EyouCMS Deserialization Vulnerability

EyouCms Eyou CMS is an open source content management system CMS based on ThinkPHP. EyouCMS version 1.6.5 has a deserialization vulnerability, the vulnerability stems from the unsafe deserialization of the parameter channelid of the file /login.php in the receipt of user-submitted serialized data...

Apache Fineract SQL Injection Vulnerability (CNVD-2024-16106)

Apache Fineract is a set of open source digital financial services platform from the U.S. Apache Apache Foundation. The platform can provide users with data management, loan and savings portfolio management and real-time financial data and other functions. Apache Fineract versions prior to 1.8.5...

Apache Answer Cross-Site Scripting Vulnerability

Apache Answer is a community platform of the Apache USA Foundation. Apache Answer 1.2.1 and earlier versions suffer from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data, which can be exploited by an attacker to...

Mozilla Firefox for iOS Cross-Site Scripting Vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A cross-site scripting vulnerability exists in Mozilla Firefox for iOS, which can be exploited by an attacker to execute JavaScript from an open bookmarked page to obtain the victim's cookie-based...

Unspecified Vulnerability in Oracle MySQL (CNVD-2024-11119)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. A security vulnerability exists in Oracle MySQL for MySQL Server version 8.0.35 and earlier, version 8.2.0 and earlier, which can be exploited by an...

Adobe InDesign Code Issues Vulnerabilities

Adobe InDesign is a set of layout and editing applications from the American company Audobee Adobe. Adobe InDesign has a security vulnerability that can be exploited by attackers to cause a denial of service...

Apache Superset Cross-Site Scripting Vulnerability (CNVD-2023-9665948)

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. A cross-site scripting vulnerability exists in Apache Superset versions prior to 2.1.2, which stems from the presence of incorrect payload validation and incorrect REST API response type issues. ...

Rockwell Automation Pavilion8 License Issue Vulnerability

Rockwell Automation Pavilion8 is a model prediction console from Rockwell Automation. Rockwell Automation Pavilion8 suffers from an authorization issue vulnerability that stems from the fact that the JMX Console is publicly available to users and does not require authentication. An attacker could...

FreeImage ofLoad function buffer overflow vulnerability

FreeImage is a cross-platform open source library for supporting popular graphic image formats. A buffer overflow vulnerability exists in the FreeImage ofLoad function, which can be exploited by an attacker to execute arbitrary code on a system or cause a denial of service attack...

FreeImage LoadPixelDataRLE8 function buffer overflow vulnerability

FreeImage is a cross-platform open source library for supporting popular graphic image formats. A buffer overflow vulnerability exists in the FreeImage LoadPixelDataRLE8 function, which can be exploited by an attacker to execute arbitrary code on a system or cause a denial of service attack...

Cleaning Business Software Cross-Site Scripting Vulnerability

Cleaning Business Software is PHPJabbers open source a cleaning business software. Cleaning Business Software v1.0 version of the existence of cross-site scripting vulnerabilities , the vulnerability stems from the file / index.php parameter index of the user-supplied data lack of effective...

Linux kernel resource management error vulnerability (CNVD-2023-56640)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. The Linux kernel suffers from a resource management error vulnerability that stems from a hash conflict problem. An attacker could exploit this vulnerability to cause a denial ...

Apache OFBiz Path Traversal Vulnerability

Apache OFBiz is the United States Apache Apache Foundation of a set of enterprise resource planning ERP system. The system provides a set of Java-based Web application components and tools. Apache OFBiz suffers from a path traversal vulnerability that stems from the application failing to properl...

Siemens Tecnomatix Plant Simulation Memory Corruption Vulnerability

Siemens Tecnomatix Plant Simulation is an industrial control device from Siemens, Germany. Using the function of discrete event simulation for production volume analysis and optimization, and thus improve the manufacturing system performance. A memory corruption vulnerability exists in versions...

D-Link DIR-867 Command Injection Vulnerability

The D-Link DIR-867 is a wireless router from China Youxun D-Link.A command injection vulnerability exists in the D-Link DIR-867, which is caused by a command injection vulnerability in the SetVirtualServerSettings function. By sending a carefully crafted request using the LocalIPAddress parameter...

Oracle VM VirtualBox has an unspecified vulnerability (CNVD-2023-05474)

A security vulnerability exists in Oracle VM VirtualBox, a virtual machine management software from Oracle Corporation USA. A highly privileged attacker could use the vulnerability to compromise Oracle VM VirtualBox by logging into the infrastructure where Oracle VM VirtualBox is executing...

Oracle VM VirtualBox has an unspecified vulnerability (CNVD-2023-05479)

A security vulnerability exists in Oracle VM VirtualBox, a virtual machine management software from Oracle Corporation. A low privilege attacker can log into the server where Oracle VM VirtualBox resides to compromise Oracle VM VirtualBox...

