ZTE MF971R Profile Control Vulnerability

The ZTE MF971R is a Cat 6 LTE mobile Wi-Fi router with download speeds up to 300mbps and upload speeds up to 50mbps.A configuration file control vulnerability exists in the ZTE MF971R. An attacker could exploit the vulnerability to modify the device's configuration parameters, which could result ...

Mozilla Rust Buffer Overflow Vulnerability (CNVD-2021-85299)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. Mozilla Rust is vulnerable to a buffer overflow vulnerability that can be exploited by attackers to cause data contention and memory corruption...

GPAC null pointer dereference vulnerability (CNVD-2021-82976)

GPAC is a multimedia framework for rich media and is distributed under the LGPL license. vwidboxdel function in boxcodebase.c in GPAC 20200801 and earlier versions is vulnerable to null pointer dereference. An attacker could exploit this vulnerability to cause a denial of service...

Mozilla Rust Command Injection Vulnerability (CNVD-2021-78744)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. Mozilla Rust is vulnerable to a command injection vulnerability that could be exploited by attackers to trigger undefined behavior and memory corruption...

Google Chrome Background Fetch API security bypass vulnerability (CNVD-2021-73419)

Google Chrome is a web browser from Google, Inc. A security bypass vulnerability exists in the Google Chrome Background Fetch API. An attacker could exploit this vulnerability to bypass security restrictions...

WeeChat Buffer Overflow Vulnerability (CNVD-2021-70118)

A security vulnerability in WeeChat, an extensible live chat client application, stems from the fact that WeeChat before version 3.2.1 allows remote attackers to trigger, via a crafted WebSocket framework, an out-of-bounds read, resulting in a denial of service crash. No detailed vulnerability...

Rundeck Cross-Site Request Forgery Vulnerability

Rundeck is an open source automation service with a web console, command line tools and WebAPI from Rundeck, Inc. that is primarily used to run automation tasks. a cross-site request forgery vulnerability exists in Rundeck, which stems from the fact that users with access to the "system" resource...

Google TensorFlow Dezero Error Vulnerability (CNVD-2021-64070)

Google TensorFlow is an end-to-end open source machine learning platform. the implementation of tf.rawops.SparseDenseCwiseDiv in versions prior to Google TensorFlow 2.6.0 is vulnerable to a dezero error. No details of the vulnerability are currently available...

Apollos Apps licensing issue vulnerability

Apollos Apps is an open source platform for distributing church-related applications. Apollos Apps suffers from an authorization issue vulnerability that stems from the fact that new user registrations only need to know basic personal information about anyone name, birthday, gender, etc. in order...

Synology DiskStation Manager Path Traversal Vulnerability (CNVD-2021-39156)

Synology DiskStation Manager DSM is an operating system for use on Network Storage Servers NAS from Synology Inc. of Taiwan, China. This operating system manages information such as data, files, photos, music, and more. A path traversal vulnerability exists in the PDF Viewer component of Synology...

Unspecified vulnerability in Genvini dlt-daemon

Genvini Dlt-daemon is a Genvini organization's software for logging and tracing. The software provides a logging and tracing interface using the standardized protocols specified in the AUTOSAR Standard 4.0 DLT, and is used as a logging framework in some programs. A security vulnerability exists i...

Atlassian Jira Server and Data Center has an unspecified vulnerability (CNVD-2021-55941)

Atlassian JIRA Server and Atlassian JIRA Data Center are both products of Atlassian Australia, Atlassian JIRA Server is a server version of the defect tracking management system. Atlassian JIRA Data Center is the data center version of Atlassian JIRA. Atlassian Jira Server and Data Center have a...

TYPO3 Dynamic Content Element SQL注入漏洞

TYPO3 Dynamic Content Element is a mobile application from the Swiss company TYPO3. TYPO3 Dynamic Content Element has a SQL injection vulnerability, which stems from insufficient filtering of user-supplied data and can be exploited by attackers to inject SQL to obtain data-sensitive information...

Terrafrost phpseclib data forgery issue vulnerability

Terrafrost phpseclib is a Terrafrost open source application. pure PHP implementation of the MIT license. A data forgery issue vulnerability exists in Terrafrost phpseclib versions prior to 2.0.31 and 3.x series versions prior to 3.0.7, which stems from incorrectly handling the RSA PKCS.No detail...

Atlassian Jira Server and Data Center has an unspecified vulnerability

Atlassian JIRA Server and Atlassian JIRA Data Center are both products of Atlassian Australia, Atlassian JIRA Server is a server version of a defect tracking management system. Atlassian JIRA Data Center is the data center version of Atlassian JIRA, which is a security vulnerability that could be...

Invigo Automatic Device Management Command Injection Vulnerability

Invigo Automatic Device Management ADM is a native management tool for cellular operators that enables them to detect, maintain and manage millions of devices cost-effectively and with a high degree of reliability. A command injection vulnerability exists in /admin/broadcast.php in Invigo Automat...

