131391 matches found
S/MIME Information Disclosure Vulnerability
S/MIME is a certificate implementation for email encryption. A security vulnerability exists in S/MIME. An attacker could exploit the vulnerability to obtain a message in plaintext form from an encrypted message...
Apache HTTP Server Denial of Service Vulnerability (CNVD-2018-06535)
Apache HTTP Server is the United States Apache Apache Software Foundation, an open source web server. The server is fast, reliable and can be expanded through a simple API. A security vulnerability exists in Apache HTTP Server that stems from the program's failure to properly destroy HTTP/2...
AsusWRT router/httpd/httpd.c file access bypass vulnerability
ASUS AsusWRT is a set of router operating systems from ASUS. A security vulnerability exists in the 'handlerequest' function of the router/httpd/httpd.c file in versions prior to ASUS AsusWRT 3.0.0.4.38410007. An attacker can exploit this vulnerability to execute a POST request...
Opentext Documentum Content Server File Download Vulnerability
OpenText Documentum Content Server formerly known as EMC Documentum Content Server is a content management service system from OpenText Canada. The system is mainly used to manage the Documentum content repository, you can create, modify and track documents and other operations. A file download...
FileRun Remote SQL Injection Vulnerability
FileRun File Manager gives you access to your files anytime, anywhere with self-hosted secure cloud storage, file backups and sharing of photos, videos, documents and more. FileRun suffers from a remote SQL injection vulnerability that originates from the program's failure to validate the metafie...
Siemens SIMATIC HMI Denial of Service Vulnerability
SIMATIC HMI is an industrial device from Siemens, Germany.SIMATIC HMI panels are used for operator control and monitoring of machines and equipment. A denial of service vulnerability in the Siemens SIMATIC HMI Multi-Panel and HMI Mobile Panels, as well as in the S7-300/S7-400 devices, allows an...
WordPress Mail Masta plugin SQL injection vulnerability (CNVD-2017-02399)
WordPress is the WordPress Software Foundation's set of blogging platform using the PHP language development, the platform supports in PHP and MySQL servers to set up a personal blog site.Mail Masta Plugin is one of the mail plugin. The Mail Masta Plugin for WordPress suffers from a SQL injection...
Apache HTTP Server suffers from httpoxy remote proxy infection vulnerability
Apache HTTP Server is the United States Apache Apache Software Foundation, an open source web server. The server is fast, reliable and can be expanded through a simple API. httpoxy is a set of vulnerabilities that affect application code running in a CGI environment. The vulnerabilities exist...
Gajim Message Interception Vulnerability
Gajim is a suite of free instant messaging software based on the Jabber communication protocol developed by the Gajim project. A security vulnerability exists in versions of Gajim prior to 0.16.5, which can be exploited by remote attackers to modify the roster and intercept messages with the help...
Samba OS Command Injection Vulnerability
Samba is Samba open source a standard Windows interoperability program suite for Linux and Unix. Samba suffers from an operating system command injection vulnerability that stems from a lack of proper validation or escaping of NetBIOS names in front-end WINS hook processing, which could lead to...
HDF5 Buffer Overflow Vulnerability (CNVD-2025-16249)
HDF5 is a data management suite developed by The HDF Group for storing and managing large-scale scientific data. A security vulnerability exists in the H5Omtimenewencode function in the src/H5Omtime.c file of HDF5 version 1.14.6, which stems from improper handling of data boundaries. An attacker...
Mattermost Authorization Issues Vulnerability
Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an authorization issue vulnerability that stems from improper privilege validation, which can be exploited by an attacker to make unauthorized changes to the system administrato...
Dell ECS Buffer Overflow Vulnerability
Dell ECS Elastic Cloud Storage is an enterprise-class cloud-scale object storage platform from Dell Technologies. A buffer overflow vulnerability exists in Dell ECS. The vulnerability is due to an arithmetic overflow in the ECS's retention period processing. An attacker could exploit the...
Microsoft Office Remote Code Execution Vulnerability (CNVD-2024-10429)
Microsoft Office is a suite of office software based on the Windows operating system developed by Microsoft. A remote code execution vulnerability exists in Microsoft Office, which can be exploited by an attacker to execute arbitrary code on a system...
Siemens JT2Go and Teamcenter Visualization null pointer dereference vulnerability (CNVD-2024-01392)
JT2Go is a JT file viewer.Teamcenter Visualization is a software that provides teamwork capabilities for designing 2D and 3D scenarios. A null pointer dereference vulnerability exists in Siemens JT2Go and Teamcenter Visualization, which can be exploited by an attacker to cause the application to...
Apache OFBiz Server-Side Request Forgery Vulnerability
Apache OFBiz is the United States Apache Apache Foundation of a set of enterprise resource planning ERP system. The system provides a set of Java-based Web application components and tools. Apache OFBiz suffers from a server-side request forgery vulnerability that can be exploited by an attacker ...
Apache Airflow Log Information Disclosure Vulnerability
Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow has a log information leakage vulnerability , the vulnerability stem...
