Apache Syncope Information Disclosure Vulnerability

Apache Syncope is the United States Apache Apache Software Foundation's set of open source digital identity management system for use in enterprise environments. The system supports identity management, role configuration and more. A security vulnerability exists in Apache Syncope versions 1.2.x...

MalwareFox AntiMalware Local Elevation of Privilege Vulnerability

MalwareFox AntiMalware is a suite of malware removal tools from the American company MalwareFox. The tool automatically detects and removes malware, cleans browsers, repairs files corrupted by rootkits and protects against virus infections in real time. A local elevation of privilege vulnerabilit...

libgit2 Buffer Overflow Vulnerability

libgit2 is a portable, C implementation of the Git core development package . A buffer overflow vulnerability exists in the smartpkt.c file in libgit2. An attacker could exploit this vulnerability to execute arbitrary code in the context of an affected application, resulting in a denial of servic...

GNU Guile Remote Code Execution Vulnerability

GNU Guile is a set of programming languages developed by the GNU Project for creating flexible applications. A security vulnerability exists in GNU Guile that could be exploited by a remote attacker to execute arbitrary code with application privileges...

libgit2 Denial of Service Vulnerability

libgit2 is a portable, pure C implementation of the Git development package , as a reentrant link library with a solid API , libgit2 allows you to use any language to write Git applications . A denial of service vulnerability exists in libgit2. An attacker can exploit this vulnerability to crash...

ISPConfig 'monitor/show_sys_state.php' SQL Injection Vulnerability

ISPConfig is a set of Linux-based open source hosting control panel, it can be used through the Web control panel to manage multiple servers, open a Web site, monitor server operating conditions and so on. The ISPConfig monitor/showsysstate.php script handles the 'server' parameter with a SQL...

Apache Spark Deserialization Vulnerability

Apache Spark is a large-scale data processing engine that supports acyclic data streaming and in-memory computing from the Apache Foundation. Apache Spark suffers from a deserialization vulnerability. The vulnerability stems from the Spark History Web UI's overly lax Jackson deserialization of...

Delta Electronics CNCSoft-G2 Buffer Overflow Vulnerability (CNVD-2024-40829)

Delta Electronics CNCSoft-G2 is a human-machine interface HMI software from Delta Electronics, China. The Delta Electronics CNCSoft-G2 suffers from a buffer overflow vulnerability that can be exploited by an attacker to execute code in the context of the current process...

Siemens Sinteso EN and Cerberus PRO EN Fire Protection Systems Out-of-Bounds Read Vulnerability

Cerberus PRO EN is a fire protection system consisting of fire panels, detection and management stations. It is available to Siemens partners and complies with the European standard EN 54 for fire detection and alarm systems. Sinteso EN is a fire protection system consisting of fire panels,...

Apache Superset Cross-Site Scripting Vulnerability (CNVD-2024-06442)

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. A cross-site scripting vulnerability exists in Apache Superset versions prior to 3.0.3, which stems from the application's lack of effective filtering and escaping of user-supplied data, and can ...

Google Chrome Security Bypass Vulnerability (CNVD-2024-10261)

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome version 121.0.6167.85 and earlier versions, which stems from an incorrect security user interface in the Payments module. An attacker can exploit this vulnerability to bypass...

Siemens Solid Edge Uninitialized Pointer Access Vulnerability (CNVD-2024-01400)

Solid Edge is a portfolio of software tools that address a variety of product development processes: 3D design, simulation, manufacturing and design management. An uninitialized pointer access vulnerability exists in Siemens Solid Edge, which can be exploited by an attacker to execute code in the...

Siemens Spectrum Power 7 Critical Resource Privilege Assignment Error Vulnerability

Spectrum Power 7 provides the essential components of SCADA, communications and data modeling for control and monitoring systems. Application suites can be added to optimize network and generation management in all areas of energy management. Siemens Spectrum Power 7 suffers from a misassigned...

Foxit Reader Arbitrary File Creation Vulnerability

Foxit Reader is a Chinese Foxit Foxit company's a PDF document reader. Foxit Reader suffers from an arbitrary file creation vulnerability, which can be exploited by an attacker to create a file in any location via a specially crafted malicious file, resulting in the execution of arbitrary code...

Cisco Wireless LAN Controller Buffer Overflow Vulnerability

Cisco Wireless LAN Controller WLC is a wireless LAN controller product from Cisco USA. The product provides security policy, intrusion detection and other functions in the wireless LAN. A security vulnerability exists in the Cisco Wireless LAN Controller that originates from a hole in the memory...

Microsoft Excel Information Disclosure Vulnerability (CNVD-2023-80153)

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. An information disclosure vulnerability exists in Microsoft Excel, which can be exploited by attackers to obtain sensitive information...

Mozilla Firefox Information Disclosure Vulnerability (CNVD-2023-68481)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security bypass vulnerability exists in Mozilla Firefox, which can be exploited by attackers to bypass network security checks...

