GitLab Access Control Error Vulnerability (CNVD-2021-91178)

GitLab is a self-hosted, Git version control system project repository application developed in Ruby on Rails by GitLab, Inc. The application can be used to access a project's file content, commit history, bug list, etc. An access control error vulnerability exists in GitLab CE/EE, which can be...

Google Chrome WebView improperly implemented vulnerability (CNVD-2021-84807)

Chrome is a web browsing tool developed by Google. versions prior to Google Chrome 95.0.4638.54 are vulnerable to a WebView misimplementation. An attacker could exploit this vulnerability to leak cross-domain data through a crafted application...

Xiuno BBS Cross-Site Scripting Vulnerability (CNVD-2021-85272)

Xiuno BBS is an open source forum program based on PHP and MySQL. Xiuno BBS suffers from a cross-site scripting vulnerability that stems from the product's installinstall.sql component failing to properly validate user input data. An attacker can execute arbitrary web script and HTML by modifying...

ZEIT Next.js Cross-Site Scripting Vulnerability

ZEIT Next.js is an open source web application framework from ZEIT based on Vue.js, Node.js, Webpack and Babel.js. Next.js versions 10.0.0 to 11.0.0 have a cross-site scripting vulnerability that can be exploited by attackers to execute arbitrary js commands...

fig2dev stack buffer overflow vulnerability (CNVD-2021-68461)

fig2dev is used to convert .fig files to various graphics languages and formats. A stack buffer overflow vulnerability exists in the genpstrxtext component of genpstricks.c in fig2dev version 3.2.7b. An attacker could exploit this vulnerability to cause a denial of service by converting xfig file...

Adobe Character Animator Memory Out-of-Bounds Access Vulnerability

Adobe Character Animator is a motion capture and animation tool that provides everyone with an easy-to-use solution for intuitive 2D character animation, real-time animation, and easy sharing and publishing of characters. A memory out-of-bounds access vulnerability exists in Adobe Character...

Google TensorFlow code issue vulnerability (CNVD-2021-48859)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A code issue vulnerability exists in Google TensorFlow 2.4.2, 2.3.3, 2.2.3, 2.1.4, which can be exploited by an attacker to cause dereferencing of null pointers...

Securepoint SSL VPN Client Access Control Error Vulnerability

Securepoint SSL VPN Client is an open source SSL VPN client for Windows. An access control error vulnerability exists in Securepoint SSL VPN Client v2, which arises from a failure to secure the software's configuration features. An attacker can escalate local privileges to NT AUTHORITYSYSTEM to...

osTicket Cross-Site Scripting Vulnerability

osTicket is a widely used and trusted open source work order support ticket system. A cross-site scripting vulnerability exists in osTicket versions prior to 1.12.6. An attacker can exploit this vulnerability via the queue-name parameter in include/class.queue.php...

Moodle Command Execution Vulnerability

Moodle is a learning platform designed to provide educators, administrators, and learners with a system for creating personalized learning environments. A command execution vulnerability exists in an older version of the Spell Checker plugin that is included by default in Moodle version 3.10. An...

Google TensorFlow tf.raw_ops.RFFT Denial of Service Vulnerability

Google TensorFlow is an end-to-end open source machine learning platform. A denial of service vulnerability exists in Google TensorFlow tf.rawops.RFFT. An attacker can exploit this vulnerability to cause a CHECK-failure denial of service...

Industrial Light and Magic OpenEXR has a buffer overflow vulnerability (CNVD-2022-19855)

OpenEXR is an image file format from Industrial Light and Magic for high dynamic range HDR images. Industrial Light and Magic OpenEXR is vulnerable to a buffer overflow vulnerability that could be exploited by an attacker to execute arbitrary code with the user running an application compiled for...

Google TensorFlow suffers from an unspecified vulnerability (CNVD-2021-36361)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow suffers from an unspecified vulnerability that stems from passing invalid parameters to tf.rawops.SparseCountSparseOutput.No details of the vulnerability are provided at this...

Tenda G1 and G3 OS Command Injection Vulnerability

Tenda G1 and G3 is a router from Tenda, China. Tenda G1 and G3 is vulnerable to OS command injection, which can be exploited to execute arbitrary OS commands via a crafted "action umountUSBPartition" request. operating system commands via a crafted "action umountUSBPartition" request...

Unspecified Vulnerability in Fortinet fortiweb

American Fita Fortinet was founded in October 2000, is committed to chip design, network communication speed, security and defense. A security vulnerability exists in Fortinet fortiweb, which can be exploited by an attacker to read the password used by the FortiWeb scanner to access devices defin...

Unspecified vulnerability in Npm chrono-node

Npm chrono-node is an application from Npm USA. Used to handle most date/time formats and extract information from any given text. A security vulnerability exists in Chrono-node prior to version 2.2.4, which stems from the program hanging on date-like strings with a large number of embedded space...

