IBM Security Verify Information Queue Information Disclosure Vulnerability (CNVD-2022-54888)

IBM Security Verify Information Queue using the acronym "ISIQ" is a cross-product integrator that uses Kafka technology and a publish/subscribe model to integrate data between IBM Security products. Security Verify Information Queue is vulnerable to information disclosure in version 10.0.2. An...

SAP BusinessObjects Business Intelligence Platform信息泄露漏洞（CNVD-2022-56944）

SAP BusinessObjects Business Intelligence Platform is a complete business analytics platform from SAP Germany. The platform combines market-leading SAP data integration products, data management products, and business intelligence BI products to eliminate system integration challenges and quickly...

Dell BSAFE Crypto-C Micro Edition and Dell BSAFE Micro Edition Suite Input Validation Error Vulnerability

Dell BSAFE Micro Edition Suite is a development kit that provides encryption, certificate and transport layer security for c/c applications, devices, systems, etc. Dell BSAFE is a security software product that supports encryption algorithms, certificate chain validation and transport layer...

Jenkins Request Rename Or Delete Plugin授权问题漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.An authorization issue vulnerability exist...

WordPress WP Ultimate CSV Importer Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A server cross-site request...

WordPress plugin Elementor Website cross-site scripting vulnerability

WordPress is a set of blogging platform developed using PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress plugin Elementor Website 3.5.5 and previous versions have a cross-site scripting vulnerability, which can be exploited by attackers to...

Swftools Null Pointer Dereference Vulnerability (CNVD-2022-62214)

Swftools is a set of utilities for working with Adobe Flash files SWF files. A null pointer dereference vulnerability exists in Swftools 2020-12-22 and earlier versions, which stems from the presence of a NULL pointer dereference in the function main located in swfdump.c. The vulnerability can be...

School Dormitory Management System Cross-Site Scripting Vulnerability

School Dormitory Management System is a school dormitory management system. v1.0 of School Dormitory Management System has a cross-site scripting vulnerability that originates from admin/inc/navigation.php:125 page that lacks a filter for user The vulnerability is caused by a lack of checksum...

npm Devcert Denial of Service Vulnerability

Devcert is a package for SSL development from npm, Inc. A denial of service vulnerability exists in versions prior to Devcert 1.2.1, which stems from triggering an exponential ReDoS regular expression denial of service in the Devcert package. An attacker could exploit this vulnerability to cause ...

Illumina Local Run Manager File Upload Vulnerability

Illumina Local Run Manager is an integrated solution from Illumina, Inc. Designed to create sequencing runs, monitor run status, analyze sequencing data, and view results, Illumina Local Run Manager contains a file upload vulnerability that could be exploited by an attacker to upload any file typ...

OctoPrint webcam stream test cross-site scripting vulnerability

OctoPrint is an application that provides a fast web interface for controlling consumer 3D printers. A cross-site scripting vulnerability exists in versions prior to OctoPrint 1.8.0, which stems from a lack of filtering and escaping of data in the software webcam stream test. An attacker could us...

WBCE CMS Cross-Site Scripting Vulnerability (CNVD-2022-68523)

WBCE CMS is an open source content management system CMS based on PHP and MySQL. version 1.5.2 of WBCE CMS contains a cross-site scripting vulnerability that can be exploited by attackers to conduct cross-site scripting XSS attacks via /admin/users/save.php...

Aruba ClearPass Policy Manager Command Injection Vulnerability (CNVD-2022-64231)

Aruba ClearPass Policy Manager is an application of the U.S. company Aruba to provide wireless network security access management system Aruba ClearPass Policy Manager has a command injection vulnerability, the vulnerability stems from the user input structure to execute the command process, the...

F5 BIG-IP cross-site scripting vulnerability in multiple products

F5 BIG-IP and F5 BIG-IP Guided Configuration GC are both products of F5, Inc. F5 BIG-IP is an application delivery platform that integrates network traffic management, application security management, load balancing, etc. F5 BIG-IP Guided Configuration is a configuration template. cross-site...

Google Android Elevation of Privilege Vulnerability (CNVD-2022-44608)

Google Android is a Linux-based open source operating system from Google, Inc. An elevation of privilege vulnerability exists in Google Android, which originates in NotificationStackScrollLayout.java. NotificationStackScrollLayout has a method to bypass factory reset protection. An attacker could...

Microsoft Windows Hyper-V Shared Virtual Hard Disks信息泄露漏洞（CNVD-2022-62514）

Microsoft Hyper-V is an application from Microsoft Corporation USA. A system hypervisor virtualization technology that enables desktop virtualization. Microsoft Windows Hyper-V Shared Virtual Hard Disks has an information disclosure vulnerability that could be exploited by attackers to obtain...

