LibreNMS Cross-Site Scripting Vulnerability (CNVD-2021-93896)

LibreNMS is a PHP/MYSQL/SNMP-based open source monitoring tool. a stored cross-site scripting vulnerability exists in API access pages in versions of LibreNMS prior to 21.3.0. The vulnerability stems from insufficient validation of the $api-description variable. An attacker could use this...

Rundeck Cross-Site Request Forgery Vulnerability

Rundeck is an open source automation service with a web console, command line tools and WebAPI from Rundeck, Inc. that is primarily used to run automation tasks. a cross-site request forgery vulnerability exists in Rundeck, which stems from the fact that users with access to the "system" resource...

GPAC Project on Advanced Content Integer Overflow Vulnerability (CNVD-2021-64080)

GPAC Project on Advanced Content is an open source cross-platform library that implements the MPEG-4 system standard and provides tools for media playback, vector graphics, and 3D rendering. an integer overflow vulnerability exists in the MPEG-4 decoding functionality in GPAC Project on Advanced...

GPAC Project on Advanced Content Integer Overflow Vulnerability (CNVD-2021-64077)

GPAC Project on Advanced Content is an open source cross-platform library that implements the MPEG-4 system standard and provides tools for media playback, vector graphics, and 3D rendering. an integer overflow vulnerability exists in the MPEG-4 decoding functionality in GPAC Project on Advanced...

Mozilla Firefox Type Obfuscation Vulnerability (CNVD-2021-90101)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the U.S. Mozilla Firefox is vulnerable to a type obfuscation vulnerability that stems from a faulty JIT optimization and a type obfuscation error. A remote attacker could trick a victim into opening a carefully construct...

Unspecified Vulnerability in HCC Embedded InterNiche (CNVD-2021-59227)

HCC Embedded InterNiche is a newsletter software. A security vulnerability exists in HCC Embedded InterNiche. The vulnerability stems from the TCP/IP stack parsing HTTP POST request code and can be exploited by an attacker to cause a cache heap overflow...

Apache Druid Privilege Permission and Access Control Issues Vulnerability

Apache Druid is the United States Apache Apache Foundation of a use of the Java language , written in column-oriented open source distributed database . Apache Druid has a security vulnerability that can be exploited by an attacker to read data from other sources e.g., the local file system using...

Google TensorFlow Denial of Service Vulnerability (CNVD-2021-37645)

Google TensorFlow is an end-to-end open source machine learning platform. A security vulnerability exists in tf.rawops.ReverseSequence in Google TensorFlow. A locally authenticated attacker can exploit this vulnerability to cause a denial of service condition...

Jamovi Cross-Site Scripting Vulnerability

jamovi is jamovi open source a free and open statistics platform. Jamovi has a cross-site scripting vulnerability in version 1.6.18 and earlier. In ElectronJS framework , the listing is vulnerable to XSS attacks. An attacker can exploit the vulnerability to craft a .omv document containing a...

Atlassian Jira Server and Data Center has an unspecified vulnerability

Atlassian JIRA Server and Atlassian JIRA Data Center are both products of Atlassian Australia, Atlassian JIRA Server is a server version of a defect tracking management system. Atlassian JIRA Data Center is the data center version of Atlassian JIRA, which is a security vulnerability that could be...

ONLYOFFICE Document Server Buffer Overflow Vulnerability

ONLYOFFICE Document Server is a free collaborative online office suite that includes viewers and editors for text, spreadsheets and presentations. A buffer overflow vulnerability exists in the BMP image processing of the ONLYOFFICE Document Server core module, which can be exploited by an attacke...

Huawei AIS-BW80H-00 Input Validation Error Vulnerability

Huawei AIS-BW80H-00 is a smart speaker device from Huawei China. Huawei AIS-BW80H-00 is vulnerable to an input validation error, which could be exploited by an attacker to load a crafted software package onto the device...

Rust Competitive Conditioning Problem Vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A Competition Condition Issue vulnerability exists in Rust concread crate versions prior to 0.2.6, which can be exploited by an attacker to cause data contention in ARCache by sending a type that does not...

Unspecified vulnerability in Mozilla Rust rulinalg crate

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in rulinalg crate in versions of Mozilla Rust prior to 2020-02-11, which stems from improperly defined lifecycle boundaries in RowMut::raw slice and RowMut::raw slice mut. No...

Advanced SystemCare Denial of Service Vulnerability

Advanced SystemCare is a Window system performance analysis and optimization tool. advanced SystemCare 13 PRO 13.5.0.174 is vulnerable to a denial of service. An attacker can exploit the vulnerability through a specially crafted program to cause a computer crash...

Microsoft .NET Core and ASP.NET Core Security Feature Bypass Vulnerability

Microsoft .NET Core and Microsoft ASP.NET Core are both products of Microsoft Corporation USA. NET Core is a free open source development platform. NET Core is a free open source development platform with multi-language support and cross-platform features.Microsoft ASP.NET Core is a framework of...

