Fortinet FortiWeb Input Validation Error Vulnerability

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content.Fortinet FortiWeb An input validation error...

Fortinet FortiWeb Cross-Site Scripting Vulnerability (CNVD-2021-101133)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. versions 6.4.1 and earlier and 6.3.15 and...

Bentley View BMP File Parsing Stack Buffer Overflow Vulnerability

Bentley View, a free viewer from Bentley Systems, Inc. A stack buffer overflow vulnerability exists in Bentley View BMP file parsing, which is due to a failure to properly validate the length of user-supplied data before copying it to the heap buffer. An attacker could exploit this vulnerability ...

Crafter CMS licensing issue vulnerability

Crafter CMS is an open source content management system CMS for digital experience applications. Crafter CMS is vulnerable to an authorization issue in versions 3.1 through 3.1.15, which stems from a lack of authentication measures or insufficient authentication strength in the web system or...

Apache APISIX Command Injection Vulnerability

Apache Apisix is a cloud-native microservices API gateway service from the Apache Foundation. The software is based on OpenResty and etcd and features dynamic routing and plugin hot-loading for API management in a microservice architecture. Apache APISIX has a security vulnerability that stems fr...

Moddable SDK Heap Buffer Overflow Vulnerability (CNVD-2021-90313)

The Moddable SDK is a combination of development tools and runtime software used to create applications for microcontrollers. a security vulnerability exists in the Moddable SDK, which stems from a networked system or product that does not properly validate data boundaries when performing...

WordPress plugin Popular Posts arbitrary file upload vulnerability

WordPress is a blogging platform developed using the PHP language, which supports setting up personal blogging sites on PHP and MySQL servers. WordPress plugin Popular Posts 5.3.2 and previous versions are vulnerable to arbitrary file uploads. An attacker could exploit the vulnerability to upload...

Kirby Cross-Site Scripting Vulnerability (CNVD-2021-95256)

Kirby is a file-based content management system CMS. Kirby suffers from a cross-site scripting vulnerability that stems from the product's failure to validate input data, which could be exploited by attackers to execute client-side code...

Laravel Framework has an unspecified vulnerability

Laravel Framework is a PHP-based web application development framework from Taylor Otwell, a personal developer.A security vulnerability exists in versions of Laravel Framework prior to 8.70.2, which stems from the fact that the framework does not adequately prevent the upload of executable PHP...

ResourceSpace directory traversal vulnerability

ResourceSpace is a digital asset management tool that enables users to organize their digital assets. a directory traversal vulnerability exists in ResourceSpace. An attacker could exploit the vulnerability to delete arbitrary files on the ResourceSpace server via the provider and variant...

Michael R Sweet HTMLDOC Buffer Overflow Vulnerability

HTMLDOC is an HTML file format conversion editor that reads HTML and Markdown source files or web pages and generates the corresponding EPUB, HTML, PostScript or PDF files with optional table of contents. A buffer overflow vulnerability exists in imageloadbmp in HTMLDOC versions prior to 1.9.12. ...

Google Chrome Background Fetch API Security Bypass Vulnerability (CNVD-2021-73418)

Google Chrome is a web browser from Google, Inc. A security bypass vulnerability exists in the Google Chrome Background Fetch API. An attacker could exploit this vulnerability to bypass security restrictions...

Sensitive Information Disclosure Vulnerability in Multiple Siemens SIMATIC Products

SIPLUS extreme products are designed for reliable operation under extreme conditions and are based on SIMATIC, LOGO!, SITOP, SINAMICS, SIMOTION, SCALANCE or other devices.The SIMATIC CP 1543-1 and SIMATIC CP 1545-1 communication processors connect the S7-1500 controller to the Ethernet. It provid...

openssl buffer overflow vulnerability (CNVD-2021-71263)

OpenSSL is an open source general-purpose cryptographic library from the Openssl team capable of implementing the Secure Sockets Layer SSLv2/v3 and Secure Transport Layer TLSv1 protocols. The product supports a variety of encryption algorithms, including symmetric ciphers, hashing algorithms,...

Advantech R-SeeNet Cross-Site Scripting Vulnerability (CNVD-2021-57185)

Advantech R-SeeNet is an industrial monitoring software from Advantech, Taiwan, China. The software is based on the snmp protocol for monitoring platforms and is available for Linux and Windows platforms.A cross-site scripting vulnerability exists in the devicegraphpage.php script function of...

Microsoft Windows/Windows Server Elevation of Privilege Vulnerability (CNVD-2021-66089)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation USA.Microsoft Windows is a set of operating systems for personal devices.Microsoft Windows Server is a set of server operating systems. An elevation of privilege vulnerability exists in Win32k in Microsoft...