Google Chrome Extensions Component Memory Misreference Vulnerability

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in the Google Chrome Extensions component, which can be exploited by an attacker to execute arbitrary code on a system or cause an application to crash...

Apache InLong Code Execution Vulnerability

Apache InLong is the United States Apache Apache Foundation's one-stop massive data integration framework. A code execution vulnerability exists in Apache InLong versions 1.4.0 through 1.6.0, which can be exploited by an attacker to execute arbitrary code on a system...

Cisco Identity Services Engine Input Validation Error Vulnerability

Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. An input validation error vulnerability exists ...

Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability (CNVD-2023-35214)

Microsoft PostScript Printer Driver is a Microsoft standard printer driver for PostScript printers from Microsoft.Microsoft PCL6 Class Printer Driver is a printer driver from Microsoft. Microsoft PCL6 Class Printer Driver is a printer driver software from Microsoft. An information disclosure...

Delta Electronics InfraSuite Device Master Deserialization Vulnerability (CNVD-2023-23883)

Delta Electronics InfraSuite Device Master is a device for simplifying and automating the monitoring of critical equipment from Delta Electronics of Taiwan, China. A deserialization vulnerability exists in Delta Electronics InfraSuite Device Master versions prior to 1.0.5, which can be exploited ...

Google Android elevation of privilege vulnerability (CNVD-2023-12020)

Google Android is a Linux-based open source operating system from Google. An elevation of privilege vulnerability exists in the enforceVisualVoicemailPackage of PhoneInterfaceManager.java in Google Android version 13.0, which stems from a privilege bypass issue. An attacker can exploit the...

Metabase Information Disclosure Vulnerability (CNVD-2023-06473)

Metabase is an open source data analytics platform from Metabase Inc. Metabase is vulnerable to an information disclosure vulnerability that stems from exposing sensitive information to an unauthorized user. No details of the vulnerability are currently available...

Nextcloud Resource Management Error Vulnerability (CNVD-2023-04308)

Nextcloud is an open source, self-hosted file synchronization and sharing communication application platform from Nextcloud Germany. nextcloud Deck is vulnerable to a resource management error, which stems from a database error that can be generated when executed multiple times, leading to a DoS...

Microsoft Office Remote Code Execution Vulnerability (CNVD-2023-18287)

Microsoft Office is a suite of office software based on the Windows operating system developed by Microsoft. A remote code execution vulnerability exists in Microsoft Office. An attacker could exploit this vulnerability to execute code on the target host...

Mozilla Firefox Information Disclosure Vulnerability (CNVD-2023-06856)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from an information disclosure vulnerability that stems from the fact that the performance API does not properly hide whether a redirect is noted for requesting a cross-domain...

Google Chrome Security Special Issue Vulnerability

Google Chrome is a web browser from Google, an American company. A vulnerability exists in Google Chrome prior to version 91.0.4472.77 due to a security specialization issue that stems from insufficient enforcement of content security policies. An attacker could exploit this vulnerability to bypa...

OpenImageIO Out-of-Bounds Write Vulnerability

OpenImageIO is an image read/write library, along with a number of tools and applications. OpenImageIO suffers from an out-of-bounds write vulnerability, which is caused by an out-of-bounds write flaw in the OpenImageIO::addexixitemtospec function. An attacker could use this vulnerability to...

APsystems Access Control Error Vulnerability

APsystems is a microinverter from APsystems, Inc. Combining high efficiency power conversion with a user-friendly monitoring interface, it brings you reliable and smart energy. An access control error vulnerability exists in APsystems ENERGY COMMUNICATION UNIT ECU-C Power Control Software version...

Telos Alliance Omnia MPX Node Insecure Direct Object Reference Vulnerability

The Telos Alliance Omnia MPX Node is a specialized hardware codec from Telos Alliance, USA. Capable of transmitting or receiving full FM signals at data rates as low as 320 kbps using the Omnia μMPXTM algorithm, it is ideally suited for capacity-limited networks, including IP radios. An insecure...

Apache MINA Deserialization Vulnerability

Apache MINA is the United States Apache Apache Foundation of a web application framework. The product is mainly used to develop high-performance and highly scalable web applications. Apache MINA 2.9.1 and earlier versions suffer from a deserialization vulnerability that stems from the use of Java...

Cisco Firepower Management Center Cross-Site Scripting Vulnerability (CNVD-2023-28092)

Cisco Firepower Management Center FMC is a new generation of firewall management center software from the United States Cisco Cisco. A cross-site scripting vulnerability exists in Cisco Firepower Management Center, which can be exploited by attackers to execute arbitrary script code in the contex...

Bento4 AP4_BitReader::SkipBits function denial of service vulnerability

Bento4 is an open source C library for reading and writing MP4 files. Bento4 v1.6.0-639 contains a denial of service vulnerability that stems from a boundary error in the AP4BitReader::SkipBitsunsigned int function in mp42ts when handling untrusted input. An attacker could exploit the vulnerabili...

