Nextcloud Android app access control error vulnerability

Nextcloud Android app is an Android-based mobile application from Nextcloud Germany for accessing Nextcloud servers. nextcloud Android app versions prior to 3.19.1 contain an access control error vulnerability that stems from improper access control, which is exploited by An authenticated attacke...

WordPress UpdraftPlus WordPress Backup plugin跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. WordPress plugin is a WordPress open source application plugin. WordPress UpdraftPlus WordPress Backup plugin...

ZoneMinder Cross-Site Scripting Vulnerability (CNVD-2022-57833)

ZoneMinder is an open source video surveillance software system. ZoneMinder 1.32.3 and earlier versions have a cross-site scripting vulnerability, which stems from the fact that the program is not properly filtered and can be exploited by remote attackers to execute HTML or JavaScript code with t...

CKEditor4 authentication vulnerability

An authentication vulnerability exists in CKEditor4, an open source HTML editor, in the "Dialog Box" plug-in. The vulnerability allows misuse of the dialog input validator regular expression, which can cause significant performance degradation, leading to browser tab freezes. No details of the...

Linux kernel io-workqueue denial of service vulnerability

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. Linux kernel versions prior to 5.15-rc1 have a denial-of-service vulnerability that stems from a false cancel operation that triggers the commit of a new io-uring, resulting in a kernel error. An attacke...

Tongda2000 SQL Injection Vulnerability (CNVD-2022-71114)

Tongda2000 is a web-based intelligent office system from Tongda, China. a SQL injection vulnerability exists in Tongda2000 v11.10, which stems from the product's failure to effectively filter the special characters in the DELETESTR parameter of the delete.php file. An attacker could use this...

libxml2 Resource Management Error Vulnerability (CNVD-2022-21487)

libxml2 is an open source library for parsing XML documents. It is written in C and can be called by multiple languages, such as C, C, XSH. libxml2 suffers from a resource management error vulnerability that can be exploited by attackers to threaten alerts that affect software or systems...

Tenda G1 and G3 Buffer Overflow Vulnerability (CNVD-2022-16168)

The Tenda G1 and G3 are routers from the Chinese company Tenda. A buffer overflow vulnerability exists in the Tenda G1 and G3 that can be exploited by an attacker to cause a denial of service via the staticRouteNet, staticRouteMask, and staticRouteGateway parameters...

Siemens Simcenter Femap Buffer Overflow Vulnerability

Simcenter Femap is an advanced simulation application for creating, editing, and inspecting finite element models of complex products or systems.Siemens Simcenter Femap buffer overflow vulnerability can be exploited by attackers to execute code in the context of the current process...

snapd input validation error vulnerability

Snapd is an open source, cross-platform package management tool. snapd is vulnerable to an input validation error that could be exploited to allow snap to escape strict snap restrictions by injecting arbitrary AppArmor policy rules through misformatted content interfaces and layout statements...

Google TensorFlow Input Validation Error Vulnerability (CNVD-2022-14991)

TensorFlow is an end-to-end open source platform for machine learning from Google. Google TensorFlow is vulnerable to an input validation error that could be exploited by an attacker to crash the system...

Jenkins SWAMP Plugin Access Control Error Vulnerability

Jenkins plug-ins are plug-ins that provide functionality for Jenkins. The Jenkins SWAMP Plugin Access Control Error vulnerability can be exploited by an attacker to connect to the attacker's specified web server using the attacker's specified credentials...

Google TensorFlow Input Validation Error Vulnerability (CNVD-2022-11505)

Google TensorFlow is an end-to-end open source platform for machine learning from Google USA. Google Tensorflow is vulnerable to an input validation error, which can be exploited by attackers to cause a denial of service...

Command Execution Vulnerability in Sunflower Personal Edition for Windows at Shanghai Berry Information Technology Co.

Sunflower is a free, all-in-one remote control management tool software that integrates remote control of computer and cell phone, remote desktop connection, remote boot, remote management, and intranet penetration support. Ltd. Sunflower Personal Edition for Windows has a command execution...

TSG Tokheim Profleet DiaLOG Fuel Management System SQL Injection Vulnerability

TSG Tokheim Profleet DiaLOG Fuel Management System is a fuel management system from TSG UK.A SQL injection vulnerability exists in TSG Tokheim Profleet DiaLOG Fuel Management System, which can be exploited by attackers to cause remote code execution as root user...

Tensorflow Input Validation Error Vulnerability (CNVD-2022-11209)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. An input validation error vulnerability exists in Tensorflow, which stems from the fact that the er component of TensorFlow is prone to integer overflow when estimating the cost of crop and resize, whic...

PrinterLogic Web Stack Insecure Direct Object Reference (IDOR) Vulnerability (CNVD-2022-11105)

PrinterLogic Web Stack PrinterLogic Printer Installer is a native Web application from PrinterLogic, Inc. It enables the It department to manage and automatically create/propagate PrinterObjects and printer drivers across print environments from a single management console. PrinterLogic Web Stack...

