Microsoft Windows DNS Server Remote Code Execution Vulnerability (CNVD-2022-84115)

Microsoft Windows is an operating system for personal devices from Microsoft Corporation USA.A remote code execution vulnerability exists in Microsoft Windows DNS Server, which can be exploited by attackers to execute arbitrary code on the system...

Microsoft Windows Cluster Client Failover Elevation of Privilege Vulnerability

Microsoft Windows is a set of operating systems for use on personal devices from the American company Microsoft. An elevation of privilege vulnerability exists in Microsoft Windows Cluster Client Failover. The vulnerability stems from an incorrect programmatic call to an advanced local procedure...

D-Link DIR-619 Stack Overflow Vulnerability (CNVD-2022-31545)

D-Link DIR-619 is a series of routers from D-Link, a Chinese company. D-Link DIR-619 Ax v1.00 has a security vulnerability that can be exploited by attackers to cause a denial of service DoS via the curTime parameter...

DouPHP Cross-Site Scripting Vulnerability (CNVD-2022-72218)

A cross-site scripting vulnerability exists in DouPHP, a lightweight enterprise content management system CMS from China DouShell Network Technology. The vulnerability stems from a lack of data validation filtering of user-supplied data and output in the upload function of dmin/show.php. An...

IBM Business Automation Workflow and Business Process Manager Information Disclosure Vulnerability

IBM Business Automation Workflow is a suite of workflow automation solutions from IBM USA. The product is mainly used for workflow management, compliance management, and features workflow visibility and scalability. An information disclosure vulnerability exists in IBM Business Automation Workflo...

Netgear W104 has an unspecified vulnerability (CNVD-2022-22305)

Netgear W104 is a wireless access point from Netgear, Inc. A security vulnerability exists in Netgear W104 WAC104-V1.0.4.13, which stems from a lack of protection and privilege restrictions for sensitive information on the BRStop.html page. An unauthenticated attacker could access the page and us...

Atom CMS Remote Code Execution Vulnerability

Atom CMS is a content management system. A remote code execution vulnerability exists in Atom CMS version 2.0, which stems from /admin/uploads.php failing to properly filter the special elements of the construct snippet. An attacker could exploit this vulnerability to cause arbitrary code executi...

IBM Spectrum Copy Data Management Cross-Site Scripting Vulnerability (CNVD-2022-84077)

IBM Spectrum Copy Data Management is an implementation of International Business Machines Corporation IBM to modernize, simplify, and automate data center copy management processes.A cross-site scripting vulnerability exists in IBM Spectrum Copy Data Management versions 2.2.0.0 inclusive through...

Totolink X5000R and TotoLink A7000R Command Injection Vulnerability (CNVD-2022-21813)

Totolink X5000R is a router from Totolink, China.TotoLink A7000R is a wireless router from TotoLink, China.Totolink routers X5000R V9.1.0u.6118B20201102 and A7000R V9.1.0u.6115 B20201022 contain a security vulnerability that could be exploited by attackers to execute arbitrary commands via crafte...

Linux kernel io-workqueue denial of service vulnerability

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. Linux kernel versions prior to 5.15-rc1 have a denial-of-service vulnerability that stems from a false cancel operation that triggers the commit of a new io-uring, resulting in a kernel error. An attacke...

MIcrosoft Windows CD-ROM Driver Elevation of Privilege Vulnerability

Microsoft Windows is a CD-ROM driver from Microsoft Corporation, and an elevation of privilege vulnerability exists in the Microsoft Windows CD-ROM Driver, which could be exploited by attackers to execute arbitrary code with elevated privileges...

Espruino Buffer Overflow Vulnerability (CNVD-2022-20168)

Espruino is a JavaScript interpreter. It is designed for devices with only 128kB flash and 8kB RAM. espruino 2v11 has a security vulnerability that stems from src/jsvar.c containing a stack buffer overflow. No details of the vulnerability are currently available...

Zulip Cross-Site Scripting Vulnerability (CNVD-2022-17016)

Zulip is a powerful open source group chat application from the Zulip team. Used to combine the immediacy of real-time chat with the productivity benefits of threaded conversations, Zulip suffers from a cross-site scripting vulnerability that stems from the WEB application's lack of proper...

Zulip server has an unspecified vulnerability (CNVD-2022-15523)

Zulip server is an open source team chat application from Zulip USA. zulip server has a security vulnerability that stems from the fact that zlip Server deployments that reside in multiple organizations are vulnerable to attacks where an invitation created in one organization possibly a role with...

Huawei Emui and Magic UI integer overflow vulnerability

Huawei Emui is a mobile operating system developed on Android. Magic Ui is a mobile operating system developed on Android. Huawei Emui and Magic UI are vulnerable to integer overflow, which can be exploited by attackers to cause random address access...