OpenCATS Cross-Site Scripting Vulnerability (CNVD-2022-70589)

OpenCats is an open source recruitment process management system. A security vulnerability exists in OpenCats version v0.9.6, which stems from the fact that an attacker can utilize its callback component to implement reflective cross-site scripting. No detailed vulnerability details are available...

Adobe Illustrator Input Validation Error Vulnerability (CNVD-2023-07319)

Adobe Illustrator is a vector-based image creation software from Adobe. Adobe Illustrator is vulnerable to an input validation error, which can be exploited to execute arbitrary code in the context of the current user...

Microsoft Windows CryptoAPI has an unspecified vulnerability

Microsoft Windows CryptoAPI is a cryptographic compiler added to the Windows operating system by Microsoft Corporation. As an important foundation for data encryption and decryption functions, CryptoAPI supports synchronous and asynchronous key encryption processing, as well as the management of...

SAP 3D Visual Enterprise Author Buffer Overflow Vulnerability (CNVD-2022-69693)

SAP 3D Visual Enterprise Author is a desktop application from SAP Germany for managing 2D, 3D, animation, video and audio assets. SAP 3D Visual Enterprise Author suffers from a buffer overflow vulnerability, which stems from a lack of proper memory management and can be exploited by an attacker t...

Dapr Dashboard Access Control Error Vulnerability

Dapr Dashboard is a web-based user interface for Dapr that allows users to view information, view logs of running Dapr applications, components, configurations, etc. Dapr Dashboard 0.1.0 and later, 0.10.0 and earlier versions have an access control error vulnerability that stems from the existenc...

Huawei HarmonyOS Storage Vectors Out-of-Bounds Read Vulnerability

Huawei HarmonyOS is an operating system from Huawei, a Chinese company that provides a microkernel-based distributed operating system. An out-of-bounds read vulnerability exists in Huawei HarmonyOS, which stems from an out-of-bounds array read in the storage dimension module. An attacker could...

MyBB Command Injection Vulnerability

MyBB MyBulletinBoard is a free and web-based forum software developed by MYBB team using PHP and MySQL. The software is easy to use, supports multiple languages, and is extensible.MyBB is vulnerable to a command injection vulnerability that originates from the additional parameter Mail Settings ?...

Rockwell Automation Factory Talk VantagePoint SQL Injection Vulnerability

Rockwell Automation Factory Talk VantagePoint is an advanced industrial application ecosystem from Rockwell Automation, Inc. The SQL injection vulnerability in Rockwell Automation Factory Talk VantagePoint stems from a failure to properly validate SQL statements entered by users when retrieving...

Aruba Networks ArubaOS and InstantOS Cross-Site Scripting Vulnerability

Aruba Networks ArubaOS is Aruba Networks' operating system for Aruba Mobility-Defined Networks, including Mobility Controllers and Mobility Access Switches. A cross-site scripting vulnerability exists in Aruba Networks ArubaOS and InstantOS. The vulnerability stems from a lack of effective...

Adobe InCopy out-of-bounds read vulnerability (CNVD-2023-05233)

Adobe InCopy is an application produced by Adobe for professional word processing. Adobe InCopy 17.3 and 16.4.2 and prior versions contain an out-of-bounds read vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the current user...

Google Android Security Bypass Vulnerability (CNVD-2022-89769)

Google Android is a Linux-based open source operating system from Google. A security bypass vulnerability exists in Google Android. An attacker can exploit this vulnerability to bypass security restrictions and gain out-of-bounds access...

Huawei HarmonyOS iAware module malicious application control vulnerability

Huawei HarmonyOS is an operating system from Huawei, China. It provides a microkernel-based, fully distributed operating system. The Huawei HarmonyOS iAware module is vulnerable to a malicious application control vulnerability that could be exploited to cause malicious applications to boot and...

Siemens SIMATIC CP SRCS VPN Feature Code Injection Vulnerability

The SIMATIC CP 1242-7 and CP 1243-7 LTE communication processors connect SIMATIC S7-1200 controllers to a wide area network WAN. They provide integrated security features such as firewalls, virtual private networks VPNs, and support for other protocols with data encryption.The SIMATIC CP 1243-8 I...

SAP Business Objects Data Forgery Issue Vulnerability

SAP Business Objects is a business intelligence suite from SAP Germany. A security vulnerability exists in SAP Business Objects version 420 that stems from inadequate input validation. An attacker exploits the vulnerability to submit a malicious request...

VICIdial Cross-Site Scripting Vulnerability

Vicidial is a software suite from Vicidial, Inc. Designed to interact with the Asterisk open source Pbx phone system as a complete inbound/outbound contact center suite with inbound email support. A cross-site scripting vulnerability exists in VICIdial versions prior to 2.14b0.5, which stems from...

Robustel R1510 OS Command Injection Vulnerability

The Robustel R1510 is an industrial VPN router from Robustel China.The Robustel R1510 is vulnerable to an operating system command injection vulnerability, which stems from the fact that specially crafted network packets can be subject to a command injection vulnerability in the...