Rust Resource Management Error Vulnerability (CNVD-2021-39556)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A resource management error vulnerability exists in Rust pyo3 crate versions prior to 0.12.4, which stems from a reference counting error and post-release usage in From . No details of the vulnerability are...

Red Hat Keycloak Server-Side Request Forgery Vulnerability

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in Red Hat Keycloak. The vulnerability stems from the possibility of forcing the server to request a uri call t...

Cross-site Request Forgery Vulnerability in Multiple NETGEAR Products (CNVD-2021-59162)

NETGEAR WAC505 and others are a wireless access point AP from NETGEAR, Inc. A cross-site request forgery vulnerability exists in several NETGEAR products. The vulnerability stems from the WEB application not adequately verifying that the request is from a trusted user. An attacker could use the...

WordPress BearDev JoomSport Plugin SQL Injection Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.BearDev JoomSport plugin is a plugin used in it to build sports sites. A SQL injection vulnerability exists in the WordPress...

Liferay Portal Cross-Site Scripting Vulnerability (CNVD-2019-16545)

Liferay Portal is a J2EE-based portal solution from Liferay, Inc. The solution uses EJB as well as JMS and other technologies , and can be used as a Web publishing and sharing workspaces , enterprise collaboration platforms , social networks and so on. A cross-site scripting vulnerability exists ...

Fortinet FortiOS Buffer Overflow Vulnerability

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. A buffer overflow vulnerability...

LIVE555 Buffer Overflow Vulnerability

LIVE555 is a set of open source C++ libraries for multimedia streaming. Live555 suffers from a buffer overflow vulnerability. The vulnerability stems from handleRequestBytes having an unrestricted memmove, which can be exploited to cause a denial of service via a large integer in the Content-Leng...

nginx denial of service vulnerability (CNVD-2018-22806)

nginx is a lightweight web server/reverse proxy server and email IMAP/POP3 proxy server. A security vulnerability exists in the HTTP/2 implementation in Nginx versions prior to 1.15.5 and 1.14.1. A remote attacker can exploit this vulnerability by sending a malicious request to cause a denial of...

Ansible Man-in-the-Middle Attack Vulnerability

Ansible is a computer system configuration manager from Ansible, Inc. that can be used to publish, manage and orchestrate computer systems. A security vulnerability exists in Ansible versions prior to 1.2.1 that stems from the program failing to cache SSH host keys. A remote attacker can exploit...

Joomla! PrayerCenter SQL Injection Vulnerability

Joomla! is an open source content management system CMS developed by the Open Source Matters team in the U.S. The system provides RSS feeds, site search, etc. PrayerCenter is used in one of the prayer sharing components. A SQL injection vulnerability exists in Joomla! PrayerCenter version 3.0.2. ...

The Sleuth Kit Buffer Overflow Vulnerability (CNVD-2017-28572)

The Sleuth Kit TSK is a collection of data forensic tools developed by software developer Brian Carrier. The tools are able to analyze file systems such as FAT, NTFS, UFS, etc. and provide detailed information about the file system, including deleted data. A buffer overflow vulnerability exists i...

libgit2 Buffer Overflow Vulnerability

libgit2 is a portable, C implementation of the Git core development package . A buffer overflow vulnerability exists in the smartpkt.c file in libgit2. An attacker could exploit this vulnerability to execute arbitrary code in the context of an affected application, resulting in a denial of servic...

libgit2 Denial of Service Vulnerability

libgit2 is a portable, pure C implementation of the Git development package , as a reentrant link library with a solid API , libgit2 allows you to use any language to write Git applications . A denial of service vulnerability exists in libgit2. An attacker can exploit this vulnerability to crash...

RT-Thread Input Validation Error Vulnerability (CNVD-2025-16524)

RT-Thread is an open source IoT real-time operating system RTOS open-sourced by RT-Thread. RT-Thread suffers from an input validation error vulnerability that originates from the operation of the parameter how in the file rt-thread/components/lwp/lwpsyscall.c, which can be exploited by an attacke...

Google Chrome Resource Management Error Vulnerability

Google Chrome is a popular web browser. Google Chrome suffers from a resource management error vulnerability, which stems from a post-release reuse of a media component, that can be exploited by an attacker to cause an application to crash or execute arbitrary code in the context of the applicati...

Google Chrome heap buffer overflow vulnerability (CNVD-2025-09156)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a heap buffer overflow vulnerability that can be exploited by an attacker to submit a special Web request that can be tricked into being parsed by the user, crashing the application or executing arbitrary...

YesWiki cross-site scripting vulnerability (CNVD-2025-03330)

YesWiki is a wiki system written in PHP by the French organization YesWiki. It is used to create and manage websites in a collaborative way. A cross-site scripting vulnerability exists in YesWiki 4.4.5 and earlier versions, which stems from improper input validation when the attach component...

