TOTOLINK N600R Command Injection Vulnerability (CNVD-2022-53552)

TOTOLINK N600R is a wireless router from Taiwan-based TOTOLINK, China.A command injection vulnerability exists in TOTOLINK N600R, which can be exploited by attackers to conduct command injection attacks via the devicemac parameter in /setting/setDeviceName...

Rancher Labs Rancher Access Control Error Vulnerability (CNVD-2022-65013)

Rancher Labs Rancher is an open source, enterprise-class container management platform from Rancher Labs, Inc. Rancher Labs Rancher is vulnerable to an access control error that could be exploited by an attacker to gain write access to directories when the restricted administrator role is enabled...

Apache CouchDB Access Control Error Vulnerability

Apache CouchDB is a document-oriented database system developed by the Apache Foundation using Erlang.An access control error vulnerability exists in versions prior to Apache CouchDB 3.2.2, which stems from a network system or product that does not properly restrict access to resources from...

Command Execution Vulnerability in Atlassian Bitbucket Data Center

Atlassian Bitbucket Data Center is the data center version of Atlassian Bitbucket by Atlassian Australia. Atlassian Bitbucket Data Center suffers from a command execution vulnerability that can be exploited by an attacker to execute arbitrary code via Java deserialization...

SWHKD has unspecified vulnerabilities

SWHKD is a hotkey daemon made with Rust that is independent of the display protocol. SWHKD has security vulnerabilities that can be exploited by attackers to perform arbitrary file presence tests with the -c option...

Microsoft Windows Kernel Information Disclosure Vulnerability (CNVD-2022-65612)

The Microsoft Windows Kernel is the kernel of the Windows operating system from the American company Microsoft. An information disclosure vulnerability exists in Microsoft Windows Kernel. The vulnerability arises from errors in configuration, etc. in the operation of a networked system or product...

WordPress MapPress Maps plugin authorization problem vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WordPress plugin is a WordPress open source application plugin. WordPress MapPress Maps plugin has an authorization problem vulnerability that stems from a lack of authentication measures or...

Directus Cross-Site Scripting Vulnerability (CNVD-2022-81371)

Directus is a live Api and application dashboard. Used to manage Sql database content, a cross-site scripting vulnerability existed prior to Directus version 9.7.0, which stems from the program's lack of data validation filtering of user-supplied data and output. An attacker could exploit this...

Gravitl Netmaker has an unspecified vulnerability

Gravitl Netmaker is a platform for creating and managing fast, secure and dynamic virtual overlay networks using WireGuard from Gravitl USA. Used to create and control automated virtual networks, Gravitl Netmaker contains a security vulnerability that could be exploited by an attacker to run...

Google Chrome Security Feature Issue Vulnerability (CNVD-2022-20551)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a security signature issue vulnerability that can be exploited by attackers to bypass security restrictions...

ffjpeg Denial of Service Vulnerability (CNVD-2022-12798)

ffjpeg is a JPEG encoder/decoder by the individual developer Kai Chen in China. A rejection vulnerability exists in ffjpeg, which originates when the size information in the metadata of a bmp is out of range, it returns without allocating a memory buffer to pb-pdata and without exiting the progra...

TP-Link AC1750 Input Validation Error Vulnerability

The Tp-link AC1750 is a wireless router from China P&L Tp-link. The TP-Link AC1750 suffers from an input validation error vulnerability that stems from a specific flaw in the NetUSB.ko module. The issue is caused due to a lack of proper validation of user-supplied data, which could result in an...

microweber cross-site request forgery vulnerability (CNVD-2022-12800)

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A cross-site request forgery vulnerability exists in microweber because the product does...

Radareorg Radare2 Buffer Overflow Vulnerability

radare2 is a set of libraries and tools for working with binary files. radareorg Radare2 suffers from a buffer overflow vulnerability that stems from the product's failure to effectively determine memory boundaries, which could be exploited by an attacker to cause a buffer overflow...

Radareorg Radare2 Resource Management Error Vulnerability (CNVD-2022-13389)

radare2 is a set of libraries and tools for working with binary files. radareorg Radare2 is vulnerable to a resource management error that stems from the product's reuse of released resources. No detailed vulnerability details are currently available...

Google Tensorflow has an unspecified vulnerability (CNVD-2022-09893)

Google TensorFlow is an end-to-end open source platform for machine learning from Google. Google TensorFlow has a security vulnerability that can be exploited to cause a denial of service by modifying SavedModel so that TensorByteSize triggers a CHECK failure...

Reolink RLC-410W Information Disclosure Vulnerability

Reolink Rlc-410W is a Wifi security camera from Reolink China. reolink RLC-410W in v3.0.0.13620121102 is vulnerable to information disclosure, which stems from information disclosure due to web server configuration errors. An attacker could use this vulnerability to obtain sensitive information...

