EyouCMS Deserialization Vulnerability

EyouCms Eyou CMS is an open source content management system CMS based on ThinkPHP. EyouCMS version 1.6.5 has a deserialization vulnerability, the vulnerability stems from the unsafe deserialization of the parameter channelid of the file /login.php in the receipt of user-submitted serialized data...

Mattermost Denial of Service Vulnerability (CNVD-2024-14305)

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a denial-of-service vulnerability that stems from an inability to limit the number of mentions processed per message, which can be exploited by an authenticated attacker to cras...

Siemens SINEMA Remote Connect Client Information Disclosure Vulnerability

SINEMA Remote Connect is a management platform for remote networks that makes it simple to manage tunneled connections VPN between headquarters, service technicians and installed machines or plants. An information disclosure vulnerability exists in Siemens SINEMA Remote Connect Client, which can ...

SWFTools Denial of Service Vulnerability (CNVD-2024-37468)

SWFTools is a set of utilities for working with Adobe Flash files SWF files. A denial of service vulnerability exists in SWFTools version v0.9.2, which stems from an overlapping strcpy parameter in component /home/swftools/src/swfc+0x448318a. An attacker can exploit this vulnerability to cause a...

Unspecified Vulnerability in Oracle MySQL (CNVD-2024-11155)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. A security vulnerability exists in Oracle MySQL for MySQL Server version 8.2.0 and earlier versions. An attacker can exploit this vulnerability to...

Linux has a binary vulnerability

Linux is an open source Unix-like operating system. Linux has a binary vulnerability that can be exploited by attackers to elevate privileges...

Apache NiFi cross-site scripting vulnerability (CNVD-2023-9665850)

Apache NiFi is a data processing and distribution system from the Apache USA Foundation. The system is primarily used for data routing, transformation and system intermediary logic. Apache NiFi suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and...

Fortinet FortiClient Hardcoding Vulnerability

Fortinet FortiClient is a mobile endpoint security solution from Fortinet. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance and two-factor authentication when connected to a FortiGate firewall appliance. A hard-coded vulnerability exists in Fortinet FortiClien...

SAP PowerDesigner Input Validation Error Vulnerability

SAP PowerDesigner is a database design software from SAP Germany. An input validation error vulnerability exists in SAP PowerDesigner version 16.7, which stems from an inability to adequately validate a BPMN2 XML document imported from an untrusted source. An attacker could exploit this...

Google libwebp open source library remote code execution vulnerability

WebP is an image format developed by Google, which supports lossy and lossless compression of network images, and its compression effect and speed have certain advantages over PNG and JPEG formats. libwebp is a C/C++ open source library that implements the coding and decoding of the WebP image...

Microsoft Excel Information Disclosure Vulnerability (CNVD-2023-80108)

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. An information disclosure vulnerability exists in Microsoft Excel, which can be exploited by attackers to obtain sensitive information...

Microsoft Exchange Server Remote Code Execution Vulnerability (CNVD-2023-72224)

Microsoft Exchange Server is the United States Microsoft Microsoft company's set of e-mail service program. It provides e-mail access, storage, forwarding, voice mail, e-mail filtering and screening. A remote code execution vulnerability exists in Microsoft Exchange Server, which can be exploited...

Linux Kernel Denial of Service Vulnerability (CNVD-2023-64507)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A denial of service vulnerability exists in the Linux Kernel, which originates from a null pointer dereference issue in fs/jfs/jfsdmap.c, a component of the Journaling File...

Siemens Tecnomatix Plant Simulation Out-of-Bounds Write Vulnerability (CNVD-2023-56537)

Siemens Tecnomatix Plant Simulation is an industrial control device from Siemens, Germany, that uses discrete-event simulation to analyze and optimize throughput and thereby improve manufacturing system performance. Siemens Tecnomatix Plant Simulation suffers from an out-of-bounds write...

Trend Micro Apex One elevation of privilege vulnerability (CNVD-2023-65417)

Trend Micro Apex One is an endpoint protection software from Trend Micro. An elevation of privilege vulnerability exists in Trend Micro Apex One, which can be exploited by a local attacker to elevate privileges and write arbitrary values to specific entries...

ChurchCRM Cross-Site Scripting Vulnerability (CNVD-2023-64494)

ChurchCRM is an open source Church CRM and management software. A cross-site scripting vulnerability exists in ChurchCRM version 4.5.3, which can be exploited by an attacker to inject malicious JavaScript scripts...

answer authorization issue vulnerability (CNVD-2023-40597)

answer is an open source knowledge-based community software. A vulnerability in authorization issues exists in versions of answer prior to 1.0.9, which stems from a lack of authorization for the software. An attacker could use this vulnerability to unauthorize changes or delete votes...

