Linux kernel nfsd4_decode_bitmap() buffer overflow vulnerability

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. Linux kernel nfsd4decodebitmap has a buffer overflow vulnerability that could be exploited by an attacker to access out-of-bounds memory, resulting in a threat to system integrity and confidentiality...

Apache Kylin server-side request forgery vulnerability

Apache Kylin is an open source distributed analytic data warehouse from the Apache Foundation. The product mainly provides Hadoop/Spark on top of the SQL query interface and multidimensional analysis OLAP and other functions. Apache kylin has a server-side request forgery vulnerability, which ste...

Wireshark Injection Vulnerability (CNVD-2022-11197)

Wireshark formerly known as Ethereal is a suite of network packet analysis software from the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis. Wireshark version 3.6.0 suffers from an injection vulnerability that stems from a crash...

Trendnet AC2600 TEW-827DRU Information Disclosure Vulnerability

Trendnet AC2600 TEW-827DRU is a wireless router. Trendnet AC2600 TEW-827DRU is vulnerable to an information disclosure vulnerability that stems from a failure to properly disclose credentials for the device's smb functionality. An attacker could exploit the vulnerability to display all mb account...

Mozilla Rust actix-web crate memory corruption vulnerability

Rust actix-web crate is a Rust web framework. security vulnerability exists in Mozilla Rust actix-web crate versions prior to 0.7.15, which can be exploited by attackers to cause memory corruption...

Mozilla Rust libpulse-binding crate memory corruption vulnerability

Rust libpulse-binding crate is a repository containing sys FFI and binding libraries crates for connecting to PulseAudio PA from the Rust programming language.Mozilla Rust libpulse-binding crate memory corruption vulnerability, which stems from a security flaw in A security vulnerability exists i...

Mozilla Rust actix-web crate memory corruption vulnerability

Rust actix-web crate is a Rust web framework. a security vulnerability exists in versions of Rust actix-web crate prior to 0.7.15, which stems from the fact that it can unreasonably prolong the life cycle of a string, which can be exploited by an attacker to cause memory corruption...

Siemens Syngo FastView Out-of-Bounds Writing Vulnerability (CNVD-2022-56511)

Siemens Syngo FastView is a standalone viewer of Dicom 2 images available on Dicom exchange media from Siemens, Germany. An out-of-bounds write vulnerability exists in Siemens Syngo FastView, which stems from a lack of proper validation of user-supplied data when parsing BMP files. An attacker...

Google Chrome ANGLE security bypass vulnerability

Google Chrome is a web browser from Google, Inc. A security vulnerability exists in Google Chrome that stems from an object lifecycle issue in ANGLE. An attacker could use this vulnerability to bypass security restrictions...

Delicious Brains Advanced Custom Fields Access Control Error Vulnerability

Delicious Brains Advanced Custom Fields is an advanced custom fields plug-in from Delicious Brains Canada.An access control error vulnerability exists in Delicious Brains Advanced Custom Fields, which stems from a lack of authorization associated with database browsing The vulnerability stems fro...

Nodebb path traversal vulnerability

NodeBB is a forum system built by the Design Create Play team using Node.js, a web application platform built on top of Google's V8 JavaScript engine. Nodebb is vulnerable to a path traversal vulnerability that could be exploited to access locations outside of restricted directories...

Siemens Nucleus ReadyStart Type Obfuscation Vulnerability

Siemens Nucleus ReadyStart is a bundled solution from Siemens, Germany. It is used to accelerate the fast startup of complete systems and provides a rich set of board support packages Bsp. A security vulnerability exists in Siemens Nucleus ReadyStart, which originates from an ICMP echo packet wit...

GNU Hurd has unspecified vulnerabilities

Gnu Hurd is a Gnu project replacement for the Unix kernel. It is used to implement the file system, network protocols, file access control, and other features implemented by the Unix kernel or similar kernels such as Linux. GNU Hurd suffers from a security vulnerability that stems from the use of...

Adobe Prelude Memory Buffer Out-of-Bounds Access Vulnerability (CNVD-2021-92811)

Adobe Prelude is a video recording and capture tool designed for intuitive and efficient media organization and metadata entry to quickly tag and transcode video footage and quickly create rough cuts.Adobe Prelude 10.1 and earlier versions are vulnerable to an out-of-bounds memory buffer access...

ZTE MF971R Profile Control Vulnerability

The ZTE MF971R is a Cat 6 LTE mobile Wi-Fi router with download speeds up to 300mbps and upload speeds up to 50mbps.A configuration file control vulnerability exists in the ZTE MF971R. An attacker could exploit the vulnerability to modify the device's configuration parameters, which could result ...

Redmine Information Disclosure Vulnerability (CNVD-2022-10738)

Redmine is an open source web-based project management and defect tracking tool. The product provides project management, issue tracking, and role-based access control, among other features.A security vulnerability exists in Redmine, which stems from a configuration or other error in the operatio...