Mozilla Firefox Memory Misreference Vulnerability (CNVD-2023-75343)
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. The Mozilla Firefox memory misreference vulnerability can be exploited by a remote attacker to submit a special Web request that induces the user to parse it, which can crash the application...
Microsoft SharePoint Server Elevation of Privilege Vulnerability (CNVD-2023-72193)
Microsoft SharePoint Server is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. An elevation o...
GNU Binutils Denial of Service Vulnerability
GNU Binutils is a set of open source tools for working with binaries such as target files, executables, libraries, etc., mainly used in the areas of compilation, debugging, reverse engineering and so on. A denial of service vulnerability exists in GNU Binutils. An attacker can exploit this...
Microsoft Exchange Server Remote Code Execution Vulnerability (CNVD-2023-64865)
Microsoft Exchange Server is the United States Microsoft Microsoft company's set of e-mail service program. It provides e-mail access, storage, forwarding, voice mail, e-mail filtering and screening. A remote code execution vulnerability exists in Microsoft Exchange Server, which can be exploited...
Google Android Framework elevation of privilege vulnerability (CNVD-2024-13746)
Google Android is a Linux-based open source operating system from Google. An elevation of privilege vulnerability exists in Google Android Framework, which can be exploited by an attacker to gain elevated privileges on the system due to an error in a framework component...
Huawei HarmonyOS and EMUI Information Disclosure Vulnerability (CNVD-2023-61744)
Huawei HarmonyOS is an operating system from Huawei, a Chinese company. It provides a full-scenario distributed operating system based on a microkernel.Huawei EMUI is a user interface developed by Huawei based on the Android operating system. Huawei HarmonyOS and EMUI have an information disclosu...
Mattermost Resource Management Error Vulnerability (CNVD-2023-55044)
Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a resource management error vulnerability that stems from an inability to unescape Markdown strings, which can be exploited by an attacker to cause a denial of service by sendin...
Adobe Experience Manager cross-site scripting vulnerability (CNVD-2023-100302)
Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Audobee Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...
Siemens SICAM A8000 Devices CPCI85 Firmware Command Injection Vulnerability
The SICAM A8000 RTUs Remote Terminal Units series is a modular device family for remote control and automation applications in all areas of energy supply. A command injection vulnerability exists in the Siemens SICAM A8000 Devices CPCI85 Firmware, which can be exploited by an attacker to execute...
NETGEAR SRX5308 Cross-Site Scripting Vulnerability
The NETGEAR SRX5308 is a VPN firewall appliance from NETGEAR. The NETGEAR SRX5308 suffers from a cross-site scripting vulnerability that originates from an incorrect operation of the parameter sysLogInfo.serverName, which can be exploited by an attacker to obtain sensitive information such as use...
SAP Application Interface Framework Cross-Site Scripting Vulnerability
SAP Application Interface Framework SAP AIF is a German SAP SAP company's application program interface framework. A security vulnerability exists in the SAP Application Interface Framework that stems from the application allowing the use of HTML markup, which can be exploited by an attacker to...
Apache InLong Deserialization Vulnerability (CNVD-2023-25936)
Apache InLong is the U.S. Apache Apache Foundation's one-stop massive data integration framework. Provides automated, secure and reliable data transfer capabilities. A deserialization vulnerability exists in Apache InLong versions 1.1.0 to 1.5.0. The vulnerability stems from unsafe deserializatio...
answer Access Control Error Vulnerability
answer is an open source knowledge-based community software. An access control error vulnerability exists in versions of answer prior to 1.0.6 that stems from insufficient session expiration. An attacker could exploit the vulnerability by using a token to gain unauthorized access to an applicatio...
Tenda AX3 Command Injection Vulnerability (CNVD-2023-21670)
The Tenda Ax3 is an Ax1800 Gigabit Port Dual Band Wifi 6 Wireless Router from Tenda China. Tenda AX3 V16.03.12.11 suffers from a command injection vulnerability that stems from the lanip parameter of /goform/AdvSetLanip failing to correctly filter constructed command special characters, commands,...
LS ELECTRIC XBC-DN32U Access Control Error Vulnerability
LS ELECTRIC XBC-DN32U is a PLC programmable logic controller from LS ELECTRIC Korea. LS ELECTRIC XBC-DN32U version 01.80 is vulnerable to an access control error, which could be exploited to remotely set the function to lock out the user from reading data from the device...
Siretta QUARTZ-GOLD buffer overflow vulnerability (CNVD-2023-17030)
The Siretta QUARTZ-GOLD is a high-speed industrial router from Siretta. A buffer overflow vulnerability exists in Siretta QUARTZ-GOLD version G5.0.1.5-210720-141020, which can be exploited by an attacker to execute arbitrary commands...
Apache InLong Deserialization Vulnerability (CNVD-2023-25934)
Apache InLong is the United States Apache Apache Foundation's one-stop massive data integration framework. Apache InLong suffers from a deserialization vulnerability that can be exploited by a remote attacker to submit a special request and execute arbitrary code in the application context...
