Google Android Information Disclosure Vulnerability (CNVD-2021-77615)

Android is a Linux-based open source operating system developed by Google Inc. and the Open Handheld Alliance OHA for short, and an information disclosure vulnerability exists in the System component of Google Android. An attacker could use this vulnerability to obtain sensitive information...

Huawei FusionCompute Command Injection Vulnerability (CNVD-2021-84882)

Huawei FusionCompute is a computer virtualization engine from Huawei China. A command injection vulnerability exists in the CMA service of the Huawei FusionCompute product, which provides Virtual Resource Manager VRM and Compute Node Agent CNA. The vulnerability stems from the fact that special...

FFmpeg Information Disclosure Vulnerability (CNVD-2021-80285)

FFmpeg is a complete solution for recording, converting, and streaming audio and video from the FFmpeg team. FFmpeg is vulnerable to an information disclosure. No detailed vulnerability details are available at this time...

Mozilla Rust Command Injection Vulnerability (CNVD-2021-85293)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. Mozilla Rust is vulnerable to a command injection vulnerability that can be exploited by attackers to cause data contention and memory corruption due to data contention...

Mozilla Rust Memory Corruption Vulnerability (CNVD-2021-71657)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in Rust hashconsing crate before 1.1.0, which stems from a limitation in HConsed's lack of sending or synchronization features, and could be exploited by an attacker to cause a...

JetBrains TeamCity Encryption Issue Vulnerability

Jetbrains JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains Jetbrains. The tool provides continuous unit testing, code quality analysis and build issue analysis reports. A cryptographic issue vulnerability exists in...

Adobe Captivate 2019 Elevation of Privilege Vulnerability

Adobe Captivate 2019 is a tool that allows us to quickly create and produce interactive content in html. An elevation of privilege vulnerability exists in Adobe Captivate 2019 11.5.5 and earlier versions. The vulnerability stems from creating temporary files in a directory with incorrect...

TYPO3 Cross-Site Scripting Vulnerability (CNVD-2022-17973)

TYPO3 is a free and open source content management system framework CMS/CMF from the TYPO3 Typo3 association in Switzerland.TYPO3 has a cross-site scripting vulnerability that stems from failure to properly parse, clean and encode malicious rich text content, and no detailed vulnerability details...

Huawei EMUI/Magic UI NFC-based connection authentication vulnerability

Huawei Emui is an Android-based mobile operating system. Huawei Magic UI is the operating system for Honor phones. Huawei EMUI/Magic UI has a security vulnerability that can be exploited by attackers to cause kernel code execution...

ZOHO ManageEngine ADSelfService Plus CSV Injection Vulnerability

ZOHO ManageEngine ADSelfService Plus is a web-based end-user password management software from ZOHO, Inc. A CSV injection vulnerability exists in ZOHO ManageEngine ADSelfService Plus, which can be exploited by attackers to obtain a reverse shell...

Microsoft Excel Remote Code Execution Vulnerability (CNVD-2021-54407)

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft Corporation USA.Microsoft Excel is vulnerable to remote code execution. An attacker could exploit this vulnerability to execute code on the target host...

Google Golang Trust Management Issue Vulnerability

Google Golang is a statically strongly typed, compiled language from Google, U.S. A trust management issue vulnerability exists in Google Golang, which can be exploited by attackers to cause a TLS client panic...

Google TensorFlow Buffer Overflow Vulnerability (CNVD-2021-48861)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A buffer overflow vulnerability exists in Google TensorFlow 2.4.2, 2.3.3, 2.2.3, 2.1.4, which can be exploited by an attacker to cause a read to exceed the bounds of the heap allocation data...

XWiki Platform cross-site request forgery vulnerability

XWiki Platform is a generic wiki platform that provides runtime services for applications built on it. XWiki Platform is vulnerable to cross-site request forgery, which can be exploited by attackers to reset the password of any user in XWiki via a spoofed URL...

Unauthorized Access Vulnerability in Portainer

Portainer is a graphical management tool for visualizing container images. With Portainer you can easily build, manage and maintain Docker environments. An unauthorized access vulnerability exists in Portainer. An attacker could exploit the vulnerability to obtain sensitive information...

Siemens Tecnomatix Plant Simulation Buffer Error Vulnerability

Siemens Tecnomatix Plant Simulation is an industrial control device from Siemens, Germany. The power of discrete-event simulation is used to analyze and optimize throughput and thus improve manufacturing system performance. A buffer error vulnerability exists in Tecnomatix Plant Simulation versio...

Microsoft Windows/Windows Server Elevation of Privilege Vulnerability (CNVD-2021-66099)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, an operating system for personal devices, and Microsoft Windows Server, a server operating system. An elevation of privilege vulnerability exists in the "Container Manager Service" of Microsoft...