Linux kernel resource management error vulnerability (CNVD-2021-17212)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel 5.9.x through 5.11.3, which can be exploited by attackers to cause a driver crash...

MediaArea MediaInfo Buffer Overflow Vulnerability

MediaArea MediaInfo is an application that displays technical information related to video and audio files. A buffer overflow vulnerability exists in the StreamsFillPerStream in the Multiple/FileMpegPs.cpp file in MediaArea MediaInfo version 20.03, which stems from the program failing to properly...

jsrsasign package buffer overflow vulnerability (CNVD-2021-20284)

jsrsasign package is an open source encryption library from the Japanese software developer Kenji Urashima . A security vulnerability exists in jsrsasign package versions prior to 8.0.18 Node.js. An attacker could exploit this vulnerability to cause memory corruption...

Tortoise ORM SQL Injection Vulnerability

Tortoise ORM is an open source object-relational mapper . A SQL injection vulnerability exists in MySQL in Tortoise ORM versions prior to 0.15.23 and prior to 0.16.6. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based applications. An attacker...

rack-cors gem for Ruby directory traversal vulnerability

rack-cors is Rack middleware for handling cross-domain resource sharing CORS. A directory traversal vulnerability in the rack-cors gem for Ruby prior to version 1.0.4, which stems from resource matching failing to ensure that pathnames are in a canonical format, can be exploited by an attacker to...

Alkacon OpenCms Local File Inclusion Vulnerability

Alkacon OpenCms is a set of open source content management system CMS developed using the Java language . A local file inclusion vulnerability exists in Alkacon OpenCms versions 10.5.4 and 10.5.5, which can be exploited by an attacker to access server resources...

WIBU-SYSTEMS WibuKey.sys 0x8200E804 IOCTL Kernel Information Disclosure Vulnerability

Wibu-Systems WibuKey is a digital rights management DRM system from Wibu-Systems. A security vulnerability in WIBU-SYSTEMS WibuKey.sys 0x8200E804 IOCTL handling allows local attackers to exploit the vulnerability by submitting a special request to obtain a kernel memory information disclosure...

AjentiCP Cross-Site Scripting Vulnerability

AjentiCP is a hosting management panel. A cross-site scripting vulnerability exists in AjentiCP 1.2.23.13 and earlier versions. A remote attacker can exploit this vulnerability to execute malicious JavaScript code in a user's browser...

Smarty path traversal vulnerability

New Digital Group Smarty is a template engine written in PHP by New Digital Group. A path traversal vulnerability exists in the 'SmartySecurity::isTrustedResourceDir' function in New Digital Group Smarty versions prior to 3.1.33, which stems from the program's failure to adequately filter templat...

WordPress Plainview Activity Monitor Plugin OS Command Injection Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . Plainview Activity Monitor plugin is used in one of the website user activity monitoring plugin . An operating syst...

XiongMai uc-httpd Buffer Overflow Vulnerability

XiongMai uc-httpd is a HTTP protection program for cameras and other products from XiongMai. A buffer overflow vulnerability exists in version 1.0.0 of XiongMai uc-httpd. An attacker can exploit this vulnerability to cause a denial of service via the Web camera reader interface...

MalwareFox AntiMalware Local Elevation of Privilege Vulnerability

MalwareFox AntiMalware is a suite of malware removal tools from the American company MalwareFox. The tool automatically detects and removes malware, cleans browsers, repairs files corrupted by rootkits and protects against virus infections in real time. A local elevation of privilege vulnerabilit...

Microsoft Internet Explorer and Microsoft Edge Information Disclosure Vulnerability (CNVD-2017-12102)

Microsoft Internet Explorer IE and Microsoft Edge are both web browsers developed by the American company Microsoft. The former is the default browser that came with operating systems before Windows 10, and the latter is the default browser that comes with the latest operating system, Windows 10...

PHPMailer Information Disclosure Vulnerability

PHPMailer is a PHP class library for sending e-mail . A local information disclosure vulnerability exists in PHPMailer versions 5.0.0 through 5.2.22. An attacker can exploit this vulnerability to obtain sensitive information...

Apache Spark Deserialization Vulnerability

Apache Spark is a large-scale data processing engine that supports acyclic data streaming and in-memory computing from the Apache Foundation. Apache Spark suffers from a deserialization vulnerability. The vulnerability stems from the Spark History Web UI's overly lax Jackson deserialization of...

Google Chrome Information Disclosure Vulnerability (CNVD-2026-10645)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from an information disclosure vulnerability, which is caused due to improper implementation in the backend fetch AP. An attacker can exploit the vulnerability to disclose cross-origin data...

GNU libopts Buffer Overflow Vulnerability

GNU libopts is a C language library for parsing command line options from the US GNU community. A buffer overflow vulnerability exists in GNU libopts version 27.6 and earlier, which stems from a boundary error in the function strstrsse2 when processing untrusted input. An attacker could exploit...