NETGEAR RBR750 Command Injection Vulnerability

The NETGEAR RBR750 is a home WiFi system from NETGEAR. The NETGEAR RBR750 version 4.6.8.5 suffers from a command injection vulnerability that stems from a failure to properly filter constructed command special characters, commands, etc. in the hidden telnet service feature. An attacker could...

Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability (CNVD-2023-28102)

Microsoft PostScript Printer Driver is a Microsoft standard printer driver for PostScript printers from Microsoft. Microsoft PostScript and PCL6 Class Printer Driver is a remote code execution vulnerability that can be exploited by attackers to remotely execute code...

Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability (CNVD-2023-28107)

Microsoft PostScript Printer Driver is a Microsoft standard printer driver for PostScript printers from Microsoft USA. Microsoft PCL6 Class Printer Driver is a printer driver software from Microsoft Corporation. Microsoft PostScript and PCL6 Class Printer Driver contains an information disclosure...

Apache Airflow Google Provider Input Validation Error Vulnerability (CNVD-2023-88040)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An input validation error vulnerability exists in Apache Airflow Google Provider...

Fortinet FortiWeb Path Traversal Vulnerability (CNVD-2023-18293)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. A path traversal vulnerability exists that...

Apache Sling JNDI Injection Vulnerability

Apache Sling is the United States Apache Apache Foundation of a Java platform for open source Web framework. Designed to meet the JSR-170 content repository such as Apache Jackrabbit to create content-centric applications. Apache Sling JCR Base versions prior to 3.1.12 JNDI injection vulnerabilit...

Microsoft 3D Builder Remote Code Execution Vulnerability (CNVD-2023-04327)

Microsoft 3D Builder, a tool for creating models and 3D printing from Microsoft USA, has a security vulnerability. No details of the vulnerability are currently available...

Mozilla Firefox Access Control Error Vulnerability (CNVD-2023-03068)

Mozilla Firefox is an open source Web browser from the Mozilla Foundation in the U.S. An access control error vulnerability exists in Mozilla Firefox, which stems from the Remote Agent used in WebDriver not validating the Host or Origin header. An attacker could exploit the vulnerability to force...

kkFileView cross-site scripting vulnerability (CNVD-2023-00013)

kkFileView is China's Keking Technology Keking company's a Spring-Boot to create a file document online preview project . A cross-site scripting vulnerability exists in kkFileView, which stems from the setWatermarkAttribute function in the /picturesPreview file that allows an attacker to implemen...

Linux kernel has unspecified vulnerabilities (CNVD-2023-06532)

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. Linux kernel USB core subsystem has a security vulnerability that stems from incorrect access control and can be exploited by local attackers to crash the system...

Google TensorFlow has an unspecified vulnerability (CNVD-2023-15772)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc...

Chocolatey PHP Permission Design Vulnerability

PHP is a scripting language that executes on the server side. A privilege design vulnerability exists in the Chocolatey PHP package v8.1.12 and below, which originates from all users in the Authenticated users group having write access to the subfolder C:\tools\php81 and all files in that folder,...

NdkAdvancedCustomizationFields Server-Side Request Forgery Vulnerability

NdkAdvancedCustomizationFields is an advanced customization field from Ndk. A server-side request forgery vulnerability exists in NdkAdvancedCustomizationFields 3.5.0 and prior versions, which stems from rotateimg.php failing to properly validate user input. An attacker could use this vulnerabili...

Google TensorFlow MirrorPadGrad buffer overflow vulnerability

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A buffer overflow vulnerability exists in Google TensorFlow, which originates from the "MirrorPadGrad" input "paddings" is too large, an attacker can use this vulnerability to cause a heap memory...

Siemens Parasolid out-of-bounds write vulnerability

Parasolid is a 3D geometric modeling tool that supports multiple techniques, including solid modeling, direct editing, and free-form surface/table modeling.An out-of-bounds write vulnerability exists in Siemens Parasolid, which can be exploited by attackers to execute code in the context of the...

Google Chrome Permissions API Memory Misreference Vulnerability

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in Google Chrome versions prior to 106.0.5249.119. The vulnerability stems from the use of the Permissions API after release, and can be exploited by a remote attacker to trick a user into...

Microsoft Windows Local Session Manager (LSM) Denial of Service Vulnerability

Microsoft Windows is a set of operating systems for personal devices from the U.S. Microsoft Windows Local Session Manager LSM has a denial-of-service vulnerability that can be exploited by attackers to launch denial-of-service attacks...