Oracle VM VirtualBox has an unspecified vulnerability (CNVD-2023-05476)
A security vulnerability exists in Oracle VM VirtualBox, a virtual machine management software from Oracle Corporation. An unauthenticated attacker can use this vulnerability to compromise Oracle VM VirtualBox by accessing the network via multiple protocols...
phpMyFAQ cross-site scripting vulnerability (CNVD-2023-04313)
phpMyFAQ is a multi-language, fully database-driven FAQ system. A cross-site scripting vulnerability exists in versions prior to phpMyFAQ 3.1.10, which stems from the presence of stored cross-site scripting XSS. No details of the vulnerability are provided at this time...
Microsoft Office Remote Code Execution Vulnerability (CNVD-2023-18288)
Microsoft Office is a suite of office software based on the Windows operating system developed by Microsoft. A remote code execution vulnerability exists in Microsoft Office. An attacker could exploit this vulnerability to execute code on the target host...
TRENDnet TEW-755AP stack overflow vulnerability (CNVD-2023-18939)
The TRENDnet TEW-755AP is a router from TRENDnet. A stack overflow vulnerability exists in TRENDnet TEW-755AP version 1.13B01, which stems from a lack of size checking of input data in the comeo.comeo.nslookuptarget parameter of the toolsnslookup function, which can be exploited by an attacker to...
OpenImageIO Information Disclosure Vulnerability
OpenImageIO is an image read/write library, along with a number of tools and applications. OpenImageIO suffers from an information disclosure vulnerability that is caused by a flaw in the IFFOutput channel interleaving function. An attacker can exploit this vulnerability to obtain sensitive...
Siemens SCALANCE X-200RNA Switch Devices Uncontrolled Resource Consumption Vulnerability (CNVD-2022-87967)
The SCALANCE X-204RNA Industrial Ethernet Access Point enables non-PRP end devices to connect to separate parallel networks where required. An uncontrolled resource consumption vulnerability exists in Siemens SCALANCE X-200RNA Switch Devices, which can be exploited by an attacker to cause a denia...
Siemens Simcenter STAR-CCM Privilege Elevation Vulnerability
Siemens Simcenter STAR-CCM is a complete multi-physics field solution from Siemens Germany that simulates products and designs working under real-world conditions. a security vulnerability exists in Siemens Simcenter STAR-CCM, which stems from improperly assigning file permissions to installation...
Unspecified Vulnerability in Google Chrome (CNVD-2022-86348)
Google Chrome is a web browser from Google, an American company. A security vulnerability exists in Goole Chrome versions prior to 108.0.5359.71 for use after the release of Mojo, which can be exploited by attackers to launch an attack via a constructed HTML page using heap corruption...
Permission Design Vulnerability in Chocolatey Ruby
Chocolatey is a NuGet-based package manager developed for Windows systems.Ruby is a cross-platform, object-oriented, dynamically-typed programming language developed by the individual developer Yukihiro Matsumoto. A privilege design vulnerability exists in the Chocolatey Ruby package v3.1.2.1 and...
Digital Alert Systems DASDEC EAS Cross-Site Scripting Vulnerability
Digital Alert Systems DASDEC EAS is a digital alert system from Digital Alert Systems in the United States. A cross-site scripting vulnerability exists in all current versions of Digital Alert Systems DASDEC, which stems from a lack of effective filtering and escaping of user-supplied data on an...
Amasty Blog Create Post Function Cross-Site Scripting Vulnerability
Amasty Blog is a website page extension for Amasty, Inc. A cross-site scripting vulnerability exists in the Amasty Blog Pro 2.10.3 and 2.10.4 plug-ins, which can be exploited by attackers to inject cross-site code and launch XSS attacks...
Moodle Policy Tool Cross-Site Scripting Vulnerability
Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A cross-site scripting vulnerability exists in Moodle versions 3.9.0 and later, 3.9.18 and earlier, 3.11.0 and later, 3.11.11 and...
IBM CICS TX Encryption Issue Vulnerability
IBM CICS TX is a comprehensive, single transaction runtime package from International Business Machines IBM. IBM CICS TX version 11.1 is vulnerable to an encryption issue that stems from the use of a weaker-than-expected encryption algorithm, which could be exploited by an attacker to decrypt...
Huawei HarmonyOS Elevation of Privilege Vulnerability (CNVD-2022-78140)
Huawei HarmonyOS is an operating system from Huawei China. Huawei HarmonyOS is vulnerable to an elevation of privilege vulnerability caused by a serialization/deserialization mismatch in the AMS module. An attacker could exploit this vulnerability to elevate privileges...
Web-Based Student Clearance System File Upload Vulnerability
Web-Based Student Clearance System is a web-based student clearance system from the personal developer Ndueso Okorie. v1.0 of Web-Based Student Clearance System is vulnerable to a file upload vulnerability that originates from a method in the edit-photo.php file in the Photo Handler component tha...
mojoPortal directory traversal vulnerability
mojoPortal is an open source, object-oriented web architecture WSF and content management system CMS from Joe Audette, an individual developer in the United States. The system provides event calendars, photo albums, file managers, etc. mojoPortal v2.7 version of the path traversal vulnerability,...