Insyde InsydeH2O has an unspecified vulnerability (CNVD-2022-10035)

Insyde H2OFFT is a set of tools for BIOS firmware development from Insyde Software Taiwan, China.Insyde InsydeH2O has a security vulnerability that could be exploited by attackers to gain control of the system via system administration mode privileges...

Nextcloud server processing logic error vulnerability

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A processing logic error vulnerability exists in the Nextcloud server, which stems from the fact that the Nextcloud server is vulnerable to brute-force attack...

Weak Password Vulnerability in 3Com-OfficeConnect ADSL Wireless 11g Firewall Router

Founded in 1979, 3Com is a U.S. equipment provider of security products, integrated voice appliances, and data networking solutions for businesses of all sizes. A weak password vulnerability exists in the 3Com-OfficeConnect ADSL Wireless 11g Firewall Router, which can be exploited by attackers to...

Ruby Parameter Injection Vulnerability

Ruby is a cross-platform, object-oriented, dynamically-typed programming language from the individual developer, Yukihiro Matsumoto. A parameter injection vulnerability exists in Ruby versions prior to 1.4.0, which can be exploited by an attacker to read and write arbitrary files via a crafted UR...

Siemens Tecnomatix Plant Simulation Buffer Error Vulnerability

Siemens Tecnomatix Plant Simulation is an industrial control device from Siemens, Germany. The power of discrete-event simulation is used to analyze and optimize throughput and thus improve manufacturing system performance. A buffer error vulnerability exists in Tecnomatix Plant Simulation versio...

Microsoft Word Code Execution Vulnerability

Microsoft Word is a word processing software in the Office suite of the U.S. company Microsoft Microsoft. A code execution vulnerability exists in Microsoft Word, which can be exploited by an attacker to execute arbitrary code on a system with the victim's privileges...

Accusoft ImageGear out-of-bounds write vulnerability (CNVD-2021-25372)

Accusoft ImageGear is a multi-platform, multi-language document imaging developer toolkit. An out-of-bounds write vulnerability exists in the TIFF header count processing functionality of Accusoft ImageGear 19.8. An attacker can exploit the vulnerability by supplying a specially crafted malicious...

PostgreSQL Resource Management Error Vulnerability (CNVD-2021-14792)

PostgreSQL is a free object-relational database management system organized by Postgresql. The system supports most of the SQL standards and provides many other features, such as foreign keys, triggers, views, etc. A resource management error vulnerability exists in PostgreSQL, which arises from...

NZXT CAM WinRing0x64 Driver Privilege Elevation Vulnerability

NZXT CAM is a performance monitoring software for gaming computers from NZXT. A vulnerability exists in the NZXT CAM WinRing0x64 Driver Privilege I/O Write IRPs feature, which can be exploited by a remote attacker to submit a special I/O request that can be elevated in privilege...

Linux kernel denial of service vulnerability (CNVD-2020-52622)

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A security vulnerability exists in the 'vfsubdentryopen' function in the Linux kernel. The vulnerability stems from an implementation of aufs that does not properly...

Drupal cross-site request forgery vulnerability (CNVD-2021-36607)

Drupal is an open source content management system developed by the Drupal community using the PHP language. A cross-site request forgery vulnerability exists in the Drupal core Form API, which stems from the program failing to properly process form input. An attacker can exploit this vulnerabili...

VMware Spring Cloud Config Path Traversal Vulnerability

VMware Spring Cloud Config is a configuration management solution for distributed systems from VMware. The product is mainly for the external configuration of distributed systems to provide server and client support. A path traversal vulnerability exists in the Spring-cloud-config-server module i...

Ruby on Rails Cross-Site Request Forgery Vulnerability (CNVD-2020-34299)

Ruby on Rails is a set of Rails team based on the Ruby language open source Web application framework. A cross-site request forgery vulnerability exists in Ruby on Rails 6.0.3 and earlier versions. The vulnerability stems from a web application that does not adequately validate that a request is...

Red Hat Keycloak Authorization Issue Vulnerability (CNVD-2020-40740)

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. An authorization issue vulnerability exists in Red Hat Keycloak versions prior to 8.0.0. A remote attacker could exploit the vulnerability by...

WordPress Gtranslate Cross-Site Scripting Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress Gtranslate versions prior to 2.8.52, which stems from...

Sylius ResourceBundle Information Disclosure Vulnerability

Sylius is a set of Symfony framework based on open source e-commerce platform . An information disclosure vulnerability exists in Sylius ResourceBundle. The vulnerability stems from a configuration or other error in the operation of a network system or product. An unauthorized attacker can exploi...

Sylius Environment Issues Vulnerabilities

Sylius is a set of Symfony framework based on open source e-commerce platform . An environmental issue vulnerability exists in Sylius. The vulnerability stems from an unreasonable environmental factor in a networked system or product. No detailed vulnerability details are provided at this time...

