerability that can be exploited by an attacker to cause an abort and denial of service related to a CHECK failure...

Google TensorFlow Input Validation Error Vulnerability (CNVD-2022-09875)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow suffers from an input validation error vulnerability that can be exploited by an attacker to cause a CHECK failure and crash...

Siemens Nucleus ReadyStart Denial of Service Vulnerability

Siemens Nucleus ReadyStart is a bundled solution from Siemens Germany. A denial-of-service vulnerability exists in Siemens Nucleus ReadyStart, which is used to accelerate the fast startup of complete systems and provides a rich board-level support package Bsp. The vulnerability stems from the...

ResourceSpace directory traversal vulnerability

ResourceSpace is a digital asset management tool that enables users to organize their digital assets. a directory traversal vulnerability exists in ResourceSpace. An attacker could exploit the vulnerability to delete arbitrary files on the ResourceSpace server via the provider and variant...

EC-CUBE improper access control vulnerability

EC-CUBE is an open source system for creating shopping websites. EC-CUBE version 2.11.2 - 2.17.1 contains an improper access control vulnerability in the administration interface. An attacker could use this vulnerability to change system settings without proper privileges...

Google Android Kernel Component Elevation of Privilege Vulnerability (CNVD-2021-101423)

Android is a Linux-based open source operating system developed by Google Inc. and the Open Handheld Alliance OHA for short. an elevation of privilege vulnerability exists in the Kernel component of Google Android, which could be exploited by an attacker to cause a local elevation of privilege...

Apache Storm Command Injection Vulnerability

Apache Storm is a free and open source distributed real-time computing system. A command injection vulnerability exists in Apache Storm's getTopologyHistory service. An attacker can exploit this vulnerability by sending a specially crafted thrift request to the Nimbus server to achieve remote cod...

bugs cross-site scripting vulnerability

Bugs is a branch of the open-source Tinyissue defect tracking system by Alexandre Plennevaux, a Belgian individual developer. bugs 1.8 and earlier versions of install/index.php are vulnerable to cross-site scripting, which can be exploited by remote attackers to inject arbitrary web scripts via...

Google Android Elevation of Privilege Vulnerability (CNVD-2021-80273)

Google Android is a Linux-based open-source operating system from the US company Google. Google Android has an elevation of privilege vulnerability that can be exploited by attackers to escalate privileges...

D-Link DIR-605L information leakage vulnerability

D-Link DIR-605L is the first cloud router launched by D-link with a transfer speed of 300Mpbs. The D-Link DIR-605L is vulnerable to information disclosure. An attacker can exploit the vulnerability by forging a post request to the /getcfg.php page to obtain a username and password...

Mozilla Rust Memory Corruption Vulnerability (CNVD-2021-71657)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in Rust hashconsing crate before 1.1.0, which stems from a limitation in HConsed's lack of sending or synchronization features, and could be exploited by an attacker to cause a...

Google Chrome WebRTC code execution vulnerability

Google Chrome is a web browser from Google, Inc. A code execution vulnerability exists in Google Chrome WebRTC. The vulnerability is caused by post-release use in WebRTC. A remote attacker could exploit this vulnerability to execute arbitrary code on the system or cause a denial of service...

Rundeck code issue vulnerability

Rundeck is an open source automation service with a Web console, command line tools, and WebAPI from Rundeck USA, which is primarily used to run automation tasks.A code issue vulnerability exists in Rundeck Enterprise Edition, which stems from the fact that an authenticated user can issue a POST...

Google TensorFlow code issue vulnerability (CNVD-2022-09856)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow suffers from a code issue vulnerability that stems from the fact that when recovering a tensor via the raw API, TensorFlow may be tricked into referencing a null pointer if the...

Google Chrome Post-release Reuse Vulnerability (CNVD-2021-68454)

Chrome is a web browsing tool developed by Google. A post-release reuse vulnerability exists in the Extensions API in versions of Google Chrome prior to 92.0.4515.159. An attacker could exploit this vulnerability to potentially cause heap corruption via a crafted HTML page...