Tor Browser Information Disclosure Vulnerability

Tor Browser is a browser used to access the Internet anonymously. Tor Browser is vulnerable to an information disclosure vulnerability that could be exploited by attackers to bypass the expected anonymity features and obtain information about the Onion service accessed by local users...

Oracle MySQL Cluster Input Validation Error Vulnerability (CNVD-2022-17689)

Oracle MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database developed by Oracle Corporation. Oracle MySQL Cluster is vulnerable to an input validation error, which can be exploited by attackers to execute arbitrary code...

Envoy Resource Management Error Vulnerability (CNVD-2022-15542)

Envoy is an open source distributed proxy server. Envoy is vulnerable to a resource management error that occurs when configuring "envoyv3apifieldextensions.filters.network.tcpproxy.v3. tunnelingconfig" crashes and the downstream connection is disconnected while the upstream connection or http/2...

Envoy has an unspecified vulnerability (CNVD-2022-16291)

Envoy is an open source distributed proxy server. Envoy has a security vulnerability that stems from Envoy's internal redirection selection configured for direct response or redirection actions, specifically so that generic routers will have segmentation failures that can be exploited by attacker...

PJSUA API Buffer Overflow Vulnerability (CNVD-2022-14998)

Pjsua Api is an advanced Api for building Sip multimedia user agent applications, and a buffer overflow vulnerability exists in the PJSUA API, which can be exploited to cause a buffer overflow via a controlled "filename" parameter...

Samsung Wear OS has an unspecified vulnerability

Samsung Wear Os is a version of the Android operating system from the South Korean company Samsung. It is designed for wearable computer devices such as smartwatches. Wear OS has a security vulnerability that stems from allowing untrusted apps to fail to disable theater mode with proper...

D-Link DIR-X1860 has unspecified vulnerabilities

The D-Link Dir-X1860 is a dual-band router from D-Link China.A security vulnerability exists in the D-Link DIR-X1860, which stems from a reflected cross-site scripting attack in the D-Link DIR-X1860 web application prior to v1.10WWB09 Beta, which can be exploited by an attacker to sending a...

WordPress WOOF plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed by the WordPress Foundation using the PHP language. WordPress WOOF plugin has a cross-site scripting vulnerability in versions prior to 1.2.6.3, which stems from the lack of escaping of woofredrawelements and can be exploited by attackers to...

Oracle MySQL Buffer Overflow Vulnerability

Oracle MySQL Server is a relational database from Oracle Corporation. MySQL Server suffers from a buffer overflow vulnerability that originates from an input validation error in the Server: Optimizer component in MySQL Server. An attacker can exploit the vulnerability to corrupt or delete data...

Dada Mail Cross-Site Request Forgery Vulnerability

Dada Mail is a web-based email list management system. A cross-site request forgery vulnerability exists in Dada Mail versions prior to 11.16.0. An attacker could send a crafted web page to obtain information about a user's account...

F5 BIG-IP Cross-Site Scripting Vulnerability (CNVD-2022-72758)

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A cross-site scripting vulnerability exists in F5 BIG-IP, which can be exploited to run JavaScript in the context of the...

Qnap Qvr has an unspecified vulnerability

Qnap Qvr is a Qnap monitoring system control center from China Welllink Technology Qnap, Inc. A security vulnerability exists in several QVR products, stemming from a stack buffer overflow vulnerability that affects QNAP devices running QVR Elite, QVR Pro, and QVR Guard. An attacker could exploit...

Discourse Information Disclosure Vulnerability (CNVD-2022-05504)

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features.Discourse is vulnerable to an information disclosure vulnerability that could be exploited by attackers to obtain private configuration files...

Microsoft Windows IKE Extension Denial of Service Vulnerability

Microsoft Windows is a windowed operating system developed by Microsoft Corporation. A denial-of-service vulnerability exists in Microsoft Windows IKE Extension, which can be exploited by attackers to cause the target system to stop responding...

DayByDay CRM Cross-Site Scripting Vulnerability (CNVD-2022-68549)

DayByDay CRM is an open source CRM Customer Relationship Management software, based on Laravel, that helps users keep track of clients, tasks, meetings and more. A cross-site scripting vulnerability exists in DayByDay CRM. The vulnerability stems from the title field of a new task in the product...

Google Android Elevation of Privilege Vulnerability (CNVD-2022-06157)

Google Android is a Linux-based open-source operating system from the US company Google. Google Android 11 has a security vulnerability that could be exploited by attackers to cause a local privilege escalation...

ILM OpenEXR Buffer Overflow Vulnerability

ILM OpenEXR is an image file format from Industrial Light and Magic ILM for high dynamic range HDR images. ILM OpenEXR is vulnerable to a buffer overflow vulnerability that can be exploited by attackers to cause a buffer overflow...