Siemens Simcenter Femap has an unspecified vulnerability

Siemens Simcenter Femap is a cutting-edge engineering simulation application from Siemens, Germany. Simcenter Femap versions prior to 11.1.1.0, 2022.1.0 and later, 2022.1.3 and later, 2022.2.0 and later, and 2022.2.2 and earlier contain security vulnerabilities that can be exploited by attackers ...

Microsoft Client Server Run-time Subsystem (CSRSS) Privilege Elevation Vulnerability

Microsoft Client Server Run-time Subsystem is a client/server run-time subsystem from Microsoft Corporation of the United States, manifested as the csrss.exe process. It is a component of the Windows NT operating system family, appearing in Windows NT 3.1 and later systems, and provides the user...

Patrik Dufresne Rdiffweb user redirection vulnerability

Patrik Dufresne Rdiffweb is a web application from the personal developer Patrik Dufresne, USA. Patrik Dufresne Rdiffweb is vulnerable to a user redirection vulnerability, which stems from the fact that the system does not handle target bounces properly and can be exploited to inject malicious...

Google Chrome Resource Management Error Vulnerability (CNVD-2022-81239)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a Resource Management Error vulnerability that originates from a confusion in the instructions responsible for freeing memory in Assistant. An attacker could exploit this vulnerability to cause a program...

Apache SOAP XML External Entity Injection Vulnerability

Apache SOAP is used as a client-side library by the Apache Foundation to invoke SOAP services available elsewhere, and as a server-side tool to implement SOAP-accessible services. parser in the RPCRouterServlet. An attacker could exploit this vulnerability to read arbitrary files...

Linux kernel resource management error vulnerability (CNVD-2022-69191)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A resource management error vulnerability exists in Linux kernel 5.19.10 and earlier versions, which stems from a confusion in the instruction responsible for freeing memory in...

Apache Airflow Licensing Issue Vulnerability (CNVD-2022-76236)

Apache Airflow is the Apache Foundation's open source platform for creating, managing, and monitoring workflows. A security vulnerability exists in Apache Airflow versions 2.2.4 to 2.3.3, which stems from the vulnerability of the "database" web server session backend to session fixation. No detai...

Laravel Deserialization Vulnerability (CNVD-2022-59204)

Laravel is a web application framework from the Laravel team.Laravel version 5.1 contains a deserialization vulnerability that stems from insecure deserialization processing of serialized data submitted by the application at the time of receipt, which can be exploited by an attacker to remotely...

Microsoft Azure Site Recovery Remote Code Execution Vulnerability (CNVD-2022-84112)

Microsoft Azure Site Recovery is a site recovery DRaaS from Microsoft Corporation for cloud and hybrid cloud architectures. The vulnerability stems from the failure of a network system or product to properly filter special elements of code segments during the construction of external input data. ...

WordPress Hotels/Restaurant/Car Rental Free Booking plugin Arbitrary File Upload Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An arbitrary file upload...

Google Android Information Disclosure Vulnerability (CNVD-2022-61753)

Google Android is a Linux-based open-source operating system from the U.S. company Google Google. Google Android has an information leakage vulnerability that could be exploited by attackers to obtain sensitive information...

Jorani v1.0 SQL Injection Vulnerability

Jorani is a leave management system developed by Benjamin BALET, an individual developer in France. Designed to provide small organizations with a simple workflow for leave and overtime requests. Jorani v1.0 suffers from an SQL injection vulnerability that stems from a lack of valid validation in...

Multiple Dahua Products Denial of Service Vulnerabilities

Dahua IPC-HFW2XXX is a series of IP cameras, Dahua IPC-HDBW2XXX is a series of cameras, Dahua ASI7XXXX is a series of face recognition access controllers, and Dahua IPC-HFW2XXX is a series of IP cameras. A denial of service vulnerability exists in several Dahua products, which could be exploited ...

WordPress Simple Membership plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in versions of the WordPress Simple Membership plugin prior to...

WordPress plugin CP Image Store with Slideshow SQL Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The WordPress plugin is an application plugin. The WordPress plugin CP Image Store with Slideshow version 1.0.68 has a SQL injection...

Elasticsearch Denial of Service Vulnerability

Elasticsearch is a search engine based on the Lucene library. A denial of service vulnerability exists in Elasticsearch versions 8.0.0 included through 8.2.1 not included. An unauthenticated attacker could exploit the vulnerability to forcefully shut down an Elasticsearch node via a network reque...