Huawei HarmonyOS HW_KEYMASTER module input validation error vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a microkernel-based, fully distributed operating system. Huawei HarmonyOS version 2.0 is vulnerable to an input validation error that stems from a lack of checksum on read content in the HWKEYMASTER module. An attacker could...

Dapr Dashboard Access Control Error Vulnerability

Dapr Dashboard is a web-based user interface for Dapr that allows users to view information, view logs of running Dapr applications, components, configurations, etc. Dapr Dashboard 0.1.0 and later, 0.10.0 and earlier versions have an access control error vulnerability that stems from the existenc...

WordPress WP Socializer Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. Quiz And Survey Master plugin is an online survey plugin used in it. WordPress plugin is an application plugin. cross-site scripting vulnerability exist...

Linux kernel resource management error vulnerability (CNVD-2022-69187)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A resource management error vulnerability exists in Linux kernel version 5.19.12 and earlier versions, which stems from the presence of a memory reuse after release issue that...

Google Chrome Resource Management Error Vulnerability (CNVD-2022-81238)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a Resource Management Error vulnerability that stems from a post-release reuse in the Browser Tag. An attacker could exploit this vulnerability to cause the browser to crash...

Rocket.Chat actionLinkHandler Information Disclosure Vulnerability

Rocket.Chat is an open source team chat software. Rocket.Chat suffers from an information disclosure vulnerability that stems from the actionLinkHandler method allowing message ID enumeration using a Regex MongoDB query. An attacker can exploit the vulnerability to obtain sensitive information...

Apache Avro Denial of Service Vulnerability

Apache Avro is a data serialization system from the Apache Foundation, Inc. A denial of service vulnerability exists in versions of Apache Avro Rust prior to 0.14.0, which stems from an integer overflow when reading corrupted .avro files in the Avro Rust SDK, and can be exploited by an attacker t...

Google Android Denial of Service Vulnerability (CNVD-2022-65635)

Google Android is a Linux-based open source operating system from Google. A denial of service vulnerability exists in Google Android, which can be exploited by an attacker to cause a denial of service due to failure to properly handle incoming error messages...

FeehiCMS arbitrary file upload vulnerability

FeehiCMS is a Php-based CMS builder from Liufee Personal Developers.FeehiCMS version v2.1.1 is vulnerable to arbitrary file uploads. The vulnerability stems from the lack of valid validation of uploaded files by the application. An attacker can exploit the vulnerability to execute arbitrary code ...

IBM QRadar SIEM Licensing Issue Vulnerability (CNVD-2022-83585)

IBM QRadar SIEM is a solution from IBM America that leverages security intelligence to protect assets and information from advanced threats. The solution provides monitoring of the entire scope of the IT architecture, generates detailed reports on data access and user activity, etc. IBM QRadar SI...

SAP NetWeaver Portal Cross-Site Scripting Vulnerability (CNVD-2022-56965)

SAP NetWeaver Portal is a component of SAP NetWeaver architecture from SAP Germany. A cross-site scripting vulnerability exists in SAP NetWeaver Portal versions 7.30, 7.31, 7.40, and 7.50, which stems from a failure to adequately validate user-controlled input, and which can be exploited by an...

Jenkins XPath Configuration Viewer存在未明漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. Jenkins Plugin is an application that provides hundreds of plug-ins to support building, deploying, and automating any project. Jenkins XPath Configuration Viewer has a security vulnerability that stems...

WordPress Shortcodes and extra features for Phlox plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The WordPress plugin is an application plugin. WordPress Shortcodes and extra features for Phlox plugin versions prior to 2.9.8 contain a...

Jenkins Google Login authorization issue vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project. jenkins Plugin is an application. jenkins Google Login has an authorizati...

Multiple MediaTek Chip Modem 2G RRs suffer from out-of-bounds write vulnerability

MediaTek Inc. is the world's fourth largest fab-based semiconductor company and a leader in the markets of mobile terminals, smart home applications, wireless connectivity and Internet of Things IoT products, with approximately 1.5 billion units of end products with built-in MediaTek chips hittin...

Tenda M3 formSetAccessCodeInfo function stack overflow vulnerability

Tenda M3 is an access controller from Tenda, China. Tenda M3 V1.0.0.12 is vulnerable to a stack overflow vulnerability, which stems from the formSetAccessCodeInfo function info parameter not checking the length of the input data. An attacker could exploit this vulnerability to cause a denial of...

Jenkins Recipe Plugin XML External Entity Injection Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project. jenkins Plugin is an application software. jenkins Recipe Plugin version 1...

