131391 matches found
ffjpeg Denial of Service Vulnerability (CNVD-2022-12798)
ffjpeg is a JPEG encoder/decoder by the individual developer Kai Chen in China. A rejection vulnerability exists in ffjpeg, which originates when the size information in the metadata of a bmp is out of range, it returns without allocating a memory buffer to pb-pdata and without exiting the progra...
Huawei Emui Access Control Error Vulnerability
Huawei Emui is an Android-based mobile operating system developed by Huawei, a Chinese company. An access control error vulnerability exists in Huawei EMUI version 12.0.0, which stems from an unauthorized rewrite vulnerability in the memory access management module on the ACPU. An attacker can...
Tensorflow Input Validation Error Vulnerability (CNVD-2022-11209)
Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. An input validation error vulnerability exists in Tensorflow, which stems from the fact that the er component of TensorFlow is prone to integer overflow when estimating the cost of crop and resize, whic...
Denial of Service Vulnerability in Multiple Siemens Industrial Products (CNVD-2022-10003)
SIMATIC Drive Controller family products are machines designed for production automation, combining the functionality of the SIMATIC S7-1500 CPU and the SINAMICS S120 drive control.SIMATIC S7-1200 CPU family products are designed for discrete and continuous control in industrial environments such...
Siemens Simcenter Femap Stack Buffer Overflow Vulnerability (CNVD-2022-10011)
Siemens Simcenter Femap is a cutting-edge engineering simulation application from Siemens, Germany. Siemens Simcenter Femap is vulnerable to a stack buffer overflow when parsing NEU files, which could be exploited to execute code in the context of the current process...
Jerryscript ecma-typedarray-object.c Denial of Service Vulnerability
JerryScript is JerryScript Jerryscript project a lightweight JavaScript engine . A denial of service vulnerability exists in Jerryscript version 3.0.0, which originates from an assertion failure in ecmaobjectistypedarray objp in /jerry-core/ecma/operations/ecma-typedarray-object.c. An attacker...
Espruino has unspecified vulnerabilities
Espruino is a JavaScript interpreter. It is designed for devices with only 128kB flash memory and 8kB RAM.A security vulnerability exists in Espruino, which stems from the fact that Espruino 2v11.251 was found to contain a SEGV vulnerability via src jsinteractivec in jsiGetDeviceFromClass. No...
Oracle MySQL Cluster Buffer Overflow Vulnerability
Oracle MySQL is an open source relational database management system from Oracle Corporation. MySQL Cluster is a highly useful, highly redundant version of Oracle MySQL Cluster for distributed computing environments. Oracle MySQL Cluster is vulnerable to buffer overflow, which can be exploited to...
Oracle MySQL Cluster Input Validation Error Vulnerability (CNVD-2022-13061)
Oracle MySQL is an open source relational database management system from Oracle Corporation. MySQL Cluster is a highly useful, highly redundant version of Oracle MySQL Cluster for distributed computing environments. The vulnerability can be exploited to read memory content or crash an applicatio...
F5 BIG-IP code issue vulnerability (CNVD-2022-70627)
F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. F5 BIG-IP is vulnerable to a code issue that could be exploited by an attacker to cause a denial of service on the BIG-IP...
crosis information leakage vulnerability
crosis is a JavaScript client that uses the Replit container protocol. crosis is vulnerable to an information disclosure vulnerability that could be exploited by an attacker to obtain a token used to connect to Repl...
VMware ESXi Buffer Overflow Vulnerability
Vmware VMware ESXi is a server virtualization platform from Vmware that can be installed directly on physical servers. A buffer overflow vulnerability exists in several Vmware products, which stems from a failure of the product's CD-ROM device emulation feature to properly determine memory...
Huawei Emui and Magic UI configuration flaw vulnerability
Huawei Emui is an Android-based mobile operating system. magic Ui is an Android-based mobile operating system. Huawei Emui and Magic UI are vulnerable to a configuration flaw that could be exploited by attackers to elevate MEID IMEI privileges...
Netgear Nighthawk R6700 Command Injection Vulnerability
The Netgear Nighthawk R6700 is a wireless router from Netgear, Inc. A command injection vulnerability exists in the Netgear Nighthawk R6700, which stems from the fact that the product supports update checking via the soap interface and can be injected with a pre-set value. No details of the...
SAFARI Montage Cross-Site Scripting Vulnerability
SAFARI Montage is a formative assessment tool from safarimontage that enables teachers to check students' understanding of topics or concepts during the course. A cross-site scripting vulnerability exists in SAFARI Montage versions 8.3 and 8.5, which can be exploited by an attacker to execute...
Linux Kernel kvm_dirty_ring_get() function denial of service vulnerability
Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. Linux Kernel kvmdirtyringget suffers from a function denial of service vulnerability, which is caused by the kvmdirtyring function in virt/kvm/dirtyring.c without creating a vCPU. dirtyring function in...