Clam AntiVirus Infinite Loop Vulnerability

Clam AntiVirus ClamAV is an anti-virus package for use on UNIX-like systems. Mainly used in mail servers, using multi-threaded background operation, you can automatically upgrade the virus database. An infinite loop vulnerability exists in the Excel XLM macro analysis module in Clam AntiVirus...

Mozilla Firefox Denial of Service Vulnerability (CNVD-2021-27926)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from a security vulnerability, and no details of the vulnerability are provided at this time...

Siemens Solid Edge Out-of-Bounds Read Vulnerability

Siemens Solid Edge is a 3D CAD software from Siemens, Germany. The software can be used for part design, assembly design, sheet metal design, welding design and other industries. An out-of-bounds read vulnerability exists in Siemens Solid Edge. The vulnerability is due to a lack of proper...

SaltStack Salt Command Injection Vulnerability (CNVD-2021-15056)

SaltStack Salt is a new way to manage infrastructure, easy to deploy, up and running in minutes, scales well, easily manages tens of thousands of servers, and is fast enough to communicate between servers in seconds. SaltStack Salt A command injection vulnerability exists in the restart check for...

Unspecified Vulnerability in Rust (CNVD-2021-13697)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in Rust. The vulnerability stems from the dereference of a program's raw pointer. No details of the vulnerability are available at this time...

Rust Resource Management Error Vulnerability (CNVD-2021-17269)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A resource management error vulnerability exists in Rust fil-ocl crate through 2021-01-04, which stems from From leading to double free.No details of the vulnerability are available at this time...

Revive Adserver Input Validation Error Vulnerability (CNVD-2021-23389)

Revive Adserver is an open source advertising management system from the Revive Adserver team. The system provides ad placement, ad space management, data statistics and other functions. An input validation error vulnerability exists in Revive Adserver versions prior to 5.1.0, which stems from an...

Unspecified Vulnerability in Rust (CNVD-2021-39164)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in miow crate for Rust prior to version 0.3.6, which stems from an incorrect expectation of the std::net::SocketAddr memory representation. No details of the vulnerability are...

Unspecified vulnerability in Mozilla Rust flatbuffers crate

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in flatbuffers crate in versions of Mozilla Rust prior to 2020-04-11, no details of the vulnerability are provided at this time...

Moodle Cross-Site Scripting Vulnerability (CNVD-2021-28738)

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A security vulnerability exists in Moodle that could allow JavaScript to be included in the title of a book chapter without being...

Microsoft Windows and Windows Server Information Disclosure Vulnerability (CNVD-2021-71945)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, an operating system for personal devices, and Microsoft Windows Server is a server operating system. Microsoft Windows and Windows Server are vulnerable to an information disclosure vulnerability that stems...

Apache Airflow RBAC Admin Page Cross-Site Scripting Vulnerability

Apache Airflow is the United States Apache Apache Software Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A cross-site scripting vulnerability exists in the RBAC Admin page in Apac...

WordPress Cross-Site Scripting Vulnerability (CNVD-2021-24378)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress, which stems from the lack of proper validation of...

Ruby on Rails Cross-Site Request Forgery Vulnerability (CNVD-2020-34299)

Ruby on Rails is a set of Rails team based on the Ruby language open source Web application framework. A cross-site request forgery vulnerability exists in Ruby on Rails 6.0.3 and earlier versions. The vulnerability stems from a web application that does not adequately validate that a request is...

Ruby on Rails Cross-Site Request Forgery Vulnerability (CNVD-2020-32423)

Ruby on Rails is a set of Rails team based on the Ruby language open source Web application framework. A cross-site request forgery vulnerability exists in Ruby on Rails versions prior to 5.2.5 and 6.0.4, which stems from a WEB application that does not adequately validate that a request is comin...

ThemeREX Addons Remote Code Execution Vulnerability

WordPress plugin ThemeREX Addons is a plugin that works with various ThemeREX themes, featuring several theme enhancements and widgets that extend the functionality of the theme in question. A remote code execution vulnerability exists in versions of ThemeREX Addons prior to 2020-03-09. The...

Giting Command Execution Vulnerability

Giting is a Git version control system server. A security vulnerability exists in Giting versions prior to 0.0.8, which is caused by the program executing the 'repo' parameter of the 'pull' function without performing arbitrary validation. The vulnerability can be exploited to execute arbitrary...

Alkacon OpenCms Local File Inclusion Vulnerability

Alkacon OpenCms is a set of open source content management system CMS developed using the Java language . A local file inclusion vulnerability exists in Alkacon OpenCms versions 10.5.4 and 10.5.5, which can be exploited by an attacker to access server resources...

Fortinet FortiOS Buffer Overflow Vulnerability

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. A buffer overflow vulnerability...