Google TensorFlow Denial of Service Vulnerability (CNVD-2021-63069)

Google TensorFlow is an end-to-end open source machine learning platform. A security vulnerability exists in Google TensorFlow versions prior to 2.6.0. The vulnerability stems from the MLIR optimization of the L2NormalizeReduceAxis operator. An attacker can exploit the vulnerability to cause a...

Google TensorFlow tf.raw_ops.QuantizeV2 Information Disclosure Vulnerability

Google TensorFlow is an end-to-end open source machine learning platform. A security vulnerability exists in tf.rawops.QuantizeV2 in Google TensorFlow versions prior to 2.6.0. An attacker can exploit the vulnerability to obtain sensitive information...

PJSIP competition condition issue vulnerability

PJSIP is a free and open source multimedia communications library written in C that implements standards-based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE.A contention problem vulnerability exists in PJSIP, which stems from improper handling of concurrent access when concurrent code need...

Ubuntu Apport Backlink Vulnerability (CNVD-2021-57436)

Apport is a toolkit for collecting and giving feedback on error messages information that the operating system finds useful when an application crashes. A security vulnerability exists in Ubuntu Apport that stems from Apport incorrectly handling certain information-gathering operations, which can...

Ypsomed mylife App has an unspecified vulnerability

Ypsomed mylife App is an application of Ypsomed AG. To optimize communication between people with diabetes and healthcare professionals, mylife Therapy Management is an easy-to-use, easy-to-share solution for diabetes therapy data. mylife App by Ypsomed suffers from a security vulnerability that...

YSoft SafeQ 6 has an unspecified vulnerability

YSoft SAFEQ 6 FlexiSpooler is an application. A print management solution. A security vulnerability exists in YSoft SafeQ 6, which stems from incorrect privileges in the MU55 FlexiSpooler service in version 6.0.55 of YSoft SafeQ 6. An attacker could exploit the vulnerability to escalate local use...

Nextcloud Input Validation Error Vulnerability (CNVD-2022-20701)

An input validation error vulnerability exists in Nextcloud Server, which stems from the fact that DownloadResponse does not do security checks on uploaded file names, and could be exploited to trick users into downloading malicious files with normal file name...

Google Chrome suffers from an information disclosure vulnerability (CNVD-2021-47672)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from an information disclosure vulnerability. A remote attacker can exploit the vulnerability to obtain potentially sensitive information from process memory via specially crafted PDF files...

OpenEXR Logic Flaw Vulnerability

OpenEXR is an image file format for high dynamic range HDR images.A security vulnerability exists in OpenEXR, which stems from a flaw in the ImfDeepScanLineInputFile functionality. An attacker could use the upstairs to trigger an out-of-bounds read by submitting a harmful file to an application...

Google TensorFlow Denial of Service Vulnerability (CNVD-2021-37631)

Google TensorFlow is an end-to-end open source machine learning platform. A security vulnerability exists in Google TensorFlow. The vulnerability stems from an FPE runtime error in tf.rawops.SparseMatMul. An attacker can exploit the vulnerability to cause a denial of service...

CloudBees Jenkins P4 Plugin Access Control Error Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . An Access Control Error...

SaltStack Salt Elevation of Privilege Vulnerability

Saltstack SaltStack Salt is a set of open source tools for managing infrastructure from SaltStack Saltstack. The tool provides configuration management, remote execution, and other features. A security vulnerability exists in SaltStack Salt versions 2016.9 through 3002.6, which stems from a comma...

Lex Li vscode-restructuredtext access control error vulnerability

Lex Li vscode-restructuredtext is a Lex Li open source application. This extension provides rich reStructuredText language support for Visual Studio Code.An access control error vulnerability exists in versions prior to Lex Li vscode-restructuredtext 146.0.0, which stems from the inclusion of an...