Dungeon Crawl Stone Soup Code Issue Vulnerability

Dungeon Crawl Stone Soup is a single player video game. A security vulnerability exists in Dungeon Crawl Stone Soup versions prior to 0.25. The vulnerability can be exploited by a remote attacker to execute arbitrary code via a .crawlrc file with Lua bytecode...

Cisco Digital Network Architecture Center Cross-Site Scripting Vulnerability (CNVD-2020-04518)

Cisco Digital Network Architecture Center DNA Center is a set of digital network architecture solutions from the U.S. company Cisco Cisco. The program can extend and protect devices, applications, etc. within the network. A cross-site scripting vulnerability exists in Cisco Digital Network...

OpenBSD Elevation of Privilege Vulnerability

OpenBSD is a cross-platform, BSD-based UNIX-like operating system from the Canadian OpenBSD project team. An elevation of privilege vulnerability exists in OpenBSD 6.6 and earlier versions, which can be exploited by a local attacker to elevate privileges to root, and then execute his own library...

Sonatype Nexus Repository Manager Operating System Command Injection Vulnerability

Sonatype Nexus Repository Manager NXRM is a Maven repository manager from Sonatype USA. An operating system command injection vulnerability exists in Sonatype NXRM that can be exploited by an attacker to execute code...

helm trust management issue vulnerability

helm is a Kubernetes package manager. A trust management issue vulnerability exists in versions of helm prior to 2.7.2. The vulnerability stems from the lack of an effective trust management mechanism in a networked system or product. An attacker can leverage default passwords or hard-coded...

Netwide Assembler (NASM) Denial of Service Vulnerability (CNVD-2019-01857)

Netwide Assembler NASM is a Linux-based assembler that creates binaries and writes bootloaders. A security vulnerability exists in the eval.c file in NASM 2.14.02 and earlier versions. A remote attacker can exploit this vulnerability to cause a denial of service infinite recursion and stack...

Ansible Information Disclosure Vulnerability (CNVD-2018-25747)

Ansible is a computer system configuration manager from Ansible, Inc. that can be used to publish, manage and orchestrate computer systems. An information disclosure vulnerability exists in Ansible, which can be exploited by an attacker to obtain sensitive data in vvv+ mode...

nginx denial of service vulnerability (CNVD-2018-22806)

nginx is a lightweight web server/reverse proxy server and email IMAP/POP3 proxy server. A security vulnerability exists in the HTTP/2 implementation in Nginx versions prior to 1.15.5 and 1.14.1. A remote attacker can exploit this vulnerability by sending a malicious request to cause a denial of...

marshmallow library for Python Information Disclosure Vulnerability

Python is an open source, object-oriented programming language from the Python Software Foundation. The language is extensible, supports modules and packages, and supports multiple platforms. marshmallow library is one of the lightweight libraries for converting complex objects into Python data...

Apache Syncope Information Disclosure Vulnerability (CNVD-2018-18783)

Apache Syncope is the United States Apache Apache Software Foundation's set of open source digital identity management system for use in enterprise environments. The system supports identity management, role configuration and more. Apache Syncope suffers from an information disclosure vulnerabili...

Debian devscripts arbitrary code execution vulnerability (CNVD-2018-13847)

Debian is a free operating system developed and maintained by the Debian Project. devscripts is a collection of system maintenance scripts. A security vulnerability in the scripts/grep-excuses.pl file in Debian devscripts 2.18.3 and earlier, which stems from the program's unsafe use of YAML::Syck...

Microsoft Windows HIDParser Elevation of Privilege Vulnerability

Microsoft Windows 10 and others are a series of operating systems released by Microsoft Corporation in the U.S. Microsoft Windows 10 is a set of operating systems for personal computers.Windows Server 2016 is a set of server operating systems.HIDParser is one of the HID HIDParser is one of the HI...

WordPress Navis DocumentCloud Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's suite of blogging platforms developed using the PHP language, which supports personal blogging sites on servers running PHP and MySQL.Navis DocumentCloud is one of the plug-ins that allows journalists to analyze, annotate, and publish documents. A...

Google Android Cache Overflow Vulnerability (CNVD-2025-07596)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from a buffer overflow vulnerability that stems from the program not properly checking boundaries, no details of the vulnerability are provided at this time...

Rockwell Automation FactoryTalk View SE Elevation of Privilege Vulnerability

Rockwell Automation FactoryTalk View SE is an industrial automation system view interface from Rockwell Automation. An elevation of privilege vulnerability exists in Rockwell Automation FactoryTalk View SE, which can be exploited by an attacker to edit scripts that bypass access control lists and...

Microsoft Excel Remote Code Execution Vulnerability (CNVD-2024-19332)

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. A remote code execution vulnerability exists in Microsoft Excel, which can be exploited by an attacker to execute arbitrary code on a system...

Foxit PDF Reader AcroForm Code Execution Vulnerability

Foxit PDF Reader is a PDF document reader and printer with fast startup speed and rich features. A code execution vulnerability exists in Foxit PDF Reader AcroForm, which can be exploited by a remote attacker to submit a special file request and trick the user into parsing it, which can crash the...

