Oracle MySQL Cluster Input Validation Error Vulnerability (CNVD-2022-13058)

Oracle MySQL is an open source relational database management system from Oracle Corporation. MySQL Cluster is a highly useful and redundant version for distributed computing environments. Oracle MySQL Cluster is vulnerable to an input validation error, which can be exploited to execute arbitrary...

Linux kernel competition condition issue vulnerability

Linux kernel is the kernel used by the Linux Foundation's open source operating system, Linux. Linux Kernel is vulnerable to a contention problem that stems from a failure to properly lock operations in btrfs, which can be exploited by an attacker to cause a user to crash the kernel or deadlock t...

Zoho ManageEngine O365 Manager Plus Remote Code Execution Vulnerability

A security vulnerability exists in Zoho ManageEngine O365 Manager Plus, a software for auditing, monitoring and managing Office 365 from ZOHO, Inc. prior to Build 4416, which stems from an external input data during the construction of a code segment, and the network system or product fails to...

WordPress Contact Form Entries Plugin Security Vulnerability

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress Contact Form Entries Plugin has a cross-site scripting vulnerability in versions prior to 1.2.4, which stems from...

Google Android Code Execution Vulnerability (CNVD-2022-06898)

Google Android is a Linux-based open source operating system from Google, Inc. A security vulnerability exists in Google Android, which stems from a configuration error in the network system or product during operation. An attacker could exploit the vulnerability to cause a local privilege...

Expat has an unspecified vulnerability

Expat is a fast streaming XML parser written in C. A security vulnerability exists in Expat, which stems from the fact that in Expat aka libexpat prior to 2.4.3, the storeAtts function in xmlparse.c shifted left by 29 or more bits may cause realloc misbehavior e.g., allocating too few bytes too...

Netgear Nighthawk R6700 Command Injection Vulnerability

The Netgear Nighthawk R6700 is a wireless router from Netgear, Inc. A command injection vulnerability exists in the Netgear Nighthawk R6700, which stems from the fact that the product supports update checking via the soap interface and can be injected with a pre-set value. No details of the...

Trendnet AC2600 TEW-827DRU Information Disclosure Vulnerability

Trendnet AC2600 TEW-827DRU is a wireless router. Trendnet AC2600 TEW-827DRU is vulnerable to an information disclosure vulnerability that stems from a failure to properly disclose credentials for the device's smb functionality. An attacker could exploit the vulnerability to display all mb account...

Rust raw-cpuid crate has an unspecified vulnerability

Rust raw-cpuid crate is a library for parsing x86 CPUID instructions, written in rust, with no external dependencies. The implementation is very similar to the Intel CPUID manual description. The library only depends on libcore. versions prior to Rust raw-cpuid crate 9.1.1 have security...

Google Chrome Resource Management Error Vulnerability (CNVD-2022-16304)

Google Chrome is a web browser from Google, Inc. Google Chrome is vulnerable to a resource management error that can be exploited by attackers to cause arbitrary code execution or data corruption...

Delicious Brains Advanced Custom Fields Information Disclosure Vulnerability

Delicious Brains Advanced Custom Fields is an advanced custom fields plugin from Delicious Brains Canada.An information disclosure vulnerability exists in Delicious Brains Advanced Custom Fields, which stems from a lack of authorization related to obtaining user lists. The vulnerability stems fro...

Eufy Anker Eufy Homebase 2 Access Control Error Vulnerability

Anker Eufy Homebase is a wireless home security camera system from Eufy U.S.A. An access control error vulnerability exists in Anker Eufy Homebase 2, which stems from the failure of the CMDDEVICEGETRSAKEYREQUEST function in the product's homesecurity file to correctly handle specially crafted...

Open-xchange OX App Suite Code Injection Vulnerability

Open-xchange OX App Suite is a Web cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. A code injection vulnerability exists in Open-xchange OX App Suite, which can be exploited by attacker...