Linux kernel denial-of-service vulnerability (CNVD-2022-07641)

Linux kernel is the kernel used by the Linux Foundation's open source operating system, Linux, of which KVM is a kernel-based virtual machine. Linux kernel suffers from a denial-of-service vulnerability, which stems from the possibility that the KVM subsystem may mishandle a memory error that...

libspf2 buffer overflow vulnerability (CNVD-2022-19088)

libspf2 is a library that allows email systems such as Sendmail, Postfix, Exim, Zmailer, and MS Exchange to check SPF records and ensure that an email is authorized from its domain. This prevents email forgery commonly used by spammers, scammers and email viruses/worms. libspf2 suffers from a...

Oracle MySQL Cluster Buffer Overflow Vulnerability

Oracle MySQL is an open source relational database management system from Oracle Corporation. MySQL Cluster is a highly useful, highly redundant version of Oracle MySQL Cluster for distributed computing environments. Oracle MySQL Cluster is vulnerable to buffer overflow, which can be exploited to...

JerryScript lit-strings.c denial-of-service vulnerability

JerryScript is a lightweight JavaScript engine from the JerryScript project.JerryScript has a denial-of-service vulnerability in version 3.0.0, which stems from an assertion failure in /jerry-core/lit/lit-strings.c. An attacker could use this vulnerability to launch a denial of service...

Apache ShardingSphere Information Disclosure Vulnerability

Apache ShardingSphere is an open source distributed database middleware solution from the Apache Foundation.Apache ShardingSphere ElasticJob-UI is vulnerable to an information disclosure vulnerability that stems from the exposure of sensitive information to unauthorized participants, which could ...

Google Android out-of-bounds write vulnerability (CNVD-2022-06897)

Google Android is a Linux-based open source operating system from Google, Inc. A security vulnerability exists in Google Android that could be exploited by attackers to remotely elevate privileges without additional executive privileges...

Mozilla Rust has an unspecified vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. a security vulnerability exists in versions of Rust smallvec crate prior to 0.6.13, which stems from the fact that it can create uninitialized values of any type, including reference types. No details of the...

cve-search has an unspecified vulnerability

Cve-Search is a tool that performs local searches for known vulnerabilities. It is used for searching, indexing, correlating and managing software vulnerabilities. cve-search versions prior to 4.1.0 have a security vulnerability that stems from lib/DatabaseLayer.py allowing regular expression...

Blackmagic Design DaVinci Resolve Buffer Overflow Vulnerability

Blackmagic Design DaVinci Resolve is an all-in-one software tool for editing, color correction, visual effects, motion graphics and audio post-production.Blackmagic Design DaVinci Resolve 17.3.1.0005 is vulnerable to a buffer overflow vulnerability that could be exploited by attackers to execute...

Microsoft Defender for IoT Remote Code Execution Vulnerability (CNVD-2022-04003)

Microsoft Defender for IoT is an asset discovery, vulnerability management, and threat monitoring solution for IoT/OT environments.Microsoft Defender for IoT suffers from a remote code execution vulnerability. An attacker could exploit this vulnerability to execute code on the target host...

Mozilla Firefox Access Control Error Vulnerability (CNVD-2021-99623)

Mozilla Firefox is an open source Web browser from the Mozilla Foundation. Mozilla Firefox has an access control error vulnerability that originates when the Web extension directory is reloaded and the application fails to prevent the Web extension from accessing the redirected URL of the click...

Nodebb licensing issue vulnerability

NodeBB is a forum system built by the Design Create Play team using Node.js, a web application platform built on top of Google's V8 JavaScript engine. an authorization issue vulnerability exists in Nodebb, which stems from a faulty token authentication logic in the product, and could be exploited...

Multiple Huawei products weak security algorithm vulnerabilities

Huawei USG9500 is a data center firewall product, Huawei IPS Module is an Intrusion Prevention System IPS module, and NGFW Module is a Next Generation Firewall NGFW module. A security vulnerability exists in several Huawei products due to the use of weak security encryption algorithms when...

SmarterMail Remote Code Execution Vulnerability

SmarterMail is the award-winning email, collaboration and group chat server that easily meets the needs of businesses of any size, from individual business owners to large corporations and enterprise organizations. With lower hardware requirements, superior stability and lower maintenance costs,...

Multiple Siemens products with integer underflow vulnerability

Capital VSTAR is a complete solution. the Nucleus NET module integrates a range of standards-compliant networking and communications protocols, drivers and utilities to provide full-featured networking support in any embedded device. the Nucleus RTOS is a microkernel-based real-time operating...