Unspecified Vulnerability in HashiCorp Consul and Consul Enterprise

Hashicorp HashiCorp Consul is a suite of distributed, highly available data center-aware solutions from HashiCorp Hashicorp USA. The product is used to connect and provision applications across a dynamically distributed infrastructure. A security vulnerability exists in HashiCorp Consul and Consu...

Rust Competitive Conditioning Problem Vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A Competition Condition Issue vulnerability exists in Rust concread crate versions prior to 0.2.6, which can be exploited by an attacker to cause data contention in ARCache by sending a type that does not...

JerryScript has an unspecified vulnerability (CNVD-2022-11531)

JerryScript is a lightweight JavaScript engine from the JerryScript project. A security vulnerability exists in JerryScript vm/opcodes.c version 2.2.0, which can be exploited by attackers to hijack the control flow via the control register...

QEMU Code Issue Vulnerability

QEMU Quick Emulator is a set of simulation processor software by French software developer Fabrice Bellard. The software is fast, cross-platform and other characteristics. A code issue vulnerability exists in the addressspacemap of the exec.c file in QEMU version 4.2.0. A local attacker can explo...

Ruby on Rails Cross-Site Request Forgery Vulnerability (CNVD-2020-34299)

Ruby on Rails is a set of Rails team based on the Ruby language open source Web application framework. A cross-site request forgery vulnerability exists in Ruby on Rails 6.0.3 and earlier versions. The vulnerability stems from a web application that does not adequately validate that a request is...

ThemeREX Addons Remote Code Execution Vulnerability

WordPress plugin ThemeREX Addons is a plugin that works with various ThemeREX themes, featuring several theme enhancements and widgets that extend the functionality of the theme in question. A remote code execution vulnerability exists in versions of ThemeREX Addons prior to 2020-03-09. The...

Symantec Endpoint Protection Manager Information Disclosure Vulnerability (CNVD-2020-09964)

Symantec Endpoint Protection Manager SEPM is a suite of enterprise-grade virus protection software from Symantec USA. The software protects against malicious attacks such as viruses, worms, and Trojan horses. Symantec Endpoint Protection Manager suffers from an information disclosure vulnerabilit...

Pillow Denial of Service Vulnerability (CNVD-2020-03157)

Pillow is a Python based image processing library. A denial of service vulnerability exists in Pillow versions prior to 6.2.2. An attacker can exploit this vulnerability to cause a denial of service process termination...

mcollective Trust Management Issues Vulnerabilities

mcollective is a framework for building Server Orchestration and parallel work execution systems. A trust management issue vulnerability exists in mcollective. The vulnerability stems from the lack of an effective trust management mechanism in a networked system or product. An attacker could...

Rittal Chiller SK 3232-Series Improper Access Control Vulnerability

The Rittal Chiller SK 3232-Series is a liquid cooling device from Rittal, Germany. An improper access control vulnerability in the web interface in the Rittal Chiller SK 3232-Series, which arises from an authentication mechanism that is not sufficiently protected to prevent unauthorized...

Pallets Werkzeug Security Feature Issue Vulnerability

Pallets Werkzeug is a WSGI Web application library. A security vulnerability exists in Pallets Werkzeug versions prior to 0.15.3. No details of the vulnerability are provided at this time...

atftp Buffer Overflow Vulnerability

atftp is a client implementation of the TFTP protocol. A buffer overflow vulnerability exists in atftp version 0.7.1. The vulnerability stems from a network system or product performing operations in memory without properly validating data boundaries, resulting in incorrect read and write...

Domoticz SQL Injection Vulnerability

Domoticz is an open source smart home system. The system supports monitoring and controlling a wide range of smart home devices. A SQL injection vulnerability exists in Domoticz versions prior to 4.10578, which stems from a lack of validation of externally entered SQL statements in database-based...

Netatalk Out-of-Bounds Write Vulnerability

Netatalk is a server for providing Appletalk network protocol services on the Linux platform. An out-of-bounds write vulnerability exists in the dsiopensess.c file in versions prior to Netatalk 3.1.12, which stems from the program's failure to perform a boundary check on attacker-controlled data...

LibTIFF tif_unix function null pointer reference vulnerability

LibTIFF is a library for reading and writing TIFF Tagged Image File Format files. The library contains some command line tools for working with TIFF files. A null pointer reference vulnerability exists in the LibTIFF tifunix function. An attacker could exploit this vulnerability to cause a denial...

Nagios Core null pointer dereference vulnerability (CNVD-2018-17098)

Nagios Core is an open source system and network monitoring application. A null pointer dereference vulnerability exists in qhecho in Nagios Core 4.4.1 and earlier. An attacker can exploit this vulnerability by sending a specially crafted payload to a listening UNIX socket to cause a local denial...