Linux kernel buffer overflow vulnerability (CNVD-2022-69200)
Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. Linux kernel is vulnerable to buffer overflow, which can be exploited by local attackers to cause a buffer overflow and execute arbitrary code, or cause a denial of service condition on the system...
Apache JSPWiki Cross-Site Scripting Vulnerability (CNVD-2021-92465)
Apache JSPWiki is an open source WikiWiki engine built on Java, Servlet, and JSP from the Apache Foundation.A security vulnerability exists in Apache JSPWiki, which stems from a well-designed plugin link call that could trigger an XSS vulnerability in Apache JSPWiki related to Denounce...
Apache Ozone input validation error vulnerability
Apache Ozone is an application. A scalable, redundant and distributed object store for Hadoop and cloud-native environments, an input validation error vulnerability exists in Apache Ozone, which stems from the product's Ozone Datanode not checking the block token's access mode parameter. An...
Moodle Cross-Site Scripting Vulnerability (CNVD-2021-93379)
Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. cross-site scripting vulnerability exists in Moodle, which stems from the lack of effective filtering and escaping of URL parameters in...
D-Link DIR-823G Command Injection Vulnerability (CNVD-2021-85889)
D-Link DIR-823G is an AC1200M dual-band gigabit wireless router.A command injection vulnerability exists in the HNAP1 protocol in D-Link DIR-823G version 1.0.2B05. An attacker can execute arbitrary Web scripts using shell meta characters in the Captcha field of the login section...
Linux kernel array index out-of-bounds vulnerability
Linux kernel is a computer operating system kernel written in C and assembly language, POSIX-compliant, and distributed under the GNU General Public License. detachcapictr function in drivers/isdn/capi/kcapi.c in versions of Linux kernel prior to 5.14.15 is vulnerable to array index out-of-bounds...
Apache DB DdlUtils code issue vulnerability
Apache DB DdlUtils is a small, easy-to-use component from the Apache Foundation for working with database definition DDL files.A code issue vulnerability exists in Apache DB DdlUtils 1.0, which stems from an insecure BinaryObjectsHelper class that uses ObjectInputStream.readObject when failing to...
D-Link DIR-615 Buffer Overflow Vulnerability
The D-Link DIR-615 is a wireless router from D-Link, a Taiwan-based company. The security vulnerability in the D-Link DIR-615 stems from a network system or product that does not properly validate data boundaries when performing operations on memory, resulting in incorrect read and write operatio...
Siemens SINEC NMS Cross-Site Request Forgery Vulnerability
Siemens SINEC NMS is a network management system NMS from Siemens, Germany, that can be used 24/7 to centrally monitor, manage and configure industrial networks with tens of thousands of devices, including safety-related areas. A cross-site request forgery vulnerability exists in Siemens SINEC NM...
Aruba Networks ArubaOS Path Traversal Vulnerability (CNVD-2021-70117)
Aruba Networks ArubaOS is an operating system for Aruba Mobility-Defined Networks including mobile controllers and mobile access switches from Aruba Networks, Inc. The vulnerability is caused by a lack of validation and filtering of parameters, which could be exploited by an authenticated attacke...
Apache ServiceComb Service-Center path traversal vulnerability
Apache ServiceComb Service-Center is a Restful-based service registry from the Apache Foundation that provides microservice discovery and microservice management. Apache ServiceComb Service-Center is vulnerable to a path traversal vulnerability in version 1.x.x. The vulnerability stems from A...
SourceCodester Online Covid Vaccination Scheduler System SQL Injection Vulnerability (CNVD-2021-99649)
SourceCodester Online Covid Vaccination Scheduler System is an application from SourceCodester, Inc. efficiently manages COVID-19 vaccinations through a reliable vaccine scheduling and queue management solution. SourceCodester Online Covid Vaccination Scheduler System is vulnerable to SQL...
Command Execution Vulnerability in I Doc View Online Document Preview System
I Doc View Online Document Preview is an online document preview system. A command execution vulnerability exists in I Doc View Online Document Preview that can be exploited by an attacker to execute arbitrary commands...
sharkdp BAT code issue vulnerability
sharkdp BAT is an open source cat syntax highlighting and Git integrated cloning tool . A security vulnerability exists in sharkdp BAT prior to 0.18.2, which stems from the execution of less.exe from the current working directory. No details of the vulnerability are provided at this time...
Siemens Jt2go and Siemens Teamcenter Visualization Out-of-Bounds Writing Vulnerability (CNVD-2021-53346)
Siemens Jt2go and Siemens Teamcenter Visualization are both products of Siemens, a German company. Siemens Teamcenter Visualization is a software that provides team collaboration capabilities for designing 2D and 3D scenes. An out-of-bounds write vulnerability exists in Siemens JT2Go versions pri...
Siemens Jt2go and Siemens Teamcenter Visualization Out-of-Bounds Read Vulnerability (CNVD-2021-53349)
Siemens Jt2go and Siemens Teamcenter Visualization are both products of Siemens AG, Germany. Siemens Jt2go is a JT file viewer. An out-of-bounds read vulnerability exists in Siemens JT2Go versions prior to 13.2 and Teamcenter Visualization versions prior to 13.2. The vulnerability stems from a...