Mozilla Rust ckb crate denial of service vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. versions prior to Rust ckb crate 0.40.0 have a security vulnerability that can be exploited by attackers to cause a denial of service...

Atomix has unspecified vulnerabilities

Atomix is a fault-tolerant distributed orchestration framework for JAVA 8. An unspecified vulnerability exists in Atomix version 3.1.5. The vulnerability allows malicious Atomix nodes to remove state from ONOS storage by abusing raw operations. No details of the vulnerability are currently...

Fortinet FortiWeb Buffer Overflow Vulnerability (CNVD-2021-101138)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. A buffer overflow vulnerability exists that...

WordPress WPSchoolPress Plugin Cross-Site Scripting Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress WPSchoolPress plugin prior to version 2.1.17, whi...

Google Chrome WebApp Installer improperly implemented vulnerability

Chrome is a web browsing tool developed by Google. versions prior to Google Chrome 95.0.4638.54 are vulnerable to an improper implementation of WebApp Installer. An attacker could potentially override and spoof the content of the multi-function box URL bar via a crafted HTML page...

Oracle VM VirtualBox Denial of Service Vulnerability (CNVD-2021-81790)

Oracle VM VirtualBox is a virtual machine management software from Oracle. A denial of service vulnerability exists in the Core component of Oracle VM VirtualBox versions prior to 6.1.28, which can be exploited by an attacker to cause Oracle VM VirtualBox to hang or crash frequently and repeatedl...

Portlandlabs Concrete5 server-side request forgery vulnerability

Portlandlabs Concrete5 is an open source content management system CMS from PortlandLabs, U.S. Portlandlabs Concrete5 server-side request forgery vulnerability can be exploited by attackers to retrieve HTTP and FTP files from internal server networks by inserting internal addresses...

Spotweb Cross-Site Scripting Vulnerability (CNVD-2021-83615)

Spotweb is a Php-based Soptnet client that follows the Spotnet protocol from the Spotweb team. 1.5.1 and previous versions of Spotweb have a cross-site scripting vulnerability that can be exploited by attackers to execute JavaScript code on the client side...

libjpeg null pointer dereference vulnerability (CNVD-2021-73918)

libjpeg is a free library written entirely in C to handle the JPEG image data format. libjpeg 2020021 and earlier versions of huffmandecoder.hpp contain a null pointer dereference vulnerability in the HuffmanDecoder::Get function. An attacker can exploit this vulnerability to cause a denial of...

Google Chrome Performance Manager code execution vulnerability

Google Chrome is a web browser from Google, Inc. A code execution vulnerability exists in Google Chrome Performance Manager. A remote attacker could use this vulnerability to execute arbitrary code on the system or cause a denial of service condition...

ImageMagick code issue vulnerability (CNVD-2022-05854)

ImageMagick is a set of open source image processing software. ImageMagick has a code problem vulnerability, the vulnerability stems from the product policy.xml file module policy exclusion Postscript file, an attacker can use the vulnerability to cause the file can be read and write...

Discourse Cross-Site Scripting Vulnerability (CNVD-2021-100594)

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features.Discourse suffers from a cross-site scripting vulnerability that can be exploited by attackers to conduct XSS attacks...

F5 BIG-IP TMUI Remote Command Execution Vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A remote command execution vulnerability exists in the F5 BIG-IP TMUI, which can be exploited by an authenticated attacker wi...

Dell EMC PowerScale OneFS OS Elevation of Privilege Vulnerability

Dell EMC PowerScale OneFS is an API-driven file system. security vulnerability exists in Dell EMC PowerScale OneFS version 8.2.-9.1.1.. An attacker could exploit the vulnerability to elevate privileges...

Siemens Jt2go and Siemens Teamcenter Visualization Out-of-Bounds Read Vulnerability (CNVD-2021-61121)

Siemens Jt2go is a JT file viewer. Siemens Teamcenter Visualization is a software that provides team collaboration capabilities for designing 2D and 3D scenes. A security vulnerability exists in Siemens Jt2go and Siemens Teamcenter Visualization, which stems from the lack of proper validation of...

Adobe Connect Security Feature Bypass Vulnerability

Adobe Connect is an online video conferencing software. A security feature bypass vulnerability exists in Adobe Connect 11.2.2 and earlier versions. The vulnerability stems from a violation of security design principles. No detailed vulnerability details are available at this time...

Libgd out-of-bounds read vulnerability (CNVD-2021-94953)

LibGD is an open source library for programmers to dynamically create images. an out-of-bounds read vulnerability exists in LibGD 2.3.2 and earlier. An attacker can exploit the vulnerability to cause a denial of service via specially crafted TGA files...