Unspecified Vulnerability in WordPress Stop User Enumeration plugin

WordPress Stop User Enumeration plugin is a security plugin for WordPress, mainly used to detect and prevent hackers from scanning website usernames user enumeration attack to get the login name, which is the pre-detection behavior of brute force password cracking attack. A security vulnerability...

Tenda AC6 fromSetRouteStatic function buffer overflow vulnerability

Tenda AC6 is a dual-band wireless router from Tenda. Tenda AC6 suffers from a buffer overflow vulnerability that stems from the list parameter in the fromSetRouteStatic function failing to properly validate the length size of the input data, no detailed vulnerability details are provided at this...

Fortinet FortiPortal Log Message Disclosure Vulnerability

Fortinet FortiPortal is an advanced, feature-rich hosted security analysis and management support tool for Fortinet's FortiGate, FortiWiFi and FortiAP product lines, available as a virtual machine for MSPs. Fortinet FortiPortal suffers from a log information disclosure vulnerability that originat...

Linux kernel bnxt driver code issue vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. The Linux kernel suffers from a code issue vulnerability that stems from the bnxt driver not properly recalculating network device characteristics after XDP is disabled, which...

Fortinet FortiOS Command Execution Vulnerability (CNVD-2024-29330)

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. Fortinet FortiOS suffers from a...

Stack buffer overflow vulnerability in libigl readOFF.cpp function

libigl is libigl open source a simple C++ geometry processing library . A stack buffer overflow vulnerability exists in the libigl readOFF.cpp function. The vulnerability is caused by incorrect boundary checking of the readOFF function. An attacker can exploit this vulnerability to cause a buffer...

Tenda W30E fromRouteStatic function buffer overflow vulnerability

The Tenda W30E is a router from the Chinese company Tenda. A buffer overflow vulnerability exists in Tenda W30E version 1.0.1.25633, which originates from the parameter page of the fromRouteStatic function in /goform/fromRouteStatic that fails to correctly validate the length of the input data, a...

Scholars Tracking System SQL Injection Vulnerability (CNVD-2024-14045)

Scholars Tracking System is a scholars tracking system by the individual developer Fabian Ros. Scholars Tracking System suffers from a SQL injection vulnerability that can be exploited by an attacker to send crafted SQL statements to Eligibility Information Update...

Siemens Sinteso EN and Cerberus PRO EN Fire Protection Systems Out-of-Bounds Read Vulnerability

Cerberus PRO EN is a fire protection system consisting of fire panels, detection and management stations. It is available to Siemens partners and complies with the European standard EN 54 for fire detection and alarm systems. Sinteso EN is a fire protection system consisting of fire panels,...

Code Injection Vulnerability in Citrix NetScaler ADC and NetScaler Gateway

NetScaler ADC is an application delivery controller. NetScaler Gateway is an access gateway with an SSL VPN solution that provides single sign-on and authentication for remote end users of network assets. Both are Citrix products. A code injection vulnerability exists in Citrix NetScaler ADC and...

Command Injection Vulnerability in DIR-822+ V1.0.2 of AUO Electronic Equipment (Shanghai) Co.

DIR-822 is a wireless router from D-Link, a Chinese company. A command injection vulnerability exists in the AUO Electronic Devices Shanghai Co. DIR-822+ version V1.0.2, which stems from the SetStaticRouteSettings function failing to correctly filter constructor command special characters,...

Siemens Spectrum Power 7 Critical Resource Privilege Assignment Error Vulnerability

Spectrum Power 7 provides the essential components of SCADA, communications and data modeling for control and monitoring systems. Application suites can be added to optimize network and generation management in all areas of energy management. Siemens Spectrum Power 7 suffers from a misassigned...

Gila CMS Area Parameter SQL Injection Vulnerability

Gila CMS is an open source content management system CMS based on PHP and MySQL. A SQL injection vulnerability exists in Gila CMS 1.15.4 and earlier versions, which stems from the application's lack of validation of externally entered SQL statements. The vulnerability can be exploited by a remote...

Foxit Reader Arbitrary File Creation Vulnerability

Foxit Reader is a Chinese Foxit Foxit company's a PDF document reader. Foxit Reader suffers from an arbitrary file creation vulnerability, which can be exploited by an attacker to create a file in any location via a specially crafted malicious file, resulting in the execution of arbitrary code...

Microsoft Windows Layer 2 Tunneling Protocol Remote Code Execution Vulnerability (CNVD-2023-81880)

Microsoft Windows is a set of operating systems for use on personal devices from the American company Microsoft. A remote code execution vulnerability exists in the Microsoft Windows Layer 2 Tunneling Protocol, which can be exploited by an attacker to remotely execute code...

Mozilla Firefox ImageBitmap Post-Release Use Vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A post-release use vulnerability exists in Mozilla Firefox ImageBitmap on process shutdown, which can be exploited by a remote attacker to submit a special Web request, tricking the user into parsing i...

Google Chrome Buffer Overflow Vulnerability (CNVD-2023-71680)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a buffer overflow vulnerability that originates from a boundary error when the application handles untrusted input, which can be exploited by an attacker to execute arbitrary code on the system or cause th...