Mozilla Firefox Information Disclosure Vulnerability (CNVD-2023-06856)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from an information disclosure vulnerability that stems from the fact that the performance API does not properly hide whether a redirect is noted for requesting a cross-domain...

OpenImageIO Out-of-Bounds Write Vulnerability

OpenImageIO is an image read/write library, along with a number of tools and applications. OpenImageIO suffers from an out-of-bounds write vulnerability, which is caused by an out-of-bounds write flaw in the OpenImageIO::addexixitemtospec function. An attacker could use this vulnerability to...

IBM AIX Denial of Service Vulnerability (CNVD-2023-00807)

IBM AIX is an open standards-based UNIX operating system developed by International Business Machines IBM for the IBM Power architecture. IBM AIX suffers from a denial-of-service vulnerability that can be exploited by unprivileged local attackers to cause a denial of service...

Chocolatey PHP Permission Design Vulnerability

PHP is a scripting language that executes on the server side. A privilege design vulnerability exists in the Chocolatey PHP package v8.1.12 and below, which originates from all users in the Authenticated users group having write access to the subfolder C:\tools\php81 and all files in that folder,...

Telos Alliance Omnia MPX Node Insecure Direct Object Reference Vulnerability

The Telos Alliance Omnia MPX Node is a specialized hardware codec from Telos Alliance, USA. Capable of transmitting or receiving full FM signals at data rates as low as 320 kbps using the Omnia μMPXTM algorithm, it is ideally suited for capacity-limited networks, including IP radios. An insecure...

Democritus Project d8s-networking code execution vulnerability (CNVD-2022-84125)

Democritus Project is a collection of simple, effective, modular, well-tested and well-documented features from Democritus. A code execution vulnerability exists in Democritus Project d8s-networking, which stems from the existence of a potential code execution backdoor inserted by a third party i...

Advantech R-SeeNet Stack Buffer Overflow Vulnerability

Advantech R-SeeNet is an industrial monitoring software from Advantech China. The software is based on the snmp protocol for monitoring platforms and is available for Linux and Windows platforms.Advantech R-SeeNet 2.4.17 and previous versions are vulnerable to a stack buffer overflow vulnerabilit...

Adobe Illustrator Input Validation Error Vulnerability (CNVD-2023-07319)

Adobe Illustrator is a vector-based image creation software from Adobe. Adobe Illustrator is vulnerable to an input validation error, which can be exploited to execute arbitrary code in the context of the current user...

Oracle MySQL Shell Information Disclosure Vulnerability

Oracle MySQL Server is a relational database from Oracle Corporation. An information disclosure vulnerability exists in the Shell: Core Client component of Oracle MySQL Shell. An attacker can exploit this vulnerability to corrupt the MySQL Shell and gain unauthorized access to a subset of MySQL...

Oracle Supply Chain Information Disclosure Vulnerability (CNVD-2023-11168)

Oracle Supply Chain Products Suite is a set of supply chain solutions from Oracle Oracle. The product provides value chain planning, value chain execution, product lifecycle management and other functions. An information disclosure vulnerability exists in Oracle Transportation Management versions...

OTFCC Buffer Overflow Vulnerability (CNVD-2023-11780)

OTFCC is a C library and utility open sourced by Caryll. It is used to parse and write OpenType font files.OTFCC 0.10.4 and earlier versions have a buffer overflow vulnerability that stems from /release-x64/otfccdump 0x6b558f a boundary error when processing untrusted input, which can be exploite...

Microsoft Windows CD-ROM File System Driver Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the Windows CD-ROM File System Driver, which stems from the failure of a network system or product to properly filter special elements in the external input data used to construct code segments. The vulnerability can be exploited by an attacker to...

SAP 3D Visual Enterprise Author .sldprt Buffer Overflow Vulnerability

SAP 3D Visual Enterprise Author is a desktop application for managing 2D, 3D, animation, video and audio assets from SAP. A buffer overflow vulnerability exists in SAP 3D Visual Enterprise Author version 9, which stems from a lack of proper memory management and can be exploited by an attacker to...

Huawei HarmonyOS Storage Vectors Out-of-Bounds Read Vulnerability

Huawei HarmonyOS is an operating system from Huawei, a Chinese company that provides a microkernel-based distributed operating system. An out-of-bounds read vulnerability exists in Huawei HarmonyOS, which stems from an out-of-bounds array read in the storage dimension module. An attacker could...

Bento4 AP4_Processor::Process Denial of Service Vulnerability

Bento4 is an open source C library for reading and writing MP4 files. version v1.6.0-639 of Bento4 contains a denial of service vulnerability that stems from a memory leak in the AP4Processor::Process function in the mp4encrypt binary. An attacker could exploit the vulnerability to cause a denial...