Siemens Sinteso EN and Cerberus PRO EN Fire Protection Systems Buffer Overflow Vulnerability

Cerberus PRO EN is a fire protection system consisting of fire panels, detection and management stations. It is available to Siemens partners and complies with the European standard EN 54 for fire detection and alarm systems. Sinteso EN is a fire protection system consisting of fire panels,...

Siemens SENTRON 3KC ATC6 Ethernet Module Hidden Function Vulnerability

The Siemens SENTRON 3KC ATC6 Expansion Module is a power distribution protection device from Siemens, Germany, for monitoring and protecting power systems. A hidden function vulnerability exists in the Siemens SENTRON 3KC ATC6 Ethernet Module due to affected devices exposing unused and unstable...

Unspecified Vulnerability in IBM PowerSC

IBM PowerSC is an International Business Machines IBM security and compliance solution for IBM Power Systems servers. A security vulnerability exists in IBM PowerSC versions 1.3, 2.0 and 2.1, which can be exploited by an attacker to perform privileged operations and retrieve sensitive information...

Arbitrary File Read Vulnerability in Yonghong One-Stop Big Data BI Platform of Beijing Yonghong Business Intelligence Technology Co.

Yonghong One-Stop Big Data BI Platform is a one-stop big data analysis platform. Beijing Yonghong Business Intelligence Technology Co., Ltd. Yonghong One-Stop Big Data BI Platform suffers from an arbitrary file read vulnerability, which can be exploited by attackers to obtain sensitive informatio...

Google Chrome Security Bypass Vulnerability (CNVD-2024-10262)

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome version 121.0.6167.85 and earlier versions, which stems from an insufficient policy enforcement issue in the DevTools module. An attacker can exploit this vulnerability to bypa...

GTKWave Integer Overflow Vulnerability

GTKWave is a full-featured, GTK+-based waveform viewer from GTKWave. An integer overflow vulnerability exists in GTKWave version 3.3.115, which can be exploited by an attacker to cause memory corruption via specially crafted .fst files...

ZZCMS File Upload Vulnerability (CNVD-2024-06241)

ZZCMS is a content management system CMS by the ZZCMS team in China. A file upload vulnerability exists in ZZCMS version 2023, which stems from the lack of valid validation of uploaded files in /Ebak5.1/upload/index.php. An attacker can exploit this vulnerability to gain server privileges and...

Apache Guacamole Integer Overflow Vulnerability

Apache Guacamole is a clientless remote desktop gateway from the Apache USA Foundation. The product supports protocols such as VNC, RDP and SSH. An integer overflow vulnerability exists in Apache Guacamole 1.5.3 and earlier versions, which can be exploited by an attacker to execute arbitrary code...

ThinkAdmin Code Execution Vulnerability

ThinkAdmin is a general purpose backend management system based on the ThinkPHP framework. A security vulnerability exists in ThinkAdmin version v6.1.53, which originates from allowing arbitrary file uploads. An attacker can exploit the vulnerability to execute arbitrary code via a specially...

Siemens SICAM PAS/PQS Incorrect Privilege Assignment Vulnerability (CNVD-2023-75593)

Siemens SICAM PAS/PQS is a software from Siemens with an operating system for energy automation and power quality. Siemens SICAM PAS/PQS suffers from an incorrect privilege assignment vulnerability that can be exploited to inject arbitrary code and elevate privileges to NT AUTHORITY/SYSTEM...

Open5GS Access Control Error Vulnerability

Open5GS is an open source implementation in C of 5G Core and Epc, the core network of the Lte/Nr network. An Access Control Error vulnerability exists in Open5GS version 2.4.10 and earlier, which stems from a lack of authentication, and can be exploited by an attacker to send an HTTP request to a...

Exiv2 buffer overflow vulnerability (CNVD-2023-68223)

Exiv2 is a suite of C++ libraries and command line applications for managing image metadata. It provides the ability to read and write image metadata in a variety of formats including EXIF, IPTC and XMP. A buffer overflow vulnerability exists in Exiv2 version 0.27.1, which stems from a boundary...

FreeImage LoadPixelDataRLE8 function buffer overflow vulnerability

FreeImage is a cross-platform open source library for supporting popular graphic image formats. A buffer overflow vulnerability exists in the FreeImage LoadPixelDataRLE8 function, which can be exploited by an attacker to execute arbitrary code on a system or cause a denial of service attack...

Fortinet FortiOS Buffer Overflow Vulnerability (CNVD-2023-64450)

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. Fortinet FortiOS suffers from a...

Microsoft Azure DevOps Server Spoofing Vulnerability

Microsoft Azure DevOps Server is a suite of software development collaboration tools from Microsoft Corporation USA. The product includes features such as sharing code, work tracking, and software distribution. The Microsoft Azure DevOps Server spoofing vulnerability can be exploited by attackers...

Google Android Input Validation Error Vulnerability (CNVD-2023-53154)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an input validation error vulnerability that can be exploited by an attacker to cause a local denial of service...

Pimcore Cross-Site Scripting Vulnerability (CNVD-2023-40909)

Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce framework and product information management applications. A cross-site scripting vulnerability exists in...