Joomla Directory Traversal Vulnerability

Joomla! is a U.S. Open Source Matters team using PHP and MySQL development of a set of open source , cross-platform content management system CMS. Media Manager is used in one of the media management components . A path traversal vulnerability exists in commedia in Joomla! CMS versions 1.5.0...

Ansible Man-in-the-Middle Attack Vulnerability

Ansible is a computer system configuration manager from Ansible, Inc. that can be used to publish, manage and orchestrate computer systems. A security vulnerability exists in Ansible versions prior to 1.2.1 that stems from the program failing to cache SSH host keys. A remote attacker can exploit...

Microsoft Internet Explorer and Microsoft Edge Information Disclosure Vulnerability (CNVD-2017-12102)

Microsoft Internet Explorer IE and Microsoft Edge are both web browsers developed by the American company Microsoft. The former is the default browser that came with operating systems before Windows 10, and the latter is the default browser that comes with the latest operating system, Windows 10...

ISPConfig '/admin/users_edit.php' cross-site request forgery vulnerability

ISPConfig is a set of Linux-based open source hosting control panel, it can be used through the Web control panel to manage multiple servers, open a Web site, monitor server operating conditions and so on. ISPConfig suffers from a cross-site request forgery vulnerability that allows remote...

Roundcube Webmail Cross-Site Scripting Vulnerability (CNVD-2015-00913)

RoundCube Webmail is a browser-based, multi-language IMAP client. Roundcube Webmail suffers from a cross-site scripting vulnerability due to the program failing to properly filter user-supplied input. An attacker could exploit this vulnerability to execute arbitrary script code or steal...

Command Injection Vulnerability in FineReport, FineBI, and FineDataLink of SailSoft Software Ltd.

FineReport is a leading enterprise-grade web reporting tool.FineBI is a new generation of self-service BI tools.FineDataLink is a low-code/high-time-efficiency enterprise-grade one-stop data integration and governance platform product. A command injection vulnerability exists in FineReport, FineB...

GNU libopts Buffer Overflow Vulnerability

GNU libopts is a C language library for parsing command line options from the US GNU community. A buffer overflow vulnerability exists in GNU libopts version 27.6 and earlier, which stems from a boundary error in the function strstrsse2 when processing untrusted input. An attacker could exploit...

TOTOLINK N300RB Command Injection Vulnerability

The TOTOLINK N300R is a wireless router for home and small office scenarios from Korean networking brand TOTOLINK. The TOTOLINK N300RB suffers from a command injection vulnerability that originates from the remote support feature of static key protection, which can be exploited by an attacker to...

TOTOLINK EX1200T Buffer Overflow Vulnerability

The TOTOLINK EX1200T is a Wi-Fi range extender from China's Gion Electronics TOTOLINK. The TOTOLINK EX1200T suffers from a buffer overflow vulnerability that originates from the parameter LangType in the file /cgi-bin/cstecgi.cgi that fails to correctly validate the length and size of the input...

Google Chrome Type Obfuscation Vulnerability (CNVD-2025-1712275)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a type obfuscation vulnerability that stems from the presence of type obfuscation in V8. No detailed vulnerability details are provided at this time...

Google Chrome Code Execution Vulnerability (CNVD-2024-27332)

Google Chrome is a web browser from Google, an American company. A code execution vulnerability exists in versions of Google Chrome prior to 126.0.6478.54, which can be exploited by an attacker to perform out-of-bounds memory writes via a crafted HTML page...

EyouCMS Deserialization Vulnerability

EyouCms Eyou CMS is an open source content management system CMS based on ThinkPHP. EyouCMS version 1.6.5 has a deserialization vulnerability, the vulnerability stems from the unsafe deserialization of the parameter channelid of the file /login.php in the receipt of user-submitted serialized data...

Mattermost Denial of Service Vulnerability (CNVD-2024-14305)

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a denial-of-service vulnerability that stems from an inability to limit the number of mentions processed per message, which can be exploited by an authenticated attacker to cras...

Siemens SINEMA Remote Connect Client Information Disclosure Vulnerability

SINEMA Remote Connect is a management platform for remote networks that makes it simple to manage tunneled connections VPN between headquarters, service technicians and installed machines or plants. An information disclosure vulnerability exists in Siemens SINEMA Remote Connect Client, which can ...

Customer Support System Cross-Site Scripting Vulnerability (CNVD-2024-14028)

Customer Support System is a customer support system by oretnom23 Personal Developer that helps a particular business or company to provide customer support after a customer has purchased a product from them. Customer Support System suffers from a cross-site scripting vulnerability that stems fro...

SWFTools Denial of Service Vulnerability (CNVD-2024-37468)

SWFTools is a set of utilities for working with Adobe Flash files SWF files. A denial of service vulnerability exists in SWFTools version v0.9.2, which stems from an overlapping strcpy parameter in component /home/swftools/src/swfc+0x448318a. An attacker can exploit this vulnerability to cause a...