Microsoft Exchange Server Spoofing Vulnerability (CNVD-2021-101659)

Microsoft Exchange Server is a mail server and calendar server developed by Microsoft. A spoofing vulnerability exists in Microsoft Exchange Server. No detailed vulnerability details are provided at this time...

Unspecified Vulnerability in FortiManager

Fortinet FortiManager is a centralized network security management platform from Fortinet. The platform supports centralized management of any number of Fortinet devices, and can group devices into different management domains ADOM to further simplify the deployment and management of multi-device...

Mozilla Rust memory leak vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. Mozilla Rust is vulnerable to a memory leak that could be exploited by attackers to read memory from an uninitialized buffer...

Mozilla Rust Competition Condition Issue Vulnerability (CNVD-2021-85289)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. spacejam mode of Mozilla Rust is vulnerable to a contention condition issue that could be exploited by an attacker to allow secure Rust code to trigger data contention...

fig2dev stack buffer overflow vulnerability (CNVD-2021-68461)

fig2dev is used to convert .fig files to various graphics languages and formats. A stack buffer overflow vulnerability exists in the genpstrxtext component of genpstricks.c in fig2dev version 3.2.7b. An attacker could exploit this vulnerability to cause a denial of service by converting xfig file...

WordPress Astra Pro Addon Plugin SQL Injection Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in WordPress Astra Pro Addon Plugin versions prior to 3.5.2, which stems...

Hotel Druid SQL Injection Vulnerability

Hotel Druid is an open source application for hotel management developed by DigitalDruid.Net. A security vulnerability exists in Hotel Druid version 3.0.2, which stems from the fact that malicious attackers can exploit the vulnerability to issue SQL commands to SQLite databases via the vulnerable...

TYPO3 Cross-Site Scripting Vulnerability (CNVD-2022-17987)

TYPO3 is a free and open source content management system framework CMS/CMF from the TYPO3 Typo3 association in Switzerland.TYPO3 suffers from a cross-site scripting vulnerability that stems from the fact that when the settings of the back-end layout are not properly coded, the corresponding grid...

Adobe Character Animator Memory Out-of-Bounds Access Vulnerability

Adobe Character Animator is a motion capture and animation tool that provides everyone with an easy-to-use solution for intuitive 2D character animation, real-time animation, and easy sharing and publishing of characters. A memory out-of-bounds access vulnerability exists in Adobe Character...

Microsoft Visual Studio Spoofing Vulnerability (CNVD-2021-54406)

Microsoft Visual Studio is a family of development tools from Microsoft Corporation USA and is a largely complete development toolset that includes most of the tools needed throughout the software lifecycle. An attacker could exploit this vulnerability with a specially crafted website to spoof...

gRPC Swift Resource Management Error Vulnerability

gRPC Swift is the open source Swift language implementation of gRPC, which includes a gRPC Swift API and code generator. The API and generated code are provided for gRPC clients and servers and can be built using Xcode or the Swift Package Manager. gRPC Swift contains a security vulnerability...

Rukovoditel cross-site scripting vulnerability (CNVD-2021-50935)

Rukovoditel is a free web-based open source project management application. A stored cross-site scripting vulnerability exists in the 'User Alerts' feature in Rukovoditel version 2.7.2, which can be exploited to execute arbitrary web script or HTML via the 'Title' parameter...

Google TensorFlow code issue vulnerability (CNVD-2021-48859)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A code issue vulnerability exists in Google TensorFlow 2.4.2, 2.3.3, 2.2.3, 2.1.4, which can be exploited by an attacker to cause dereferencing of null pointers...

ForgeRock AM code issue vulnerability

ForgeRock AM is an open source access management, privilege control platform with widespread use in universities and social organizations.ForgeRock AM is vulnerable to a code issue that could be exploited by an unauthenticated attacker to remotely execute arbitrary code by constructing a special...

Securepoint SSL VPN Client Access Control Error Vulnerability

Securepoint SSL VPN Client is an open source SSL VPN client for Windows. An access control error vulnerability exists in Securepoint SSL VPN Client v2, which arises from a failure to secure the software's configuration features. An attacker can escalate local privileges to NT AUTHORITYSYSTEM to...

Auth0 Cross-Site Scripting Vulnerability

Auth0 is is an authentication agent that supports social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce. Auth0-lock suffers from a cross-site scripting vulnerability in versions prior to 11.30.0 that can be exploited by an attacker to execute...

Http4s path traversal vulnerability (CNVD-2021-44963)

Http4s is an open source for Scala streaming HTTP server . Http4s has a path traversal vulnerability that can be exploited by an attacker to obtain sensitive information...

Siemens Nucleus Product IPv6 Stack Denial of Service Vulnerability (CNVD-2021-28696)

The Nucleus NET module includes a range of standards-compliant networking and communications protocols, drivers and utilities to provide full-featured networking support in any embedded device.Nucleus RTOS provides a highly scalable microkernel-based real-time operating system designed for...