Siemens Solid Edge Stack Buffer Overflow Vulnerability

Siemens Solid Edge is a 3D CAD software from Siemens, a German company. The software can be used for part design, assembly design, sheet metal design, welding design, etc. Siemens Solid Edge is vulnerable to a stack buffer overflow vulnerability, which can be exploited by attackers to execute cod...

Dell BIOS Buffer Overflow Vulnerability (CNVD-2023-14511)

A buffer overflow vulnerability exists in Dell BIOS, which is embedded software on a small memory chip on a computer motherboard from Dell, U.S.A. The vulnerability stems from a boundary error when handling untrusted input. A locally authenticated attacker could exploit the vulnerability to execu...

Siretta QUARTZ-GOLD OS Command Injection Vulnerability (CNVD-2023-17079)

Siretta QUARTZ-GOLD is a high-speed dual-port Gigabit Ethernet industrial router from Siretta.The Siretta QUARTZ-GOLD is vulnerable to an operating system command injection vulnerability, which can be exploited by attackers to cause the execution of arbitrary commands by sending specially crafted...

Apache Superset Access Control Error Vulnerability (CNVD-2023-05217)

An access control error vulnerability exists in Apache Superset, a data visualization and data exploration platform from the Apache Foundation, which stems from improper access controls and could be exploited by an unauthenticated attacker to access dashboard configuration metadata using the REST...

Google Chrome Information Disclosure Vulnerability (CNVD-2023-12025)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from an information disclosure vulnerability that stems from insufficient enforcement of CORS policies, which can be exploited by remote attackers to disclose cross-domain data via a crafted HTML page...

Apache Atlas path traversal vulnerability

Apache Atlas is a scalable and extensible set of core functional governance services from the Apache Foundation.Apache Atlas versions 0.8.4 through 2.2.0 have a path traversal vulnerability that stems from improper input validation in the import module, which could be exploited by an authenticate...

Siemens Teamcenter Visualization and JT2Go Out-of-Bounds Read Vulnerability

Siemens Teamcenter Visualization is a team collaboration software for designing 2D and 3D scenes. Siemens JT2GO is a JT file viewer. Siemens Teamcenter Visualization and JT2Go are vulnerable to an out-of-bounds read vulnerability that can be exploited by attackers to execute code in the context o...

Chocolatey Cmder has an unspecified vulnerability

Chocolatey Cmder is a package open sourced by Chocolatey. Chocolatey Cmder v1.3.20 and earlier versions contain a security vulnerability. An attacker could gain write access to the path C:\tools\Cmder and all files located in that folder for all users in the Authenticated Users group...

Backdrop CMS Comment Cross-Site Scripting Vulnerability

Backdrop CMS is an open source content management system CMS. A cross-site scripting vulnerability exists in Backdrop CMS Comment version 1.23.0, which can be exploited by attackers to launch cross-site scripting XSS attacks due to a lack of effective filtering and escaping of user-supplied data...

Google TensorFlow has an unspecified vulnerability (CNVD-2022-81227)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A security vulnerability exists in Google TensorFlow, which stems from a reference kernel for the CONV3DTRANSPOSE TensorFlow Lite operator that incorrectly adds dataptr when adding bias to results...

Aruba Networks ArubaOS Buffer Overflow Vulnerability (CNVD-2022-75544)

Aruba Networks ArubaOS, an operating system for Aruba Mobility-Defined Networks including mobile controllers and mobile access switches from Aruba Networks, is vulnerable to a buffer overflow vulnerability. An attacker could exploit this vulnerability to cause unauthenticated remote code executio...

Oracle Supply Chain Information Disclosure Vulnerability (CNVD-2023-11168)

Oracle Supply Chain Products Suite is a set of supply chain solutions from Oracle Oracle. The product provides value chain planning, value chain execution, product lifecycle management and other functions. An information disclosure vulnerability exists in Oracle Transportation Management versions...

Google Chrome Media Memory Misreference Vulnerability

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in versions of Google Chrome prior to 106.0.5249.62, which stems from a mix-up in instructions responsible for freeing memory in Media. An attacker could exploit the vulnerability potential...

Apache Airflow Information Disclosure Vulnerability (CNVD-2022-73695)

Apache Airflow is an open source platform for creating, managing and monitoring workflows from the Apache Foundation. The platform features scalable and dynamic monitoring. Apache Airflow versions 2.3.0 to 2.3.4 contain an information disclosure vulnerability that could be exploited by attackers ...

Siemens Teamcenter Command Injection Vulnerability

Teamcenter software is a modern, adaptable product lifecycle management PLM system that connects people and processes across functional silos through digital threads to enable innovation.Siemens Teamcenter is vulnerable to a command injection vulnerability that could be exploited by attackers to...

Jenkins Google Login authorization issue vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project. jenkins Plugin is an application. jenkins Google Login has an authorizati...