Siemens SCALANCE W-1700 (11ac) Series Denial of Service Vulnerability (CNVD-2022-28499)

The SCALANCE W-1700 products are IEEE 802.11 compliant wireless communication devices. a denial of service vulnerability exists in the Siemens SCALANCE W-1700 11ac series, which can be exploited by an attacker to cause the entire device to crash for competing conditions...

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CNVD-2022-60120)

Microsoft Edge is a web browser that comes with versions of Windows 10 and later, and an elevation of privilege vulnerability exists in Microsoft Edge Chromium-based. An attacker could exploit this vulnerability to elevate privileges...

IBM Rational ClearCase GIT connector trust management issue vulnerability

IBM Rational ClearCase is a software configuration management solution from IBM Corporation. The solution provides version control, workspace management, parallel development support, and build auditing.A trust management issue vulnerability exists in IBM Rational ClearCase GIT connector version...

IBM Business Automation Workflow and Business Process Manager Information Disclosure Vulnerability

IBM Business Automation Workflow is a suite of workflow automation solutions from IBM USA. The product is mainly used for workflow management, compliance management, and features workflow visibility and scalability. An information disclosure vulnerability exists in IBM Business Automation Workflo...

Jenkins GitLab Authentication Plugin Information Disclosure Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.The Jenkins GitLab Authentication Plugin ...

Samsung AppLock licensing issue vulnerability

Samsung AppLock is an application lock for Samsung mobile devices used to lock applications on Android.An authorization issue vulnerability exists in Samsung AppLock, which stems from a lack of authentication measures or insufficient authentication strength for Unprotected Activity in AppLock. An...

Microsoft Office Visio Remote Code Execution Vulnerability (CNVD-2022-20139)

Microsoft Office is an office software suite of products from Microsoft Corporation USA. Microsoft Office Visio is vulnerable to remote code execution. The vulnerability is due to a boundary error in the processing of EMRCOMMENTEMFPLUS records in EMF images. A remote attacker could exploit this...

Liferay Portal and Liferay DXP Cross-Site Scripting Vulnerability (CNVD-2022-19497)

Liferay Portal and Liferay DXP are both products of Liferay, a J2EE-based portal solution that uses EJB and JMS technologies and serves as a web publishing and shared workspace, enterprise collaboration platform, social network, etc. Liferay DXP is a digital experience collaboration platform...

TOTOLink A800R Command Injection Vulnerability

TOTOLink A800R is a wireless router from TotoLink, China.TOTOLink A800R V4.1.2cu.5137B20200730 is vulnerable to command injection, which can be exploited by attackers to execute arbitrary commands via the QUERYSTRING parameter...

PJSUA API buffer overflow vulnerability

Pjsua Api is an advanced Api for building Sip multimedia user agent applications. a buffer overflow vulnerability exists in the PJSUA API, which can be exploited by attackers to cause a buffer overflow via a controlled buffer parameter...

Jeecg-boot SQL Injection Vulnerability

Jeecg-Boot is a low-code platform based on the code generator from the JeecgBoot community. Jeecg-boot is vulnerable to SQL injection, which stems from a code parameter in /sys/user/queryUserComponentData that was found to be vulnerable to SQL injection. No detailed vulnerability details are...

K-Box Cross-Site Scripting Vulnerability

K-Box is a web-based application used to manage document, image, video and geographic data. A cross-site scripting vulnerability exists in K-Box, which stems from the fact that the editors of the product's user document summaries and markdown file previews do not securely handle special character...

Django Cross-Site Scripting Vulnerability (CNVD-2022-31853)

Django is the Django Foundation's set of open source web application framework based on the Python language. The framework includes an object-oriented mapper, view system, template system, etc. A cross-site scripting vulnerability exists in Django, which stems from the product's % debug %...

Oracle MySQL Cluster Buffer Overflow Vulnerability (CNVD-2022-18211)

MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database designed to guarantee 99.999% availability. A buffer overflow vulnerability exists in Oracle MySQL Cluster, which can be exploited by an attacker to execute code in the context of a service account...

libspf2 buffer overflow vulnerability (CNVD-2022-19089)

libspf2 is a library that allows email systems such as Sendmail, Postfix, Exim, Zmailer, and MS Exchange to check SPF records and ensure that email is authorized from its domain. This prevents email forgery commonly used by spammers, scammers and email viruses/worms. libspf2 suffers from a buffer...

Trend Micro Deep Security Code Injection Vulnerability

Trend Micro Deep Security is a suite of intelligent data protection solutions from Trend Micro. A code injection vulnerability exists in the Trend Micro Deep Security Agent that stems from an input validation error when handling directory traversal sequences. An attacker could use this...

WordPress Crisp Live Chat plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Crisp Live Chat plugin, which stems from a...