Plataformatec Simple Form Input Validation Error Vulnerability

Plataformatec Simple Form is a form builder from Plataformatec Brazil. An input validation error vulnerability exists in Plataformatec Simple Form. The vulnerability originates from a network system or product that does not properly validate input data. Detailed vulnerability details are not...

Unspecified Vulnerability in CloudBees Jenkins Kubernetes::Pipeline::Kubernetes Steps Plugin

CloudBees Jenkins Hudson Labs is a set of U.S. CloudBees company based on Java development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed tasks.Kubernetes::Pipeline::Arquillian Steps Plugin is used in...

WordPress wp-google-maps plugin input validation error vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. wp-google-maps plugin is a Google Maps plugin used in it. An input validation error vulnerability exists in the...

Atlassian Jira issue collector cross-site scripting vulnerability

Atlassian JIRA is a defect tracking management system from Atlassian Australia. The system is mainly used to track and manage all kinds of issues and defects in the workplace. issue collector is one of the issue collectors. A cross-site scripting vulnerability exists in the error message of a...

Apache HTTP Server Denial of Service Vulnerability (CNVD-2018-06535)

Apache HTTP Server is the United States Apache Apache Software Foundation, an open source web server. The server is fast, reliable and can be expanded through a simple API. A security vulnerability exists in Apache HTTP Server that stems from the program's failure to properly destroy HTTP/2...

WordPress Duplicator Plugin Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Duplicator plugin version 1.2.32, which can be exploited by an...

AsusWRT router/httpd/httpd.c file access bypass vulnerability

ASUS AsusWRT is a set of router operating systems from ASUS. A security vulnerability exists in the 'handlerequest' function of the router/httpd/httpd.c file in versions prior to ASUS AsusWRT 3.0.0.4.38410007. An attacker can exploit this vulnerability to execute a POST request...

Opentext Documentum Content Server File Download Vulnerability

OpenText Documentum Content Server formerly known as EMC Documentum Content Server is a content management service system from OpenText Canada. The system is mainly used to manage the Documentum content repository, you can create, modify and track documents and other operations. A file download...

FileRun Remote SQL Injection Vulnerability

FileRun File Manager gives you access to your files anytime, anywhere with self-hosted secure cloud storage, file backups and sharing of photos, videos, documents and more. FileRun suffers from a remote SQL injection vulnerability that originates from the program's failure to validate the metafie...

Siemens SIMATIC HMI Denial of Service Vulnerability

SIMATIC HMI is an industrial device from Siemens, Germany.SIMATIC HMI panels are used for operator control and monitoring of machines and equipment. A denial of service vulnerability in the Siemens SIMATIC HMI Multi-Panel and HMI Mobile Panels, as well as in the S7-300/S7-400 devices, allows an...

WordPress Mail Masta plugin SQL injection vulnerability (CNVD-2017-02399)

WordPress is the WordPress Software Foundation's set of blogging platform using the PHP language development, the platform supports in PHP and MySQL servers to set up a personal blog site.Mail Masta Plugin is one of the mail plugin. The Mail Masta Plugin for WordPress suffers from a SQL injection...

Apache HTTP Server suffers from httpoxy remote proxy infection vulnerability

Apache HTTP Server is the United States Apache Apache Software Foundation, an open source web server. The server is fast, reliable and can be expanded through a simple API. httpoxy is a set of vulnerabilities that affect application code running in a CGI environment. The vulnerabilities exist...

Gajim Message Interception Vulnerability

Gajim is a suite of free instant messaging software based on the Jabber communication protocol developed by the Gajim project. A security vulnerability exists in versions of Gajim prior to 0.16.5, which can be exploited by remote attackers to modify the roster and intercept messages with the help...

Red Hat openstack-puppet-modules trust management vulnerability

Red Hat openstack-puppet-modules is a Red Hat implementation of Puppet a configuration management tool based on a client/server architecture capable of configuring core OpenStack services. A security vulnerability in the puppet manifests in Red Hat openstack-puppet-modules versions prior to...

Samba OS Command Injection Vulnerability

Samba is Samba open source a standard Windows interoperability program suite for Linux and Unix. Samba suffers from an operating system command injection vulnerability that stems from a lack of proper validation or escaping of NetBIOS names in front-end WINS hook processing, which could lead to...

HDF5 Buffer Overflow Vulnerability (CNVD-2025-16249)

HDF5 is a data management suite developed by The HDF Group for storing and managing large-scale scientific data. A security vulnerability exists in the H5Omtimenewencode function in the src/H5Omtime.c file of HDF5 version 1.14.6, which stems from improper handling of data boundaries. An attacker...

Mattermost Authorization Issues Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an authorization issue vulnerability that stems from improper privilege validation, which can be exploited by an attacker to make unauthorized changes to the system administrato...