Microsoft GroupMe Access Control Error Vulnerability

Microsoft GroupMe is a confidential group messaging service from Microsoft. Users can conduct and manage SMS group chat via cell phone SMS or client. Microsoft GroupMe suffers from an Access Control Error vulnerability that stems from improper access control. An attacker could exploit the...

Apache Commons Configuration Out-of-Bounds Write Vulnerability

Apache Commons Configuration is the United States Apache Apache Foundation , a common configuration interface , it is mainly used to enable Java applications to read configuration data from a variety of sources . An out-of-bounds write vulnerability exists in Apache Commons Configuration versions...

Apache Superset SQL Injection Vulnerability (CNVD-2024-0102192)

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset suffers from a SQL injection vulnerability that can be exploited by an authenticated, remote attacker to send specially crafted SQL statements to the wherein JINJA macro...

Siemens User Management Component (UMC) Classic Buffer Overflow Vulnerability

Opcenter Quality is a quality management system QMS that enables organizations to safeguard compliance, optimize quality, reduce the cost of defects and rework, and achieve operational excellence by improving process stability. simatic pcs neo is a distributed control system DCS. the SINUMERIK...

Google Android Code Execution Vulnerability (CNVD-2024-07123)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from a code execution vulnerability that is caused by the use of callbackthreadevent after release in the comAndroidbluetoothbtserviceAdapterService.cpp script. An attacker can exploit this...

Foxit Reader Memory Misreference Vulnerability (CNVD-2023-96091)

Foxit Reader is a Chinese Foxit Foxit company's a PDF document reader. A memory misreference vulnerability exists in Foxit Reader before version 12.1.2.15356, which can be exploited by an attacker to execute arbitrary code on the system...

Apache InLong Data Forgery Issue Vulnerability

Apache InLong is the U.S. Apache Apache Foundation's one-stop massive data integration framework. Provides automated, secure and reliable data transfer capabilities. Apache InLong versions 1.4.0 through 1.8.0 are vulnerable to a data forgery issue that arises from a networked system or product th...

Microsoft Exchange Server Remote Code Execution Vulnerability (CNVD-2023-72227)

Microsoft Exchange Server is the United States Microsoft Microsoft company's set of e-mail service program. It provides e-mail access, storage, forwarding, voice mail, e-mail filtering and screening. A remote code execution vulnerability exists in Microsoft Exchange Server, which can be exploited...

Microsoft Exchange Server Remote Code Execution Vulnerability (CNVD-2023-72224)

Microsoft Exchange Server is the United States Microsoft Microsoft company's set of e-mail service program. It provides e-mail access, storage, forwarding, voice mail, e-mail filtering and screening. A remote code execution vulnerability exists in Microsoft Exchange Server, which can be exploited...

Microsoft Dynamics Business Central Elevation of Privilege Vulnerability

Microsoft Dynamics Business Central is an enterprise resource planning system from Microsoft. The system includes features such as financial management, project management and supply chain management. An elevation of privilege vulnerability exists in Microsoft Dynamics Business Central, which can...

Discourse cross-site scripting vulnerability (CNVD-2023-60471)

Discourse is an open source community discussion platform. The platform includes features such as community, email and chat rooms. Discourse suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data, which ca...

Microsoft Excel Information Disclosure Vulnerability (CNVD-2023-80153)

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. An information disclosure vulnerability exists in Microsoft Excel, which can be exploited by attackers to obtain sensitive information...

Siemens Tecnomatix Plant Simulation Out-of-Bounds Write Vulnerability (CNVD-2023-56537)

Siemens Tecnomatix Plant Simulation is an industrial control device from Siemens, Germany, that uses discrete-event simulation to analyze and optimize throughput and thereby improve manufacturing system performance. Siemens Tecnomatix Plant Simulation suffers from an out-of-bounds write...

Siemens Tecnomatix Plant Simulation Heap Buffer Overflow Vulnerability (CNVD-2023-56538)

Siemens Tecnomatix Plant Simulation is an industrial control device from Siemens, Germany, that uses discrete-event simulation to analyze and optimize throughput and thereby improve manufacturing system performance. Siemens Tecnomatix Plant Simulation suffers from a heap buffer overflow...

ChurchCRM Cross-Site Scripting Vulnerability (CNVD-2023-64494)

ChurchCRM is an open source Church CRM and management software. A cross-site scripting vulnerability exists in ChurchCRM version 4.5.3, which can be exploited by an attacker to inject malicious JavaScript scripts...

Apache InLong Code Execution Vulnerability

Apache InLong is the United States Apache Apache Foundation's one-stop massive data integration framework. A code execution vulnerability exists in Apache InLong versions 1.4.0 through 1.6.0, which can be exploited by an attacker to execute arbitrary code on a system...

Siemens TIA Portal Path Traversal Vulnerability (CNVD-2023-35760)

Siemens TIA Portal is a fully integrated automation portal from Siemens, Germany.TIA Portal gives you unlimited access to the full range of digital automation services, from digital planning to integrated engineering and transparent operation. A path traversal vulnerability exists in Siemens TIA...