Nexus Control Panel Buffer Overflow Vulnerability (CNVD-2021-62180)

Swisslog Healthcare Nexus Panel, a medical device from Swisslog Healthcare, has a security vulnerability in versions prior to Nexus Control Panel 7.2.5.7. The vulnerability can be exploited to override the internal queue data structure, allowing for remote code execution...

Oracle Database Server has an unspecified vulnerability (CNVD-2022-09810)

Oracle Database Server is a relational database management system from Oracle Corporation USA. A security vulnerability exists in the Advanced Networking Option component of Oracle Database Server versions 12.1.0.2, 12.2.0.1, and 19c, which could be exploited to cause an attacker to take over...

WordPress Plugin Cross-Site Scripting Vulnerability (CNVD-2021-59594)

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. prismatic WordPress plugin version 2.8 prior to the...

PuTTY data forgery issue vulnerability

PuTTY is a free set of Telnet, Rlogin and SSH client software from Simon Tatham's personal developer. The software is primarily used for remote administration of Linux systems. PuTTY is vulnerable to a data forgery issue that could be exploited by an attacker to cause a controlled SSH server to...

gRPC Swift Resource Management Error Vulnerability

gRPC Swift is the open source Swift language implementation of gRPC, which includes a gRPC Swift API and code generator. The API and generated code are provided for gRPC clients and servers and can be built using Xcode or the Swift Package Manager. gRPC Swift contains a security vulnerability...

Keystone Engine Buffer Overflow Vulnerability

Keystone Engine is an assembler framework, and a security vulnerability exists in Keystone Engine version 0.9.2, which stems from a stack-based buffer overflow in "processClientServerHello". No details of the vulnerability are currently available...

RabbitMQ Cross-Site Scripting Vulnerability (CNVD-2021-49048)

RabbitMQ is a multi-protocol message broker. A cross-site scripting vulnerability exists in RabbitMQ versions prior to RabbitMQ 3.8.18 for rabbitmq-server. The vulnerability stems from the program not properly filtering the tag. An attacker can exploit this vulnerability to execute JavaScript cod...

Google TensorFlow Denial of Service Vulnerability (CNVD-2021-37632)

Google TensorFlow is an end-to-end open source machine learning platform. A security vulnerability exists in tf.rawops.SparseSplit in Google TensorFlow. A locally authenticated attacker can exploit this vulnerability to cause a denial of service condition...

Cisco HyperFlex HX Data Platform Access Control Error Vulnerability

Cisco HyperFlex HX Data Platform is a network appliance from Cisco USA. Provides enterprise-class agility, scalability, security and lifecycle management capabilities. An access control error vulnerability exists in Cisco HyperFlex HX Data Platform, which can be exploited by an attacker to upload...

jonfinley Monitorr authorization bypass vulnerability

jonfinley Monitorr is a jonfinley open source application. Used for webfront will display the status of any Web application or service in real time. monitorr version 1.7.6m has an authorization bypass vulnerability, which can be exploited by attackers to create valid credentials...

Siemens Nucleus Product IPv6 Stack Denial of Service Vulnerability (CNVD-2021-28696)

The Nucleus NET module includes a range of standards-compliant networking and communications protocols, drivers and utilities to provide full-featured networking support in any embedded device.Nucleus RTOS provides a highly scalable microkernel-based real-time operating system designed for...

Rust Buffer Overflow Vulnerability (CNVD-2021-28297)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in Rust that stems from the loss of uninitialized memory that sometimes occurs. No details of the vulnerability are provided at this time...

TYPO3 File Upload Vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Typo3 Association. A file upload vulnerability exists in TYPO3, which can be exploited by an attacker to upload arbitrary data with arbitrary file extensions...

Wazuh API Arbitrary Code Execution Vulnerability

Wazuh is a Wazuh open source application. Used to collect, aggregate, index and analyze security data to help organizations detect intrusions, threats and behavioral anomalies. Arbitrary code execution exists in the Wazuh API in Wazuh versions 4.0.0 through 4.0.3, which allows an authenticated...

Cisco Application Services Engine Unauthorized Access Vulnerability (CNVD-2021-12827)

Cisco Application Services Engine provides a common platform for deploying Cisco data center applications. An unauthorized access vulnerability exists in Cisco Application Services Engine 1.13d and earlier versions, which can be exploited by a remote, unauthenticated attacker to elevate access to...

Mozilla Rust rocket crate competitive conditions issue vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A contention condition issue vulnerability exists in rocket crate in versions of Mozilla Rust prior to 0.4.5, which stems from LocalRequest::clone creating multiple mutable references to the same object, which c...