WordPress Note Press plugin SQL injection vulnerability (CNVD-2022-64665)

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. FormCraft is one of the form creation plugins used in it. WordPress plugin is an application plugin. WordPress Note Press plugin 0.1.10 and earlier...

GLPI SQL Injection Vulnerability (CNVD-2022-68953)

GLPI is an IT and asset management software. The software provides a full-featured IT resource management interface that can be used to create a database to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridges and ink cartridges, etc. A SQL...

Rescue Dispatch Management System SQL注入漏洞（CNVD-2022-53910）

Rescue Dispatch Management System is a rescue dispatch management system from Carlo Montero's personal developer. rescue dispatch management system v1.0 is vulnerable to SQL injection, which originates from /rdms/admin/ respondenttypes/managerespondenttype.php?id=The page lacks validation for...

Embedthis Software Appweb Community Edition Denial of Service Vulnerability

Embedthis Software Appweb is a web server for embedded applications from Embedthis Software, Inc. A denial of service vulnerability exists in Embedthis Software Appweb Community Edition version 8.2.1, which originates in src/ http/http/httpLib.c, an attacker can use this vulnerability to crash th...

Afian Filerun SQL Injection Vulnerability (CNVD-2022-68943)

Afian FileRun is a full-featured web-based file manager. sql injection vulnerability exists in Afian Filerun version 20220202, which stems from a lack of cleanup of the POST parameter metadata in the /?module=fileman§ion=get&page=grid page. An attacker could exploit this vulnerability to cause SQ...

Illumina Local Run Manager File Upload Vulnerability

Illumina Local Run Manager is an integrated solution from Illumina, Inc. Designed to create sequencing runs, monitor run status, analyze sequencing data, and view results, Illumina Local Run Manager contains a file upload vulnerability that could be exploited by an attacker to upload any file typ...

Totolink A3600R Buffer Overflow Vulnerability

TotoLink A3600R is a 6-antenna 1200M wireless router from TotoLink, Taiwan, China.A buffer overflow vulnerability exists in version V4.1.2cu.5182B20201102 of the Totolink A3600R, which stems from a vulnerability in the fread function of infostat.cgi that contains stacker overflow, which can be...

WordPress RSVPMaker plugin SQL injection vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. RSVPMaker is an event scheduling and RSVP tracking plugin used in WordPress RSVPMaker plugin 9.2.5 and earlier versions are vulnerable to SQL injection, which stems from a lack of SQL escaping and...

WordPress UpdraftPlus WordPress Backup plugin跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. WordPress plugin is a WordPress open source application plugin. WordPress UpdraftPlus WordPress Backup plugin...

Maccms Cross-Site Scripting Vulnerability (CNVD-2022-30794)

Maccms is a PHP-based film and television content management system CMS. v10 version of Maccms contains a cross-site scripting vulnerability, which originates from the lack of user-supplied data and output data validation filtering in the select and input parameters in...

Jenkins Extended Choice Parameter Plugin任意文件读取漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.Jenkins Extended Choice Parameter Plugin...

Nextcloud server denial of service vulnerability (CNVD-2022-20690)

Nextcloud is an open source, self-hosted file synchronization and sharing communication application platform from Nextcloud Germany. nextcloud server has a denial of service vulnerability that stems from a networked system or product that does not properly validate data boundaries when performing...

libxml2 Resource Management Error Vulnerability (CNVD-2022-21487)

libxml2 is an open source library for parsing XML documents. It is written in C and can be called by multiple languages, such as C, C, XSH. libxml2 suffers from a resource management error vulnerability that can be exploited by attackers to threaten alerts that affect software or systems...

Siemens Simcenter Femap Buffer Overflow Vulnerability

Simcenter Femap is an advanced simulation application for creating, editing, and inspecting finite element models of complex products or systems.Siemens Simcenter Femap buffer overflow vulnerability can be exploited by attackers to execute code in the context of the current process...

Unspecified vulnerability exists in mruby (CNVD-2022-12747)

mruby is a lightweight implementation of the Ruby language. mruby 3.2 previously had a security vulnerability that stemmed from the use of out-of-range pointer offsets. No detailed vulnerability details are currently available...

snapd input validation error vulnerability

Snapd is an open source, cross-platform package management tool. snapd is vulnerable to an input validation error that could be exploited to allow snap to escape strict snap restrictions by injecting arbitrary AppArmor policy rules through misformatted content interfaces and layout statements...

Google TensorFlow Input Validation Error Vulnerability (CNVD-2022-14991)

TensorFlow is an end-to-end open source platform for machine learning from Google. Google TensorFlow is vulnerable to an input validation error that could be exploited by an attacker to crash the system...

Jenkins SWAMP Plugin Access Control Error Vulnerability

Jenkins plug-ins are plug-ins that provide functionality for Jenkins. The Jenkins SWAMP Plugin Access Control Error vulnerability can be exploited by an attacker to connect to the attacker's specified web server using the attacker's specified credentials...