Online Payroll System Cross-Site Scripting Vulnerability

Online Payroll System is a system for distributing payroll online. A cross-site scripting vulnerability exists in Online Payroll System. The vulnerability stems from the lack of effective filtering and escaping of user-supplied data in /admin/employeeedit.php, which can be exploited to execute...

Delta Electronics InfraSuite Device Master Deserialization Vulnerability (CNVD-2023-23883)

Delta Electronics InfraSuite Device Master is a device for simplifying and automating the monitoring of critical equipment from Delta Electronics of Taiwan, China. A deserialization vulnerability exists in Delta Electronics InfraSuite Device Master versions prior to 1.0.5, which can be exploited ...

Delta Electronics InfraSuite Device Master Path Traversal Vulnerability (CNVD-2023-23884)

Delta Electronics InfraSuite Device Master is Delta Electronics' device for simplifying and automating critical equipment monitoring. A path traversal vulnerability exists in Delta Electronics InfraSuite Device Master versions prior to 1.0.5, which can be exploited by an attacker to read local...

Siemens Mendix SAML Module Certification Bypass Vulnerability (CNVD-2023-17659)

The Mendix SAML Module allows the use of SAML to authenticate users in cloud applications. The module can communicate with any identity provider that supports SAML 2.0 or Shibboleth. An authentication bypass vulnerability exists in Siemens Mendix SAML Module, which stems from inadequate validatio...

Google Chrome Navigation component code issue vulnerability

Google Chrome is a web browser from Google, an American company. A code issue vulnerability exists in versions prior to Google Chrome 111.0.5563.64, which stems from a weak policy enforcement issue in the Navigation component. A remote attacker can exploit the vulnerability to bypass the...

Apache Airflow Google Provider Input Validation Error Vulnerability (CNVD-2023-88040)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An input validation error vulnerability exists in Apache Airflow Google Provider...

Nextcloud Resource Management Error Vulnerability (CNVD-2023-04308)

Nextcloud is an open source, self-hosted file synchronization and sharing communication application platform from Nextcloud Germany. nextcloud Deck is vulnerable to a resource management error, which stems from a database error that can be generated when executed multiple times, leading to a DoS...

Mozilla Firefox Trust Management Issue Vulnerability (CNVD-2023-05204)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the U.S. Mozilla Firefox is vulnerable to trust management issues, which can be exploited by attackers to read and modify data...

Mozilla Firefox Access Control Error Vulnerability (CNVD-2023-03068)

Mozilla Firefox is an open source Web browser from the Mozilla Foundation in the U.S. An access control error vulnerability exists in Mozilla Firefox, which stems from the Remote Agent used in WebDriver not validating the Host or Origin header. An attacker could exploit the vulnerability to force...

Siemens Simcenter STAR-CCM Privilege Elevation Vulnerability

Siemens Simcenter STAR-CCM is a complete multi-physics field solution from Siemens Germany that simulates products and designs working under real-world conditions. a security vulnerability exists in Siemens Simcenter STAR-CCM, which stems from improperly assigning file permissions to installation...

APsystems Access Control Error Vulnerability

APsystems is a microinverter from APsystems, Inc. Combining high efficiency power conversion with a user-friendly monitoring interface, it brings you reliable and smart energy. An access control error vulnerability exists in APsystems ENERGY COMMUNICATION UNIT ECU-C Power Control Software version...

Chocolatey Cmder has an unspecified vulnerability

Chocolatey Cmder is a package open sourced by Chocolatey. Chocolatey Cmder v1.3.20 and earlier versions contain a security vulnerability. An attacker could gain write access to the path C:\tools\Cmder and all files located in that folder for all users in the Authenticated Users group...

Fastify Cross-Site Request Forgery Vulnerability

Fastify is an OpenJS Foundation open source web framework for Node.js. Fastify A cross-site request forgery vulnerability exists in Fastify versions 3.0.0 and later, 3.29.4 and earlier, 4.0.0 and later, 4.10.2 and earlier, which can be exploited by an attacker to launch a cross-site request forge...

Online Leave Management System SQL Injection Vulnerability (CNVD-2022-80690)

Online Leave Management System is an online leave management system. version v1.0 of Online Leave Management System has a security vulnerability that originated through the component /admin/?page=user/manageuser&id= found to contain a SQL injection vulnerability. No detailed vulnerability details...

Apache MINA Deserialization Vulnerability

Apache MINA is the United States Apache Apache Foundation of a web application framework. The product is mainly used to develop high-performance and highly scalable web applications. Apache MINA 2.9.1 and earlier versions suffer from a deserialization vulnerability that stems from the use of Java...

Google Chrome V8 Code Execution Vulnerability (CNVD-2022-85092)

Google Chrome is a web browser from Google, Inc. A security vulnerability exists in Google Chrome that could be exploited by attackers to execute arbitrary code or cause a denial of service on a system...