Discourse server-side request forgery vulnerability

Discourse is an open source community discussion platform. The platform includes community, email and chat room features.Discourse in versions 2.3.2 and 2.6 has a server-side request forgery vulnerability that can be exploited by attackers to upload images from remote websites when writing emails...

Mozilla Rust Buffer Overflow Vulnerability (CNVD-2021-85300)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. Mozilla Rust is vulnerable to a buffer overflow vulnerability that can be exploited by attackers to cause errors in data contention in concurrent programs...

Google Android Information Disclosure Vulnerability (CNVD-2021-77622)

Android is a Linux-based open source operating system developed by Google Inc. and the Open Handheld Alliance OHA, and the Media Framework component of Google Android is vulnerable to information disclosure. An attacker could use this vulnerability to obtain sensitive information...

Eclipse Mosquitto License Issue Vulnerability

Eclipse Mosquitto is a set of open source messaging agent software from the Eclipse Foundation. eclipse Mosquitto has a security vulnerability that stems from the fact that in Eclipse mosquito versions 2.0 through 2.0.11, when using the dynamic security plugin, if a client is unsubscribed from a...

Cacti Cross-Site Scripting Vulnerability (CNVD-2021-70092)

Cacti is an open source set of network traffic monitoring and analysis tools from the Cacti team. The tool obtains data via snmpget, uses RRDtool drawing graphs for analysis, and provides data and user management features. cacti suffers from a code injection vulnerability that stems from multiple...

OpenMage Magento LTS Input Validation Error Vulnerability (CNVD-2021-101205)

OpenMage Magento Lts Magento, an e-commerce system from the OpenMage organization, is vulnerable to an input validation error in versions prior to OpenMage Magento LTS 19.4.15 and 20.0.13, which can be exploited by attackers to upload arbitrary executable files to the server...

F5 BIG-IP TMUI Remote Command Execution Vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A remote command execution vulnerability exists in the F5 BIG-IP TMUI, which can be exploited by an authenticated attacker wi...

Google TensorFlow Dezero Error Vulnerability (CNVD-2021-64070)

Google TensorFlow is an end-to-end open source machine learning platform. the implementation of tf.rawops.SparseDenseCwiseDiv in versions prior to Google TensorFlow 2.6.0 is vulnerable to a dezero error. No details of the vulnerability are currently available...

Dolibarr Cross-Site Scripting Vulnerability (CNVD-2021-71264)

Dolibarr is an application. A modern software package that helps manage your organization's activities, Dolibarr ERP CRM versions 2.8.1 through 13.0.2 are vulnerable to a cross-site scripting vulnerability caused by a lack of validation of user-submitted data by the editor module in the software...

Google TensorFlow MKL Code Execution Vulnerability

Google TensorFlow is an end-to-end open source machine learning platform. A security vulnerability exists in Google TensorFlow versions prior to 2.6.0. An attacker can exploit the vulnerability to execute arbitrary code on the system...

Libgd out-of-bounds read vulnerability (CNVD-2021-94953)

LibGD is an open source library for programmers to dynamically create images. an out-of-bounds read vulnerability exists in LibGD 2.3.2 and earlier. An attacker can exploit the vulnerability to cause a denial of service via specially crafted TGA files...

WordPress Quiz Maker plugin SQL Injection Vulnerability

WordPress is a set of blogging platform developed by Wordpress Foundation using PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.Quiz Maker plugin is an application plugin for WordPress. A SQL injection vulnerability exists in WordPress Quiz Maker...

isomorphic-git path traversal vulnerability

isomorphic-git is a pure JavaScript implementation of open source git for node and browser environments including WebWorkers and ServiceWorkers. isomorphic-git is vulnerable to path traversal prior to 1.8.2, which stems from the fact that isomorphic-git allows directory traversal via carefully...

Foxit PDF Reader Resource Management Error Vulnerability

Foxit PDF Reader is a PDF reader from Foxit China. Foxit PDF Reader is vulnerable to resource management errors, which can be exploited by remote attackers to execute arbitrary code on the target system...

CASAP Automated Enrollment SQL Injection Vulnerability (CNVD-2021-57785)

CASAP Automated Enrollment is an automated enrollment system for the CASAP organization. The goal of this project is to provide CASAP with an automated enrollment system to streamline the school's processes and make them more effective, efficient and easily retrievable. SourceCodester Alumni...

Adobe Illustrator 2021 Out-of-Bounds Write Vulnerability (CNVD-2021-55965)

Adobe Illustrator 2021 is a vector drawing software. An out-of-bounds write vulnerability exists in Adobe Illustrator 2021 25.2.3 and earlier versions. An attacker can exploit this vulnerability to execute arbitrary code...

Cisco HyperFlex HX Data Platform Access Control Error Vulnerability

Cisco HyperFlex HX Data Platform is a network appliance from Cisco USA. Provides enterprise-class agility, scalability, security and lifecycle management capabilities. An access control error vulnerability exists in Cisco HyperFlex HX Data Platform, which can be exploited by an attacker to upload...