Bento4 Ap4StdCFileByteStream.cpp Denial of Service Vulnerability

Bento4 is an open source C++ library for reading and writing MP4 files. A denial of service vulnerability exists in Bento4 version 1.6.0-639, which originates in the AP4StdcFileByteStream::CreateAP4FileByteStream, char const , AP4FileByteStream::Mode, AP4ByteStream& function does not free or fail...

Genivia Dlt-daemon Denial of Service Vulnerability

Dlt-daemon is the DLT communication interface for Genivia's ECU. It collects and buffers log messages from one or more DLT users running on the ECU and makes them available to DLT clients upon request. A denial of service vulnerability exists in Genivia Dlt-daemon 2.18.8 and prior versions, which...

Rdiffweb Username Denial of Service Vulnerability

Rdiffweb is a web application by Patrik Dufresne, an individual developer in the USA. It provides quick access to your archives through an efficient web interface. A denial of service vulnerability exists in Rdiffweb versions prior to 2.4.8, which stems from a lack of length validation of the...

Google TensorFlow Denial of Service Vulnerability (CNVD-2023-15782)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A denial-of-service vulnerability exists in Google TensorFlow, which stems from the fact that the implementation of tf.reshape op in TensorFlow is vulnerable to an overflow in the number of elements in...

Adobe InCopy out-of-bounds read vulnerability (CNVD-2023-05233)

Adobe InCopy is an application produced by Adobe for professional word processing. Adobe InCopy 17.3 and 16.4.2 and prior versions contain an out-of-bounds read vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the current user...

Huawei HarmonyOS iAware module malicious application control vulnerability

Huawei HarmonyOS is an operating system from Huawei, China. It provides a microkernel-based, fully distributed operating system. The Huawei HarmonyOS iAware module is vulnerable to a malicious application control vulnerability that could be exploited to cause malicious applications to boot and...

Tenda AX180 Stack Overflow Vulnerability (CNVD-2022-78480)

Tenda AX1803 is a dual-band Gigabit WIFI6 router from Tenda China.Tenda AX1803 is vulnerable to a stack overflow vulnerability, which is caused by improper boundary checking of the fromSysTime function. An attacker could exploit this vulnerability to overflow the buffer and execute arbitrary code...

Google Android Information Disclosure Vulnerability (CNVD-2022-85765)

Google Android is a Linux-based open source operating system from Google, Inc. Google Android is vulnerable to an information disclosure vulnerability caused by a missing permission check in ConnectivityService. An attacker could use this vulnerability to obtain sensitive information...

Apache Traffic Server Input Validation Error Vulnerability (CNVD-2023-03923)

Apache Traffic Server ATS is a set of scalable HTTP proxy and caching servers from the Apache Foundation. Apache Traffic Server is vulnerable to an input validation error, which could be exploited by attackers to smuggle requests...

Google Android elevation of privilege vulnerability (CNVD-2022-65634)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability. The vulnerability stems from incorrect programmatic calls to high-level native procedures. An attacker can exploit this vulnerability to gain elevated...

F5 BIG-IP Health Check Configuration Elevation of Privilege Vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. An elevation of privilege vulnerability exists in the F5 BIG-IP health check configuration, which can be exploited by an...

IBM Security Verify Information Queue Information Disclosure Vulnerability (CNVD-2022-54888)

IBM Security Verify Information Queue using the acronym "ISIQ" is a cross-product integrator that uses Kafka technology and a publish/subscribe model to integrate data between IBM Security products. Security Verify Information Queue is vulnerable to information disclosure in version 10.0.2. An...

SAP BusinessObjects Business Intelligence Platform信息泄露漏洞（CNVD-2022-56944）

SAP BusinessObjects Business Intelligence Platform is a complete business analytics platform from SAP Germany. The platform combines market-leading SAP data integration products, data management products, and business intelligence BI products to eliminate system integration challenges and quickly...

Dell BSAFE Crypto-C Micro Edition and Dell BSAFE Micro Edition Suite Input Validation Error Vulnerability

Dell BSAFE Micro Edition Suite is a development kit that provides encryption, certificate and transport layer security for c/c applications, devices, systems, etc. Dell BSAFE is a security software product that supports encryption algorithms, certificate chain validation and transport layer...

Jenkins Request Rename Or Delete Plugin授权问题漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.An authorization issue vulnerability exist...

WordPress WP Ultimate CSV Importer Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A server cross-site request...

WordPress plugin Elementor Website cross-site scripting vulnerability

WordPress is a set of blogging platform developed using PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress plugin Elementor Website 3.5.5 and previous versions have a cross-site scripting vulnerability, which can be exploited by attackers to...

Swftools Null Pointer Dereference Vulnerability (CNVD-2022-62214)

Swftools is a set of utilities for working with Adobe Flash files SWF files. A null pointer dereference vulnerability exists in Swftools 2020-12-22 and earlier versions, which stems from the presence of a NULL pointer dereference in the function main located in swfdump.c. The vulnerability can be...