Django Directory Traversal Vulnerability (CNVD-2021-45275)

Django is an advanced Python web framework that pushes rapid development and clean, functional design. A directory traversal vulnerability exists in MultiPartParser in Django. The vulnerability can be exploited to perform directory traversal via an uploaded file with a specially crafted filename...

Jupyter Notebook redirection vulnerability

Jupyter Notebook is an open source web application that allows you to create and share documents containing live code, equations, visualizations, and narrative text.A redirection vulnerability exists in versions prior to Jupyter Notebook 6.1.5. An attacker can exploit this vulnerability to redire...

WordPress Comment Mismanagement Vulnerability

WordPress is a blogging platform developed using the PHP language. Users can set up their own websites on servers that support PHP and MySQL databases, or use WordPress as a content management system CMS. A comment mismanagement vulnerability exists in wp-includes/comment-template.php in WordPres...

F5 BIG-IP Access Control Error Vulnerability (CNVD-2020-51797)

F5 BIG-IP is an application delivery platform from F5 Inc. that integrates network traffic management, application security management, load balancing, etc. Configuration utility is one of the configuration utilities. A security vulnerability exists in F5 BIG-IP. The vulnerability originates from...

WordPress has unspecified vulnerabilities (CNVD-2021-24379)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in WordPress, which can be exploited by attackers to inject JavaScript code to...

GNU Aspell Buffer Overflow Vulnerability

GNU Aspell is a free, open source spell checker. A stack buffer overflow vulnerability exists in acommon::unescape in common/getdata.cpp in libaspell.a in versions prior to GNU Aspell 0.60.8, which can be exploited by an attacker to cause, among other things, a buffer overflow or heap overflow...

Blueimp jQuery-File-Upload Arbitrary File Upload Vulnerability

Blueimp jQuery-File-Upload is a multi-language file upload tool that includes file selection, file drag and drop, progress bar display and image preview. An arbitrary file upload vulnerability exists in Blueimp jQuery-File-Upload 9.22.0 and earlier versions, which can be exploited by remote...

LibreOffice and Apache OpenOffice Information Disclosure Vulnerability (CNVD-2018-09235)

LibreOffice and Apache OpenOffice are both open source office software suites. The suite contains text documents, spreadsheets, presentations, drawings, databases and other software. The former by the Document Foundation The Document Foundation, TDF development; the latter by the U.S. Apache Apac...

MariaDB and Percona XtraDB Cluster Denial of Service Vulnerability

MariaDB is a free and open source database management system developed by Monty Program Ab, Inc. and the MariaDB Foundation, Inc. and a forked version of MySQL using the Maria storage engine.Percona XtraDB Cluster is a package for creating MySQL clusters. A security vulnerability exists in the...

OpenStack qemu-imge security bypass vulnerability

OpenStack is a cloud platform management program developed by the National Aeronautics and Space Administration and Rackspace, Inc. OpenStack qemu-imge is one of the installation images. A security bypass vulnerability exists in OpenStack qemu-imge. An attacker could use this vulnerability to...

Tenda M3 /goform/setInternetLanInfo File Heap Buffer Overflow Vulnerability

Tenda M3 is a wireless controller AC from Tenda, which is aimed at scenarios such as hotel chains, low-star hotels and small and medium-sized businesses. Tenda M3 heap buffer overflow vulnerability exists, the vulnerability stems from the file / goform / setInternetLanInfo function...

WordPress Blockspare plugin sensitive information insertion vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. The WordPress Blockspare plugin suffers from a sensitive information insertion vulnerability that originates from inserting sensitive information in sent data, which can be...

PDF-XChange Editor Heap Buffer Overflow Vulnerability (CNVD-2025-16305)

PDF-XChange Editor is a PDF-XChange company running on Microsoft Windows systems in the PDF file viewer software. PDF-XChange Editor suffers from a heap buffer overflow vulnerability that can be exploited by an attacker to execute code in the context of the current process...