Buffalo WSR-2533DHPL2 and WSR-2533DHP3 Access Control Error Vulnerability

Buffalo WSR-2533DHPL2 and WSR-2533DHP3 are routers from Buffalo Japan.The Buffalo WSR-2533DHPL2 and WSR-2533DHP3 are vulnerable to an access control error that could be exploited by an attacker to gain access to unauthorized content...

Netop Vision Pro Misauthorization Vulnerability

Netop Vision Pro is a student monitoring system for teachers to facilitate student learning while using school computers. A security vulnerability exists in Netop Vision Pro. An attacker could exploit the vulnerability to replay network traffic...

Cisco NX-OS Denial of Service Vulnerability (CNVD-2021-12829)

Cisco NX-OS is the network operating system for the Cisco Nexus family of Ethernet switches and the MDS family of Fibre Channel storage area network switches. A denial of service vulnerability exists in the Protocol Independent Multicast PIM feature of the Cisco NX-OS, which can be exploited by a...

WordPress Cross-Site Scripting Vulnerability (CNVD-2021-24378)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress, which stems from the lack of proper validation of...

Inductive Automation Ignition Access Control Error Vulnerability

Inductive Automation Ignition is a suite of integrated software platforms for SCADA systems from Inductive Automation, Inc. The platform supports SCADA data acquisition and monitoring systems, HMI human machine interface and more. An access control error vulnerability exists in Inductive Automati...

TYPO3 code issue vulnerability (CNVD-2020-04075)

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. A security vulnerability exists in the QueryGenerator and QueryView classes in TYPO3 versions prior to 8.7.30, 9.x versions prior to 9.5.12, and 10.x versions prior to 10.2.2. An attacker...

fig2dev buffer overflow vulnerability (CNVD-2021-79776)

fig2dev is a tool for printing and exporting .fig format files. A buffer error vulnerability exists in the 'readtextobject' function of the read.c file in fig2dev version 3.2.7b. The vulnerability stems from a networked system or product that does not properly validate data boundaries when...

WordPress SlickQuiz SQL Injection Vulnerability

WordPress is a suite of blogging platforms developed in the PHP language by the WordPress Foundation.SlickQuiz is a plugin for displaying and managing nice dynamic quizzes. WordPress SlickQuiz suffers from a SQL injection vulnerability that can be exploited by attackers to execute illegal SQL...

Atlassian Jira Username Enumeration Vulnerability

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. A username enumeration vulnerability exists in Atlassian Jira versions prior to 7.13.3, 8.0.4, and 8.1.1, which can be exploited...

Microsoft .NET Framework Local Elevation of Privilege Vulnerability

Microsoft .NET Framework is a comprehensive and consistent programming model developed by Microsoft Corporation USA and a development platform for building Windows, Windows Store, Windows Phone, Windows Server and Microsoft Azure Windows Store, Windows Phone, Windows Server, and Microsoft Azure...

Apache HTTP Server Denial of Service Vulnerability (CNVD-2018-06536)

Apache HTTP Server is the United States Apache Apache Software Foundation, an open source web server. The server is fast, reliable and can be expanded through a simple API. There is a security vulnerability in Apache HTTP Server. An attacker can exploit this vulnerability by sending a specially...

Artifex Software MuPDF and Ghostscript Artifex jbig2dec Denial of Service Vulnerability

Artifex Software Ghostscript and MuPDF are both products of the United States Artifex Software. Artifex Ghostscript is an open source PostScript parser; MuPDF is a free, lightweight PDF reader. jbig2dec is an for Ghostscript and MuPDF in the decoding of PDF files in the JBIG2 stream implementatio...

WordPress Mail Masta plugin SQL injection vulnerability (CNVD-2017-02397)

WordPress is the WordPress Software Foundation's set of blogging platform using the PHP language development, the platform supports in PHP and MySQL servers to set up a personal blog site.Mail Masta Plugin is one of the mail plugin. The Mail Masta Plugin for WordPress suffers from a SQL injection...

Psi+ User Simulation Vulnerability

Psi is a cross-platform Jabber client of which Psi+ is a fork. Psi+ has a user emulation vulnerability. An attacker can use this vulnerability to emulate any user, leading to further attacks...

Python pip security bypass vulnerability

Python is an open source, object-oriented programming language from the Python Software Foundation. pip is a set of tools for installing and managing Python packages. A security bypass vulnerability exists in Python pip. An attacker could use this vulnerability to bypass security restrictions and...

Kaseya Virtual System Administrator Elevation of Privilege Vulnerability

Kaseya Virtual System Administrator is a suite of IT system management platforms for simplifying and automating IT services. Kaseya Virtual System Administrator does not enforce user authentication and does not restrict target file paths, allowing remote attackers to exploit vulnerabilities to...

Apache Spark Deserialization Vulnerability

Apache Spark is a large-scale data processing engine that supports acyclic data streaming and in-memory computing from the Apache Foundation. Apache Spark suffers from a deserialization vulnerability. The vulnerability stems from the Spark History Web UI's overly lax Jackson deserialization of...