Google Chrome V8 Code Execution Vulnerability (CNVD-2021-91296)

Google Chrome is a web browser from Google, Inc. A security vulnerability exists in Google Chrome, which is caused by type obfuscation in V8. An attacker could exploit the vulnerability to execute arbitrary code on the system...

EC-CUBE Cross-site Request Forgery Vulnerability (CNVD-2022-03132)

EC-CUBE is an open source system for creating shopping websites. EC-CUBE versions 2.11.0 - 2.17.1 have a cross-site request forgery vulnerability in the administration interface. An attacker could exploit the vulnerability to remove administrators by tricking a user with administrative privileges...

Siemens Nucleus ReadyStart Type Obfuscation Vulnerability

Siemens Nucleus ReadyStart is a bundled solution from Siemens, Germany. It is used to accelerate the fast startup of complete systems and provides a rich set of board support packages Bsp. A security vulnerability exists in Siemens Nucleus ReadyStart, which originates from an ICMP echo packet wit...

Google TensorFlow has an unspecified vulnerability (CNVD-2021-92551)

Google TensorFlow is a set of end-to-end open source platform for machine learning from Google Google Inc. A security vulnerability exists in versions prior to Google TensorFlow 2.7.0, which stems from a lack of code validation for boosting trees in TensorFlow. No details of the vulnerability are...

Boston Scientific ZOOM LATITUDE Programmer/Recorder/Monitor (PRM) Model 3120 Data Validation Error Vulnerability

The Boston Scientific ZOOM LATITUDE Programmer/Recorder/Monitor PRM Model 3120 is a portable cardiac rhythm management Crm programming system from Boston Scientific, Inc. The Boston Scientific ZOOM LATITUDE Programmer/Recorder/Monitor PRM Model 3120 is vulnerable to a data validation error that...

ZOHO ManageEngine Log360 Access Control Error Vulnerability

ZOHO ManageEngine Log360 is an integrated log management and Active Directory auditing and alerting solution from ZOHO USA. The solution helps you mitigate security threats, detect persistent attack attempts, detect suspicious user activity, and comply with regulatory requirements.ZOHO ManageEngi...

Michael R Sweet HTMLDOC Buffer Overflow Vulnerability

HTMLDOC is an HTML file format conversion editor that reads HTML and Markdown source files or web pages and generates the corresponding EPUB, HTML, PostScript or PDF files with optional table of contents. A buffer overflow vulnerability exists in imageloadbmp in HTMLDOC versions prior to 1.9.12. ...

GitLab Information Disclosure Vulnerability (CNVD-2021-91179)

GitLab is a self-hosted Git version control system project repository application developed in Ruby on Rails by GitLab, Inc. GitLab CE/EE is vulnerable to an information disclosure vulnerability that stems from the fact that project exports can reveal external webhook token values, which can be...

Oracle VM VirtualBox Denial of Service Vulnerability (CNVD-2021-81790)

Oracle VM VirtualBox is a virtual machine management software from Oracle. A denial of service vulnerability exists in the Core component of Oracle VM VirtualBox versions prior to 6.1.28, which can be exploited by an attacker to cause Oracle VM VirtualBox to hang or crash frequently and repeatedl...

Portlandlabs Concrete5 server-side request forgery vulnerability

Portlandlabs Concrete5 is an open source content management system CMS from PortlandLabs, U.S. Portlandlabs Concrete5 server-side request forgery vulnerability can be exploited by attackers to retrieve HTTP and FTP files from internal server networks by inserting internal addresses...

Apache HTTP Server Denial of Service Vulnerability (CNVD-2022-09237)

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. A denial of service vulnerability exists in Apache HTTP Server version 2.4.49, which arises from the detection of new null pointer...

SAP Business One Path Traversal Vulnerability

SAP Business One is a set of enterprise management software developed by SAP, a German company. SAP Business One is vulnerable to a path traversal vulnerability that could be exploited to traverse the file system to access files or directories outside of restricted directories...