OnionShare has an unspecified vulnerability (CNVD-2022-06477)

OnionShare is an open source tool used to securely and anonymously share files, host websites, and chat with friends using the Tor network. Used to securely and anonymously share files, host websites, and chat with friends using the Tor network, a security vulnerability exists in OnionShare that...

Qnap Qvr has an unspecified vulnerability

Qnap Qvr is a Qnap monitoring system control center from China Welllink Technology Qnap, Inc. A security vulnerability exists in several QVR products, stemming from a stack buffer overflow vulnerability that affects QNAP devices running QVR Elite, QVR Pro, and QVR Guard. An attacker could exploit...

Binaryen Stack Buffer Overflow Vulnerability

Binaryen is a compiler infrastructure and toolchain library for WebAssembly written in C++. Binaryen has a stack buffer overflow vulnerability in version 103, which originates when the software printf public function performs an operation in memory, and can be exploited by an attacker to cause...

VMware ESXi Buffer Overflow Vulnerability

Vmware VMware ESXi is a server virtualization platform from Vmware that can be installed directly on physical servers. A buffer overflow vulnerability exists in several Vmware products, which stems from a failure of the product's CD-ROM device emulation feature to properly determine memory...

mruby has an unspecified vulnerability

mruby is a lightweight implementation of the Ruby language. mruby has a security vulnerability that stems from the fact that mruby is vulnerable to a heap-based buffer overflow attack. No details of the vulnerability are currently available...

SAFARI Montage Cross-Site Scripting Vulnerability

SAFARI Montage is a formative assessment tool from safarimontage that enables teachers to check students' understanding of topics or concepts during the course. A cross-site scripting vulnerability exists in SAFARI Montage versions 8.3 and 8.5, which can be exploited by an attacker to execute...

Mozilla Rust has an unspecified vulnerability (CNVD-2022-03129)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation.A security vulnerability exists in versions of Rust crypto2 crate prior to 2021-10-08, which stems from a possible unaligned read of u32 during Chacha20 encryption and decryption. No details of the vulnerability...

ZZCMS SQL Injection Vulnerability (CNVD-2021-101691)

ZZCMS is a content management system CMS from the Zzcms team in China.ZZCMS is vulnerable to SQL injection in 2021, which stems from a lack of validation of external input SQL statements in the askbigclassid parameter of /admin/ask.php in the application. An attacker could use this vulnerability ...

Google Chrome ANGLE security bypass vulnerability

Google Chrome is a web browser from Google, Inc. A security vulnerability exists in Google Chrome that stems from an object lifecycle issue in ANGLE. An attacker could use this vulnerability to bypass security restrictions...

Fortinet FortiWeb Buffer Overflow Vulnerability (CNVD-2021-99680)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning, and other attacks to secure web applications and protect sensitive database content. A buffer overflow vulnerability exists, whi...

Open Design Alliance Drawings SDK Out-of-Bounds Writing Vulnerability (CNVD-2022-01428)

Open Design Alliance Drawings SDK is a software development kit for drawing design applications from Open Design Alliance, Inc. The SDK provides easy, object-oriented API access to data in .dwg and .dgn, C API, file repair support, support for . code execution...

Belledonne Belle-sip Denial of Service Vulnerability

Belledonne Belle-sip is a library from the French company Belledonne that implements the transport, transaction and conversation layers of SIP RFC 3261. security vulnerabilities exist in versions prior to Belledonne Belle sip 5.0.20, which can be exploited by attackers to crash applications such ...

Sourcecodester Engineers Online Portal Access Control Error Vulnerability

Sourcecodester Engineers Online Portal is an open source online portal. niamunozmonitoringsystem/admin/uploads of Sourcecodester Engineers Online Portal in PHP is vulnerable to An access control error vulnerability can be exploited to bypass access control and access all files uploaded to the web...

D-Link DIR-823G Command Injection Vulnerability (CNVD-2021-85889)

D-Link DIR-823G is an AC1200M dual-band gigabit wireless router.A command injection vulnerability exists in the HNAP1 protocol in D-Link DIR-823G version 1.0.2B05. An attacker can execute arbitrary Web scripts using shell meta characters in the Captcha field of the login section...

Apache Traffic Server Heap Buffer Overflow Vulnerability

Apache Traffic Server, referred to as ATS or TS, is a high-performance, modular HTTP proxy and caching server. stats-over-http plugin in Apache Traffic Server version 9.1.0 is vulnerable to a heap buffer overflow. An attacker could exploit this vulnerability to overwrite memory...

Unspecified Vulnerability in Fortinet FortiPortal

Fortinet FortiPortal is an advanced, feature-rich hosted security analysis and management support tool for Fortinet's FortiGate, FortiWiFi and FortiAP product lines, available as a virtual machine for MSPs. A security vulnerability in the customer database interface of Fortinet FortiPortal prior ...

WordPress Html5 Audio Player plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the erection of personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress Html5 Audio Player plugin in versions...