WordPress Web-Dorado Instagram Feed WD Plugin Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Software Foundation using the PHP language, which supports setting up personal blog sites on servers with PHP and MySQL.Web-Dorado Instagram Feed WD plugin is a social media content sharing plugin used in ... A cross-site scripting...

WordPress Plugin Site Editor Local File Inclusion Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.Site Editor plugin is used in one of the WYSIWYG front-end editor. A local file inclusion vulnerability exists in...

SQL Injection Vulnerability in Multiple Peplink Balance Products

Peplink Balance 305 and others are multi-exit load balancing routers for medium-sized businesses. An SQL injection vulnerability exists in several Peplink Balance products using firmware versions prior to fw-b305hw2380hw6580hw2710hw31350hw22500-7.0.1-build2093. A remote attacker could exploit the...

Multiple Vulnerabilities in OpenStack Object Storage

OpenStack is a cloud platform management program developed by the National Aeronautics and Space Administration in collaboration with Rackspace in the U.S. OpenStack Object Storage a.k.a. Swift is one of these programs used to storage project for storing permanent static data. A security...

ASUS Router Authentication Bypass Vulnerability (CNVD-2025-29936)

ASUS Router is a router product and accompanying management application from ASUS, primarily used for wireless connectivity and management of home and business networks. An authentication bypass vulnerability exists in ASUS Router, which stems from an unexpected side effect of Samba functionality...

Unspecified Vulnerability in HCL AION (CNVD-2025-25409)

HCL AION is an AI lifecycle management platform from HCL India. HCL AION suffers from a security vulnerability that stems from a script whitelist configuration bypass and a misconfigured Content-Security-Policy header, which can be exploited by an attacker to cause cross-site scripting and other...

Cisco Webex Meetings Cross-Site Scripting Vulnerability (CNVD-2025-21256)

Cisco Webex Meetings is a set of video conferencing solutions from Cisco USA. A cross-site scripting vulnerability exists in Cisco Webex Meetings that stems from insufficient validation of user input and can be exploited by an attacker to cause a cross-site scripting attack...

Mozilla Firefox for Android Security Bypass Vulnerability (CNVD-2025-19559)

Mozilla Firefox for Android is a web browser designed for Android devices by the US-based Mozilla Foundation. A security bypass vulnerability exists in Mozilla Firefox for Android prior to version 141, which stems from improper truncation of URL display in the address bar and can be exploited by...

JetBrains TeamCity Cross-Site Scripting Vulnerability

JetBrains TeamCity is a Continuous Integration CI/CD tool developed by JetBrains, Inc. to automate the software build, test and deployment process. JetBrains TeamCity suffers from a cross-site scripting vulnerability that stems from the presence of reflective cross-site scripting on the...

TOTOLINK N300RB Command Injection Vulnerability

The TOTOLINK N300R is a wireless router for home and small office scenarios from Korean networking brand TOTOLINK. The TOTOLINK N300RB suffers from a command injection vulnerability that originates from the remote support feature of static key protection, which can be exploited by an attacker to...

WordPress Plugin WP Umbrella: Update Backup Restore & Monitoring Local File Containment Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A local file inclusion vulnerability exists in the WordPress plugin WP Umbrella: Update Backup Restore &...

Adobe Photoshop Digital Error Vulnerability (CNVD-2025-24445)

Adobe Photoshop is a set of image processing software from the American company Audobee Adobe. The software is mainly used for processing pictures. Adobe Photoshop suffers from a numeric error vulnerability that can be exploited by an attacker to cause arbitrary code to be executed in the current...

Mattermost Path Traversal Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a path traversal vulnerability that stems from an inability to clean up front-end user input used for redirection, which can be exploited by an attacker to cause a cross-site...

Google Chrome Code Execution Vulnerability (CNVD-2024-27332)

Google Chrome is a web browser from Google, an American company. A code execution vulnerability exists in versions of Google Chrome prior to 126.0.6478.54, which can be exploited by an attacker to perform out-of-bounds memory writes via a crafted HTML page...

Unspecified Vulnerability in Oracle VM VirtualBox (CNVD-2024-20437)

Oracle Virtualization and Oracle VM VirtualBox are both products of Oracle Corporation.Oracle Virtualization is a suite of virtualization solutions. The product is used to unify the management of the entire hardware and software system from the application to the disk, can be achieved from the...

Microsoft SharePoint Server Spoofing Vulnerability (CNVD-2024-39676)

Microsoft SharePoint Server is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A spoofing...

SAP NetWeaver AS Cross-Site Scripting Vulnerability (CNVD-2024-13534)

SAP NetWeaver AS is a SAP network application server from SAP. It not only provides network services, but also the basic platform for SAP software. A cross-site scripting vulnerability exists in SAP NetWeaver AS ABAP, which stems from insufficiently coded user-controlled input in SAP GUI for...