UReport Arbitrary File Creation Vulnerability

UReport is a high-performance pure Java reporting engine based on the Spring architecture. ureport version 2.2.9 contains an arbitrary file creation vulnerability. An attacker can exploit this vulnerability to execute arbitrary code...

Google Chrome WebApp Installs Code Execution Vulnerability

Google Chrome is a web browser from Google, Inc. A code execution vulnerability exists in Google Chrome WebApp Installs. The vulnerability is caused by use after the WebApp installation is free. A remote attacker can exploit this vulnerability to execute arbitrary code on the system or cause a...

F5 BIG-IP Advanced WAF and ASM WebSocket Denial of Service Vulnerability (CNVD-2021-65633)

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. When a Websocket profile is configured on the Virtual server of BIG-IP AWAF/ASM, undisclosed requests may cause the BD proces...

Exiv2 has an unspecified vulnerability (CNVD-2021-94920)

Exiv2 is a cross-platform C library and command-line utility for managing image metadata. an unspecified vulnerability exists in the printLong function in tagsint.cpp in Exiv2 version 0.27.99.0. An attacker could exploit the vulnerability to cause a denial of service via a specially crafted tif...

Google TensorFlow buffer overflow vulnerability (CNVD-2021-64535)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A buffer overflow vulnerability exists in Google TensorFlow due to a lack of valid restrictions in tf.rawops.ResourceGather in the affected version, which could be exploited by an attacker to A crash ca...

fig2dev stack buffer overflow vulnerability (CNVD-2021-68460)

fig2dev is used to convert .fig files to various graphics languages and formats. A stack buffer overflow vulnerability exists in the genptktext component of genptk.c in fig2dev version 3.2.7b. An attacker could exploit this vulnerability to cause a denial of service by converting xfig files to pt...

Ubuntu Apport Backlink Vulnerability (CNVD-2021-57437)

Apport is a toolkit for collecting and giving feedback on error messages information that the operating system finds useful when an application crashes. A security vulnerability exists in Ubuntu Apport that stems from incorrect handling of certain information gathering operations, which can be...

Microsoft HEVC Video Extensions Remote Code Execution Vulnerability (CNVD-2021-70130)

Microsoft HEVC Video Extensions is a video extension application from Microsoft Corporation USA. The application enables computers and devices to read High Efficiency Video Encoding or HEVC video.A remote code execution vulnerability exists in Microsoft HEVC Video Extensions. An attacker could...

Siemens Jt2go and Siemens Teamcenter Visualization Buffer Over Read Vulnerability (CNVD-2021-53357)

Siemens Jt2go and Siemens Teamcenter Visualization are both products of Siemens AG, Germany. Siemens Jt2go is a JT file viewer. Siemens Teamcenter Visualization is a software that provides team collaboration capabilities for designing 2D and 3D scenes. A buffer over-read vulnerability exists in...

GNU cflow Resource Management Error Vulnerability (CNVD-2021-36540)

GNU cflow is a flowchart generator for the GNU community that reads C source files and generates externally referenced flowcharts. A resource management error vulnerability exists in cflow version 1.6, which stems from the existence of a post-release use of the callchar name, int line function in...

Tenda AC11 Stack Buffer Overflow Vulnerability (CNVD-2021-33998)

The Tenda AC11 is an AC1200 dual-band Gigabit WiFi router. A stack buffer overflow vulnerability exists in /goform/setmac in the Tenda AC11 02.03.01.104CN and earlier firmware. An attacker can exploit this vulnerability to execute arbitrary code on the system via a specially crafted post request...

Webmin Cross-Site Request Forgery Vulnerability (CNVD-2021-31910)

Webmin is a Web-based system configuration tool for Unix-like systems, and the latest version can also be installed and run on Windows. A cross-site request forgery vulnerability exists in Webmin version 1.973. An attacker can use this vulnerability to create an elevated privilege user via Webmin...