Jenkins Plugin requests-plugin授权问题漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project. jenkins Plugin is an application. jenkins Plugin requests-plugin version...

Jenkins Filesystem List Parameter Plugin Cross-Site Scripting Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. Jenkins Plugin is an application that provides hundreds of plug-ins to support building, deploying, and automating any project. Jenkins Filesystem List Parameter Plugin version 0.0.7 and earlier versions...

InvenTree File Upload Vulnerability

InvenTree is an open source inventory management system from InvenTree Open Source. Provides powerful low-level inventory control and parts tracking . A file upload vulnerability exists in InvenTree versions prior to 0.7.2, which stems from the application's lack of effective validation of upload...

BigBlueButton licensing issue vulnerability

BigBlueButton is an open source Web conferencing system from the BigBlueButton community. bigBlueButton has an authorization issue vulnerability that stems from the application's lack of required permission checks, which could be exploited by an attacker to bypass access restrictions in order to...

Authentication Bypass Vulnerability in Multiple VMware Products

VMware vRealize Automation is a management tool that provides self-service, supervisory multi-cloud automation.VMware Workspace One Access is a centralized management console through which you can manage users and groups, set and manage authentication and access policies, and add resources to the...

epub2txt2 denial of service vulnerability

epub2txt is a simple command-line utility for extracting text from an EPUB document and optionally rearranging it to fit a specific number of columns of text to be displayed. epub2txt2 version v2.04 is vulnerable to a denial-of-service vulnerability stemming from an integer overflow error in the...

Erudika Para Cross-Site Scripting Vulnerability

Erudika Para is a command-line interface from the Bulgarian company Erudika. cross-site scripting vulnerability exists in versions prior to Erudika Para v1.45.11, which stems from a function in Utils.java that lacks filtering and escaping for user data. An attacker could use this vulnerability to...

Unspecified vulnerability exists in moodle (CNVD-2022-54952)

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. a security vulnerability exists in Moodle, which stems from the description user field failing to hide when set to hidden. No details o...

WordPress WPQA plugin access control error vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plug-in. An access control error vulnerability exists in versions of WordPress WPQA plugin prior to 5.2, whic...

Asus DSL-N14U-B1 Denial of Service Vulnerability

The ASUS DSL-N14U-B1 is a router device from Asus China. A denial of service vulnerability exists in the Asus DSL-N14U-B1 version 1.1.2.3805. The vulnerability stems from a failure to properly handle incoming error messages and can be exploited by a remote attacker to cause a denial of service Do...

Microsoft Visual Studio Code Remote Code Execution Vulnerability (CNVD-2022-60132)

Microsoft Visual Studio Code is an open source code editor from Microsoft USA. A remote code execution vulnerability exists in Microsoft Visual Studio Code, which arises from a failure of a networked system or product to properly filter specific elements of externally entered data during the...

WordPress Multiple Shipping Address Woocommerce plugin SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. The vulnerability stems from a failure to validate, clean up, and escape various user inputs before using...

Rancher Labs Rancher Information Disclosure Vulnerability

Rancher Labs Rancher is an open source, enterprise-class container management platform from Rancher Labs, U.S. Rancher Labs Rancher is vulnerable to an information disclosure vulnerability that stems from exposing repository credentials to an external third-party source, which could be exploited ...

WordPress AdRotate plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. Cross-site scripting vulnerabilities exist in versions of WordPress AdRotate plugin prior to 5.8.23, which st...

OWASP ESAPI Cross-Site Scripting Vulnerability

OWASP ESAPI is a free, open source, web application security control library that makes it easier for programmers to write lower-risk applications. cross-site scripting vulnerabilities exist in versions of OWASP ESAPI prior to 2.3.0.0, which originate from the " onsiteURL" regular expression erro...

Command Execution Vulnerability in Atlassian Bitbucket Data Center

Atlassian Bitbucket Data Center is the data center version of Atlassian Bitbucket by Atlassian Australia. Atlassian Bitbucket Data Center suffers from a command execution vulnerability that can be exploited by an attacker to execute arbitrary code via Java deserialization...

Mattermost Resource Management Error Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. A resource management error vulnerability exists in Mattermost 6.4.1 and earlier versions, which stems from an image proxy component that allocates memory for multiple copies of a proxy image and can be exploited by an...

Pascom Cloud Phone System Server Request Forgery Vulnerability

Pascom Cloud Phone System is a cloud-based phone system from Pascom. A server request forgery vulnerability exists in Pascom Cloud Phone System, which stems from the product's failure to properly validate user input and could be exploited by attackers to probe server intranet resources...