Nagios Core null pointer dereference vulnerability (CNVD-2018-17098)

Nagios Core is an open source system and network monitoring application. A null pointer dereference vulnerability exists in qhecho in Nagios Core 4.4.1 and earlier. An attacker can exploit this vulnerability by sending a specially crafted payload to a listening UNIX socket to cause a local denial...

Joomla! PrayerCenter SQL Injection Vulnerability

Joomla! is an open source content management system CMS developed by the Open Source Matters team in the U.S. The system provides RSS feeds, site search, etc. PrayerCenter is used in one of the prayer sharing components. A SQL injection vulnerability exists in Joomla! PrayerCenter version 3.0.2. ...

PHPMailer Information Disclosure Vulnerability

PHPMailer is a PHP class library for sending e-mail . A local information disclosure vulnerability exists in PHPMailer versions 5.0.0 through 5.2.22. An attacker can exploit this vulnerability to obtain sensitive information...

ProFTPd (mod_copy) Remote Command Execution Vulnerability

ProFTPD is ProFTPD team of a set of open source FTP server software . The software is highly configurable , secure , stable and so on. A remote command execution vulnerability exists in ProFTPd. An attacker can exploit the vulnerability to execute arbitrary code in the context of an affected...

OpenClaw has an unspecified vulnerability (CNVD-2026-19618)

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from a security vulnerability that stems from the derivation of a loopback MCP owner context from a server-issued bearer token that can be spoofed in the request header, which can be exploited by an attacke...

TOTOLINK A702R /boafrm/formParentControl File Buffer Overflow Vulnerability

TOTOLINK A702R is a wireless router device manufactured by China's Gion Electronics TOTOLINK, mainly used for home network connection and signal coverage. The TOTOLINK A702R suffers from a buffer overflow vulnerability, which originates from the failure of the parameter submit-url in the file...

RT-Thread Input Validation Error Vulnerability (CNVD-2025-16524)

RT-Thread is an open source IoT real-time operating system RTOS open-sourced by RT-Thread. RT-Thread suffers from an input validation error vulnerability that originates from the operation of the parameter how in the file rt-thread/components/lwp/lwpsyscall.c, which can be exploited by an attacke...

IBM InfoSphere Information Server and IBM InfoSphere DataStage Flow Designer Unspecified Vulnerability (CNVD-2025-05561)

IBM InfoSphere Information Server and IBM InfoSphere DataStage Flow Designer are both products of International Business Machines IBM.IBM InfoSphere Information Server is a data integration platform. The platform can be used to integrate data information obtained from various sources.IBM InfoSphe...

Tenda AC6 Buffer Overflow Vulnerability (CNVD-2025-09222)

Tenda AC6 is a dual-band wireless router from China's Tenda Tenda in 2016. Tenda AC6 suffers from a buffer overflow vulnerability, which originates from some unknown features of /goform/WifiExtraSet, and can be exploited by an attacker to execute arbitrary code by manipulating the parameter...

YesWiki cross-site scripting vulnerability (CNVD-2025-03330)

YesWiki is a wiki system written in PHP by the French organization YesWiki. It is used to create and manage websites in a collaborative way. A cross-site scripting vulnerability exists in YesWiki 4.4.5 and earlier versions, which stems from improper input validation when the attach component...

Siemens Solid Edge V2024 Integer Underflow Vulnerability

Solid Edge is a portfolio of software tools to address a variety of product development processes: 3D design, simulation, manufacturing and design management. Siemens Solid Edge V2024 suffers from an integer underflow vulnerability that can be exploited by an attacker to execute code in the conte...

Apache Ozone Authentication Error Vulnerability

Apache Ozone is an application of the US Apache Apache Foundation. A scalable, redundant and distributed object store for Hadoop and cloud-native environments. Apache Ozone version 1.4.0 suffers from an authentication error vulnerability that originates from an authentication error in an HTTP...

Microsoft Visual Studio Remote Code Execution Vulnerability (CNVD-2024-28701)

Microsoft Visual Studio is a family of development tool suites from Microsoft, and a largely complete development toolset that includes most of the tools needed throughout the software life cycle. A remote code execution vulnerability exists in Microsoft Visual Studio, which can be exploited by a...

Apache Commons Configuration Out-of-Bounds Write Vulnerability

Apache Commons Configuration is the United States Apache Apache Foundation , a common configuration interface , it is mainly used to enable Java applications to read configuration data from a variety of sources . An out-of-bounds write vulnerability exists in Apache Commons Configuration versions...

Unspecified Vulnerability in Oracle MySQL (CNVD-2024-11119)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. A security vulnerability exists in Oracle MySQL for MySQL Server version 8.0.35 and earlier, version 8.2.0 and earlier, which can be exploited by an...