Rust buffer overflow vulnerability (CNVD-2021-29835)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A buffer overflow vulnerability exists in reorder crate for Rust 2021-02-24 and earlier, which stems from the fact that swapindex may return uninitialized values if the len returned by the iterator is too large...

FUDForum cross-site scripting vulnerability (CNVD-2021-22864)

FUDforum is an open source forum system built on PHP+MySQL/PostgreSQL. A cross-site scripting vulnerability exists in FUDForum 3.1.0. An attacker can exploit this vulnerability to inject JavaScript via the author parameter in index.php...

Realtek RTL8195A Buffer Overflow Vulnerability (CNVD-2021-56816)

The Realtek RTL8195A is an IoT microcontroller from Realtek Semiconductor Taiwan, China.A buffer overflow vulnerability exists in versions prior to the Realtek RTL8195A 2.08, which could be exploited by an attacker to inject crafted packets into a WPA2 handshake to emulate an access point and...

ZeroMQ Denial of Service Vulnerability

ZeroMQ is a lightweight distributed messaging engine core library . A security vulnerability exists in versions prior to ZeroMQ 4.3.1-4+deb10u2. The vulnerability originates from a remote unauthenticated client running using the libzmq library to connect to an application and can be exploited by ...

TYPO3 code issue vulnerability (CNVD-2020-04075)

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. A security vulnerability exists in the QueryGenerator and QueryView classes in TYPO3 versions prior to 8.7.30, 9.x versions prior to 9.5.12, and 10.x versions prior to 10.2.2. An attacker...

Jenkins Git client plugin command execution vulnerability

Jenkins is an open source software project , is based on Java development of a continuous integration tool . Git client plug-in for Jenkins plug-in provides git application programming interface . Jenkins Git client plug-in has a command execution vulnerability , with Job/Configure privileges of...

Apache HTTP Server Authentication Bypass Vulnerability

Apache HTTP Server is the United States Apache Apache Software Foundation of an open source web server . An authentication bypass vulnerability exists in Apache HTTP Server. An attacker can exploit the vulnerability to bypass the authentication mechanism and perform unauthorized operations...

Cisco Webex Meetings Desktop App Update Service Command Injection Vulnerability

Cisco WebEx Meetings are web conferencing solutions. A command injection vulnerability exists in the Cisco Webex Meetings Desktop App Update Service due to insufficient validation of user-supplied parameters. An attacker exploiting this vulnerability could invoke the update service command by usi...

LibreOffice and Apache OpenOffice Information Disclosure Vulnerability (CNVD-2018-09235)

LibreOffice and Apache OpenOffice are both open source office software suites. The suite contains text documents, spreadsheets, presentations, drawings, databases and other software. The former by the Document Foundation The Document Foundation, TDF development; the latter by the U.S. Apache Apac...

Apache Syncope Information Disclosure Vulnerability

Apache Syncope is the United States Apache Apache Software Foundation's set of open source digital identity management system for use in enterprise environments. The system supports identity management, role configuration and more. A security vulnerability exists in Apache Syncope versions 1.2.x...

MariaDB and Percona XtraDB Cluster Denial of Service Vulnerability

MariaDB is a free and open source database management system developed by Monty Program Ab, Inc. and the MariaDB Foundation, Inc. and a forked version of MySQL using the Maria storage engine.Percona XtraDB Cluster is a package for creating MySQL clusters. A security vulnerability exists in the...

ISPConfig 'monitor/show_sys_state.php' SQL Injection Vulnerability

ISPConfig is a set of Linux-based open source hosting control panel, it can be used through the Web control panel to manage multiple servers, open a Web site, monitor server operating conditions and so on. The ISPConfig monitor/showsysstate.php script handles the 'server' parameter with a SQL...

ProFTPd (mod_copy) Remote Command Execution Vulnerability

ProFTPD is ProFTPD team of a set of open source FTP server software . The software is highly configurable , secure , stable and so on. A remote command execution vulnerability exists in ProFTPd. An attacker can exploit the vulnerability to execute arbitrary code in the context of an affected...