BeyondTrust Remote Support Cross-Site Request Forgery Vulnerability

BeyondTrust Remote Support is a remote desktop access, help desk and collaboration software for Windows, Mac, Linux, Ios iPad, iPhone, etc. BeyondTrust Remote Support is vulnerable to cross-site request forgery. The vulnerability stems from the lack of proper validation of client-side data in the...

Garrett Metal Detectors Authentication Bypass Vulnerability

Garrett Metal Detectors is a walk-in metal detector from Garrett U.S.A. Garrett Metal Detectors is vulnerable to an authentication bypass vulnerability that could be exploited by attackers to bypass authentication with the help of session hijacking...

Mozilla Rust actix-web crate memory corruption vulnerability

Rust actix-web crate is a Rust web framework. security vulnerability exists in Mozilla Rust actix-web crate versions prior to 0.7.15, which can be exploited by attackers to cause memory corruption...

Mozilla Rust has an unspecified vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. a security vulnerability exists in versions of Rust smallvec crate prior to 0.6.13, which stems from the fact that it can create uninitialized values of any type, including reference types. No details of the...

Fortinet FortiWeb Input Validation Error Vulnerability

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content.Fortinet FortiWeb An input validation error...

Fortinet FortiWeb Cross-Site Scripting Vulnerability (CNVD-2021-101133)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. versions 6.4.1 and earlier and 6.3.15 and...

Bentley View BMP File Parsing Stack Buffer Overflow Vulnerability

Bentley View, a free viewer from Bentley Systems, Inc. A stack buffer overflow vulnerability exists in Bentley View BMP file parsing, which is due to a failure to properly validate the length of user-supplied data before copying it to the heap buffer. An attacker could exploit this vulnerability ...

Crafter CMS licensing issue vulnerability

Crafter CMS is an open source content management system CMS for digital experience applications. Crafter CMS is vulnerable to an authorization issue in versions 3.1 through 3.1.15, which stems from a lack of authentication measures or insufficient authentication strength in the web system or...

Delicious Brains Advanced Custom Fields Access Control Error Vulnerability

Delicious Brains Advanced Custom Fields is an advanced custom fields plug-in from Delicious Brains Canada.An access control error vulnerability exists in Delicious Brains Advanced Custom Fields, which stems from a lack of authorization associated with database browsing The vulnerability stems fro...

Apache APISIX Command Injection Vulnerability

Apache Apisix is a cloud-native microservices API gateway service from the Apache Foundation. The software is based on OpenResty and etcd and features dynamic routing and plugin hot-loading for API management in a microservice architecture. Apache APISIX has a security vulnerability that stems fr...

Moddable SDK Heap Buffer Overflow Vulnerability (CNVD-2021-90313)

The Moddable SDK is a combination of development tools and runtime software used to create applications for microcontrollers. a security vulnerability exists in the Moddable SDK, which stems from a networked system or product that does not properly validate data boundaries when performing...

WordPress plugin Popular Posts arbitrary file upload vulnerability

WordPress is a blogging platform developed using the PHP language, which supports setting up personal blogging sites on PHP and MySQL servers. WordPress plugin Popular Posts 5.3.2 and previous versions are vulnerable to arbitrary file uploads. An attacker could exploit the vulnerability to upload...

Kirby Cross-Site Scripting Vulnerability (CNVD-2021-95256)

Kirby is a file-based content management system CMS. Kirby suffers from a cross-site scripting vulnerability that stems from the product's failure to validate input data, which could be exploited by attackers to execute client-side code...

Laravel Framework has an unspecified vulnerability

Laravel Framework is a PHP-based web application development framework from Taylor Otwell, a personal developer.A security vulnerability exists in versions of Laravel Framework prior to 8.70.2, which stems from the fact that the framework does not adequately prevent the upload of executable PHP...

ResourceSpace directory traversal vulnerability

ResourceSpace is a digital asset management tool that enables users to organize their digital assets. a directory traversal vulnerability exists in ResourceSpace. An attacker could exploit the vulnerability to delete arbitrary files on the ResourceSpace server via the provider and variant...

Michael R Sweet HTMLDOC Buffer Overflow Vulnerability

HTMLDOC is an HTML file format conversion editor that reads HTML and Markdown source files or web pages and generates the corresponding EPUB, HTML, PostScript or PDF files with optional table of contents. A buffer overflow vulnerability exists in imageloadbmp in HTMLDOC versions prior to 1.9.12. ...

Mozilla Rust Buffer Overflow Vulnerability (CNVD-2021-85300)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. Mozilla Rust is vulnerable to a buffer overflow vulnerability that can be exploited by attackers to cause errors in data contention in concurrent programs...

Google Chrome Background Fetch API Security Bypass Vulnerability (CNVD-2021-73418)

Google Chrome is a web browser from Google, Inc. A security bypass vulnerability exists in the Google Chrome Background Fetch API. An attacker could exploit this vulnerability to bypass security restrictions...