Autodesk Design Review Buffer Overflow Vulnerability (CNVD-2021-53945)
Autodesk Design Review ADR is a suite of AutoCAD drawing software assist software from Autodesk, Inc. The software supports viewing, marking, measuring, printing, and tracking changes to 2D and 3D design files.Autodesk Design Review is vulnerable to a buffer overflow vulnerability, which could be...
Terrafrost phpseclib data forgery issue vulnerability
Terrafrost phpseclib is a Terrafrost open source application. pure PHP implementation of the MIT license. A data forgery issue vulnerability exists in Terrafrost phpseclib versions prior to 2.0.31 and 3.x series versions prior to 3.0.7, which stems from incorrectly handling the RSA PKCS.No detail...
libvips Information Disclosure Vulnerability
libvips is a demand-driven multi-threaded image processing library. libvips versions prior to 8.8.2 are vulnerable to an information disclosure. The vulnerability stems from imvips2dz in /libvips/libvips/deprecated/imvips2dz.c in libvips having uninitialized variables. An attacker could use this...
Symantec Endpoint Detection
Symantec Endpoint Detection And Response uses AI, IR automation and threat intelligence to detect, find, isolate and eliminate intrusions across all endpoints. symantec Endpoint Detection...
MoinMoin Cross-Site Scripting Vulnerability
MoinMoin is a set of open source , scalable wiki engine program based on the Python environment . A cross-site scripting vulnerability exists in versions prior to MoinMoin 1.9.11, which can be exploited by an attacker to trigger cross-site scripting via an SVG attachment in order to run JavaScrip...
Nextcloud Desktop Client Cross-Site Scripting Vulnerability
Nextcloud is a suite of client-server software for creating file hosting services and using them.Nextcloud Desktop Client is the Nextcloud desktop client. A cross-site scripting vulnerability exists in Nextcloud Desktop Client 2.6.4. An attacker can exploit this vulnerability via an invalid serve...
TYPO3 Backend User Interface and Install Tool Component Cross-Site Scripting Vulnerability
TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. A security vulnerability exists in the Backend User Interface and Install Tool components in TYPO3 versions 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1. An attacker could exploit the...
Microsoft Win32k Elevation of Privilege Vulnerability (CNVD-2020-28432)
Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, U.S.A. Microsoft Windows is a set of operating systems for use on personal devices.Microsoft Windows Server is a set of server operating systems. win32k is the kernel part of one of the Windows subsystems, ...
Vanilla cross-site scripting vulnerability (CNVD-2020-04666)
Vanilla is an open source multi-language, fully extensible forum program. A cross-site scripting vulnerability exists in Vanilla version 2.6.3 in index.php?p = / dashboard / settings / branding. The vulnerability stems from a lack of proper validation of client-side data in the web application. A...
Django Account Hijacking Vulnerability
Django is an open source web application framework. Django suffers from an account hijacking vulnerability that can be exploited by an attacker to obtain a valid password reset token for a user account...
Ansible fetch module path traversal vulnerability
Ansible is a computer system configuration manager that can be used to publish, manage, and orchestrate computer systems. A path traversal vulnerability exists in the Ansible fetch module. An attacker can exploit this vulnerability to copy and overwrite files...
Apache HTTP Server Authorization Issues Vulnerability
Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. Apache HTTP Server is vulnerable to an authorization issue. The vulnerability stems from modsession detecting the expiration time ...
CloudBees Jenkins Code Issue Vulnerability
CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . LTS is a long-term support for...
VLC media player arbitrary code execution vulnerability (CNVD-2018-12841)
VLC media player is a well-known multimedia player that can play video and audio in many formats. An arbitrary code execution vulnerability exists in VLC media player that allows attackers to execute arbitrary code in the context of a logged-in user via a crafted MKV file...
WordPress Plugin Site Editor Local File Inclusion Vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.Site Editor plugin is used in one of the WYSIWYG front-end editor. A local file inclusion vulnerability exists in...
Jolokia Agent Cross-Site Scripting Vulnerability
Jolokia is a use of JSON via Http to achieve JMX remote management of open source projects , it provides JMX batch operation , security policies , etc. Jolokia agent is one of the agent . Jolokia agent 1.3.7 version of the HTTP servlet has a cross-site scripting vulnerability . A remote attacker...
Kubernetes Trust Management Issues Vulnerabilities
Kubernetes K8s is an open source system of Kubernetes open source for automating the deployment, scaling, and management of containerized applications. Kubernetes suffers from a trust management issue vulnerability that stems from the certificate validation logic not properly validating the chain...
TOTOLINK N300RB Command Injection Vulnerability
The TOTOLINK N300R is a wireless router for home and small office scenarios from Korean networking brand TOTOLINK. The TOTOLINK N300RB suffers from a command injection vulnerability that originates from the remote support feature of static key protection, which can be exploited by an attacker to...