Google Android Buffer Overflow Vulnerability (CNVD-2022-47675)

Google Android is a Linux-based open source operating system from Google, Inc. Google Android suffers from a buffer overflow vulnerability, which can be exploited by attackers to cause local privilege escalation...

Atom CMS SQL Injection Vulnerability

Atom CMS is a content management system. A SQL injection vulnerability exists in Atom CMS version 2.0, which stems from a missing validation of external input SQL statements in the id parameter of /admin/ajax/avatar.php. An attacker could use this vulnerability to execute illegal SQL commands to...

phpLiteAdmin Cross-Site Scripting Vulnerability (CNVD-2022-21815)

phpLiteAdmin is a web-based SQLite database management tool. phpLiteAdmin versions prior to 1.9.8.2 are vulnerable to cross-site scripting. The vulnerability stems from a newRows parameter in index.php that lacks a data validation filter for user-supplied data and output. An attacker could use th...

SuiteCRM Deserialization Vulnerability

SuiteCRM is a customer relationship management system from the SuiteCRM team. SuiteCRM suffers from a deserialization vulnerability that stems from insecure deserialization of serialized data received by the application from users, which can be exploited by attackers to execute arbitrary code via...

Apache Spark Encryption Problem Vulnerability (CNVD-2022-21823)

Apache Spark is a multilingual engine for performing data engineering, data science, and machine learning on a single-node machine or cluster. Apache Spark is vulnerable to an encryption issue that stems from the program's use of a custom mutual authentication protocol that allows fully encrypted...

Nextcloud Talk Input Validation Error Vulnerability

Nextcloud Talk, a self-hosted local audio/video and chat communication service from Nextcloud Germany, is vulnerable to a user redirection vulnerability in versions prior to 12.1.2. The vulnerability stems from the system's failure to reasonably handle target jumps, which could be exploited to...

Subrion CMS Cross-Site Scripting Vulnerability (CNVD-2022-20164)

Subrion CMS is a PHP-based content management system CMS from the Subrion team. The system can be integrated into websites and supports multiple extension plugins, etc. A security vulnerability exists in Subrion CMS 4.2.1, which can be exploited by attackers via the q parameter in the Kickstart...

Google Tensorflow Denial of Service Vulnerability (CNVD-2022-13928)

TensorFlow is an end-to-end open source machine learning platform. It has a comprehensive and flexible ecosystem of tools, libraries, and community resources that help researchers push the boundaries of advanced machine learning techniques and enable developers to easily build and deploy...

Jenkins Chef Sinatra Plugin Cross-Site Request Forgery Vulnerability

The Jenkins Plugin is a plug-in that provides functionality for Jenkins. The Jenkins Chef Sinatra Plugin Cross-Site Request Forgery vulnerability allows an attacker to send an HTTP request from Jenkins to a URL that can be controlled using this vulnerability...

Foxit PDF Reader pdf Buffer Overflow Vulnerability

Foxit PDF Reader is a PDF reader. Foxit PDF Reader has a security vulnerability that can be exploited by remote attackers to submit a special file request, which induces the user to parse it and can crash the application or execute arbitrary code in the application context...

Ricon Mobile Ricon Industrial Cellular Router S9922L and S9922XL OS Command Injection Vulnerability

Ricon Mobile Ricon Industrial Cellular Router S9922L and S9922XL are both 4G/4.5G, WiFi and Vpn technology based mobile network routers from Ricon Mobile Canada.Ricon Mobile Ricon Industrial Cellular Router S9922L and S9922XL are vulnerable to OS command injection, which can be exploited by...

Siemens Simcenter Femap Stack Buffer Overflow Vulnerability (CNVD-2022-10011)

Siemens Simcenter Femap is a cutting-edge engineering simulation application from Siemens, Germany. Siemens Simcenter Femap is vulnerable to a stack buffer overflow when parsing NEU files, which could be exploited to execute code in the context of the current process...

McAfee Agent Command Injection Vulnerability

The McAfee McAfee Agent MA is a set of client components from McAfee, Inc. that provides secure communications between ePolicy Orchestrator the antivirus management platform and managed products. A security vulnerability exists in the McAfee Agent that originates from allowing a local user to...

Checkmk Cross-Site Scripting Vulnerability (CNVD-2022-21235)

Checkmk is an editor. A security vulnerability exists in Checkmk, which can be exploited by remote, authenticated attackers to inject arbitrary JavaScript into view headers via the javascript: URL...

Discourse Information Disclosure Vulnerability (CNVD-2022-05504)

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features.Discourse is vulnerable to an information disclosure vulnerability that could be exploited by attackers to obtain private configuration files...