Xwiki Platform path traversal vulnerability

Xwiki Platform is a set of French Xwiki company's Wiki platform for creating Web collaboration applications. XWiki Platform has a path traversal vulnerability, the vulnerability stems from the application fails to properly filter special elements in the resource or file path, an attacker can use...

WordPress Visual CSS Style Editor plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed by the WordPress Foundation using the PHP language. WordPress Visual CSS Style Editor plugin in versions prior to 7.5.4 has a cross-site scripting vulnerability that stems from not cleaning up and escaping the wyppagetype parameter. An attacker...

Tensorflow Input Validation Error Vulnerability (CNVD-2022-11209)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. An input validation error vulnerability exists in Tensorflow, which stems from the fact that the er component of TensorFlow is prone to integer overflow when estimating the cost of crop and resize, whic...

Reolink Rlc-410W Denial of Service Vulnerability (CNVD-2022-12647)

Reolink Rlc-410W is a Wifi security camera from Reolink China.A security vulnerability exists in Reolink RLC-410W, which can be exploited by attackers to cause a denial of service...

Apache ShardingSphere Information Disclosure Vulnerability

Apache ShardingSphere is an open source distributed database middleware solution from the Apache Foundation.Apache ShardingSphere ElasticJob-UI is vulnerable to an information disclosure vulnerability that stems from the exposure of sensitive information to unauthorized participants, which could ...

Google Android Code Execution Vulnerability (CNVD-2022-06898)

Google Android is a Linux-based open source operating system from Google, Inc. A security vulnerability exists in Google Android, which stems from a configuration error in the network system or product during operation. An attacker could exploit the vulnerability to cause a local privilege...

Google Android out-of-bounds write vulnerability (CNVD-2022-06897)

Google Android is a Linux-based open source operating system from Google, Inc. A security vulnerability exists in Google Android that could be exploited by attackers to remotely elevate privileges without additional executive privileges...

Expat has an unspecified vulnerability

Expat is a fast streaming XML parser written in C. A security vulnerability exists in Expat, which stems from the fact that in Expat aka libexpat prior to 2.4.3, the storeAtts function in xmlparse.c shifted left by 29 or more bits may cause realloc misbehavior e.g., allocating too few bytes too...

Avast Antivirus Access Control Error Vulnerability

Avast antivirus is a suite of antivirus software from the Czech company Avast.Avast Antivirus has an access control error vulnerability in versions prior to 20.4, which can be exploited by attackers to abuse the privilege to control the scan results and thus escape detection or delete arbitrary...

Blackmagic Design DaVinci Resolve Buffer Overflow Vulnerability

Blackmagic Design DaVinci Resolve is an all-in-one software tool for editing, color correction, visual effects, motion graphics and audio post-production.Blackmagic Design DaVinci Resolve 17.3.1.0005 is vulnerable to a buffer overflow vulnerability that could be exploited by attackers to execute...

Atomix has an unspecified vulnerability (CNVD-2021-101702)

Atomix is a fault-tolerant distributed orchestration framework for JAVA 8. An unspecified vulnerability exists in Atomix version 3.1.5. The vulnerability allows an unauthorized Atomix node to join the target cluster by providing configuration information. No detailed vulnerability details are...

Microsoft Defender for IoT Remote Code Execution Vulnerability (CNVD-2022-04003)

Microsoft Defender for IoT is an asset discovery, vulnerability management, and threat monitoring solution for IoT/OT environments.Microsoft Defender for IoT suffers from a remote code execution vulnerability. An attacker could exploit this vulnerability to execute code on the target host...

Anchor Cross-Site Scripting Vulnerability (CNVD-2021-103514)

Anchor is an open source lightweight blogging system. Anchor is vulnerable to a cross-site scripting vulnerability that could be exploited by attackers to upload headers and content containing malicious code via the post bar...

Delicious Brains Advanced Custom Fields Information Disclosure Vulnerability

Delicious Brains Advanced Custom Fields is an advanced custom fields plugin from Delicious Brains Canada.An information disclosure vulnerability exists in Delicious Brains Advanced Custom Fields, which stems from a lack of authorization related to obtaining user lists. The vulnerability stems fro...

Zephyr has an unspecified vulnerability (CNVD-2021-95617)

Zephyr is an open source, small, scalable, real-time operating system. a security vulnerability exists in Zephyr, which stems from the ZephyrJSON decoder incorrectly decoding arrays. No details of the vulnerability are currently available...

Apache Ozone input validation error vulnerability

Apache Ozone is an application. A scalable, redundant and distributed object store for Hadoop and cloud-native environments, an input validation error vulnerability exists in Apache Ozone, which stems from the product's Ozone Datanode not checking the block token's access mode parameter. An...