Unspecified Vulnerability in Oracle MySQL (CNVD-2024-11155)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. A security vulnerability exists in Oracle MySQL for MySQL Server version 8.2.0 and earlier versions. An attacker can exploit this vulnerability to...

Linux has a binary vulnerability

Linux is an open source Unix-like operating system. Linux has a binary vulnerability that can be exploited by attackers to elevate privileges...

Apache NiFi cross-site scripting vulnerability (CNVD-2023-9665850)

Apache NiFi is a data processing and distribution system from the Apache USA Foundation. The system is primarily used for data routing, transformation and system intermediary logic. Apache NiFi suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and...

Fortinet FortiClient Hardcoding Vulnerability

Fortinet FortiClient is a mobile endpoint security solution from Fortinet. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance and two-factor authentication when connected to a FortiGate firewall appliance. A hard-coded vulnerability exists in Fortinet FortiClien...

SAP PowerDesigner Input Validation Error Vulnerability

SAP PowerDesigner is a database design software from SAP Germany. An input validation error vulnerability exists in SAP PowerDesigner version 16.7, which stems from an inability to adequately validate a BPMN2 XML document imported from an untrusted source. An attacker could exploit this...

Google libwebp open source library remote code execution vulnerability

WebP is an image format developed by Google, which supports lossy and lossless compression of network images, and its compression effect and speed have certain advantages over PNG and JPEG formats. libwebp is a C/C++ open source library that implements the coding and decoding of the WebP image...

Microsoft Excel Information Disclosure Vulnerability (CNVD-2023-80108)

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. An information disclosure vulnerability exists in Microsoft Excel, which can be exploited by attackers to obtain sensitive information...

Microsoft Exchange Server Remote Code Execution Vulnerability (CNVD-2023-72224)

Microsoft Exchange Server is the United States Microsoft Microsoft company's set of e-mail service program. It provides e-mail access, storage, forwarding, voice mail, e-mail filtering and screening. A remote code execution vulnerability exists in Microsoft Exchange Server, which can be exploited...

Linux Kernel Denial of Service Vulnerability (CNVD-2023-64507)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A denial of service vulnerability exists in the Linux Kernel, which originates from a null pointer dereference issue in fs/jfs/jfsdmap.c, a component of the Journaling File...

Siemens Tecnomatix Plant Simulation Out-of-Bounds Write Vulnerability (CNVD-2023-56537)

Siemens Tecnomatix Plant Simulation is an industrial control device from Siemens, Germany, that uses discrete-event simulation to analyze and optimize throughput and thereby improve manufacturing system performance. Siemens Tecnomatix Plant Simulation suffers from an out-of-bounds write...

Trend Micro Apex One elevation of privilege vulnerability (CNVD-2023-65417)

Trend Micro Apex One is an endpoint protection software from Trend Micro. An elevation of privilege vulnerability exists in Trend Micro Apex One, which can be exploited by a local attacker to elevate privileges and write arbitrary values to specific entries...

ChurchCRM Cross-Site Scripting Vulnerability (CNVD-2023-64494)

ChurchCRM is an open source Church CRM and management software. A cross-site scripting vulnerability exists in ChurchCRM version 4.5.3, which can be exploited by an attacker to inject malicious JavaScript scripts...

answer authorization issue vulnerability (CNVD-2023-40597)

answer is an open source knowledge-based community software. A vulnerability in authorization issues exists in versions of answer prior to 1.0.9, which stems from a lack of authorization for the software. An attacker could use this vulnerability to unauthorize changes or delete votes...

NETGEAR RBR750 Command Injection Vulnerability

The NETGEAR RBR750 is a home WiFi system from NETGEAR. The NETGEAR RBR750 version 4.6.8.5 suffers from a command injection vulnerability that stems from a failure to properly filter constructed command special characters, commands, etc. in the hidden telnet service feature. An attacker could...

Siemens Tecnomatix Plant Simulation Memory Corruption Vulnerability

Siemens Tecnomatix Plant Simulation is an industrial control device from Siemens, Germany. Using the function of discrete event simulation for production volume analysis and optimization, and thus improve the manufacturing system performance. A memory corruption vulnerability exists in versions...

Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability (CNVD-2023-28102)

Microsoft PostScript Printer Driver is a Microsoft standard printer driver for PostScript printers from Microsoft. Microsoft PostScript and PCL6 Class Printer Driver is a remote code execution vulnerability that can be exploited by attackers to remotely execute code...

Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability (CNVD-2023-28107)

Microsoft PostScript Printer Driver is a Microsoft standard printer driver for PostScript printers from Microsoft USA. Microsoft PCL6 Class Printer Driver is a printer driver software from Microsoft Corporation. Microsoft PostScript and PCL6 Class Printer Driver contains an information disclosure...

Apache Airflow Google Provider Input Validation Error Vulnerability (CNVD-2023-88040)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An input validation error vulnerability exists in Apache Airflow Google Provider...

Fortinet FortiWeb Path Traversal Vulnerability (CNVD-2023-18293)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. A path traversal vulnerability exists that...

Apache Sling JNDI Injection Vulnerability

Apache Sling is the United States Apache Apache Foundation of a Java platform for open source Web framework. Designed to meet the JSR-170 content repository such as Apache Jackrabbit to create content-centric applications. Apache Sling JCR Base versions prior to 3.1.12 JNDI injection vulnerabilit...

Schneider Electric Conext ComBox Cross-Site Request Forgery Vulnerability

The Schneider Electric Conext ComBox is a communication and monitoring device from Schneider Electric France. The Schneider Electric Conext ComBox suffers from a cross-site request forgery vulnerability that can be exploited by a remote attacker to construct a malicious URI, which induces a reque...

Microsoft 3D Builder Remote Code Execution Vulnerability (CNVD-2023-04327)

Microsoft 3D Builder, a tool for creating models and 3D printing from Microsoft USA, has a security vulnerability. No details of the vulnerability are currently available...

Mozilla Firefox Access Control Error Vulnerability (CNVD-2023-03068)

Mozilla Firefox is an open source Web browser from the Mozilla Foundation in the U.S. An access control error vulnerability exists in Mozilla Firefox, which stems from the Remote Agent used in WebDriver not validating the Host or Origin header. An attacker could exploit the vulnerability to force...

kkFileView cross-site scripting vulnerability (CNVD-2023-00013)

kkFileView is China's Keking Technology Keking company's a Spring-Boot to create a file document online preview project . A cross-site scripting vulnerability exists in kkFileView, which stems from the setWatermarkAttribute function in the /picturesPreview file that allows an attacker to implemen...

Linux kernel has unspecified vulnerabilities (CNVD-2023-06532)

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. Linux kernel USB core subsystem has a security vulnerability that stems from incorrect access control and can be exploited by local attackers to crash the system...

Google TensorFlow has an unspecified vulnerability (CNVD-2023-15772)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc...

Chocolatey PHP Permission Design Vulnerability

PHP is a scripting language that executes on the server side. A privilege design vulnerability exists in the Chocolatey PHP package v8.1.12 and below, which originates from all users in the Authenticated users group having write access to the subfolder C:\tools\php81 and all files in that folder,...

NdkAdvancedCustomizationFields Server-Side Request Forgery Vulnerability

NdkAdvancedCustomizationFields is an advanced customization field from Ndk. A server-side request forgery vulnerability exists in NdkAdvancedCustomizationFields 3.5.0 and prior versions, which stems from rotateimg.php failing to properly validate user input. An attacker could use this vulnerabili...

Google TensorFlow MirrorPadGrad buffer overflow vulnerability

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A buffer overflow vulnerability exists in Google TensorFlow, which originates from the "MirrorPadGrad" input "paddings" is too large, an attacker can use this vulnerability to cause a heap memory...

Siemens Parasolid out-of-bounds write vulnerability

Parasolid is a 3D geometric modeling tool that supports multiple techniques, including solid modeling, direct editing, and free-form surface/table modeling.An out-of-bounds write vulnerability exists in Siemens Parasolid, which can be exploited by attackers to execute code in the context of the...

Google Chrome Permissions API Memory Misreference Vulnerability

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in Google Chrome versions prior to 106.0.5249.119. The vulnerability stems from the use of the Permissions API after release, and can be exploited by a remote attacker to trick a user into...

Microsoft Windows Local Session Manager (LSM) Denial of Service Vulnerability

Microsoft Windows is a set of operating systems for personal devices from the U.S. Microsoft Windows Local Session Manager LSM has a denial-of-service vulnerability that can be exploited by attackers to launch denial-of-service attacks...

Siemens Simcenter Femap has an unspecified vulnerability

Siemens Simcenter Femap is a cutting-edge engineering simulation application from Siemens, Germany. Simcenter Femap versions prior to 11.1.1.0, 2022.1.0 and later, 2022.1.3 and later, 2022.2.0 and later, and 2022.2.2 and earlier contain security vulnerabilities that can be exploited by attackers ...

Microsoft Client Server Run-time Subsystem (CSRSS) Privilege Elevation Vulnerability

Microsoft Client Server Run-time Subsystem is a client/server run-time subsystem from Microsoft Corporation of the United States, manifested as the csrss.exe process. It is a component of the Windows NT operating system family, appearing in Windows NT 3.1 and later systems, and provides the user...