Google Chrome V8 Code Execution Vulnerability (CNVD-2021-91296)

Google Chrome is a web browser from Google, Inc. A security vulnerability exists in Google Chrome, which is caused by type obfuscation in V8. An attacker could exploit the vulnerability to execute arbitrary code on the system...

D-Link DIR-823G Command Injection Vulnerability (CNVD-2021-85889)

D-Link DIR-823G is an AC1200M dual-band gigabit wireless router.A command injection vulnerability exists in the HNAP1 protocol in D-Link DIR-823G version 1.0.2B05. An attacker can execute arbitrary Web scripts using shell meta characters in the Captcha field of the login section...

Michael R Sweet HTMLDOC Buffer Overflow Vulnerability

HTMLDOC is an HTML file format conversion editor that reads HTML and Markdown source files or web pages and generates the corresponding EPUB, HTML, PostScript or PDF files with optional table of contents. A buffer overflow vulnerability exists in imageloadbmp in HTMLDOC versions prior to 1.9.12. ...

WordPress Cross-Site Scripting Vulnerability (CNVD-2021-83666)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in the WordPress plugin LearnPress, which stems from insufficient...

Spotweb Cross-Site Scripting Vulnerability (CNVD-2021-83613)

Spotweb is a Php-based Soptnet client that follows the Spotnet protocol from the Spotweb team. 1.5.1 and previous versions of Spotweb have a cross-site scripting vulnerability that can be exploited by attackers to execute JavaScript code on the client side...

Google TensorFlow Buffer Overflow Vulnerability (CNVD-2022-09855)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow suffers from a buffer overflow vulnerability that stems from the inability of the ""tf.rawops.RaggedGather"" parameter in the software to determine a valid ragged tensor code,...

ECOA BAS controller directory traversal vulnerability (CNVD-2021-83638)

ECOA BAS controller is a smart lighting control solution. ECOA BAS controller is vulnerable to directory traversal, which can be exploited by attackers to compromise sensitive and system information...

Cisco IOS XE Software Authentication Bypass Vulnerability

Cisco IOS XE Software is an operating system from the U.S. company Cisco Cisco. A single operating system for enterprise wired and wireless access, aggregation, core, and WAN, Cisco IOS XE reduces business and network complexity.Cisco IOS XE Software is vulnerable to an authentication bypass...

Mozilla Rust Competition Condition Issue Vulnerability (CNVD-2021-85289)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. spacejam mode of Mozilla Rust is vulnerable to a contention condition issue that could be exploited by an attacker to allow secure Rust code to trigger data contention...

UReport Arbitrary File Creation Vulnerability

UReport is a high-performance pure Java reporting engine based on the Spring architecture. ureport version 2.2.9 contains an arbitrary file creation vulnerability. An attacker can exploit this vulnerability to execute arbitrary code...

Exiv2 Buffer Overflow Vulnerability (CNVD-2021-94951)

Exiv2 is a cross-platform C library and command-line utility for managing image metadata. a buffer overflow vulnerability exists in Exiv2::Internal::Nikon1MakerNote::print0x0088 in nikonmnint.cpp in Exiv2 version 0.27.99.0. An attacker could exploit this vulnerability to obtain information...

Google TensorFlow buffer overflow vulnerability (CNVD-2021-64535)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A buffer overflow vulnerability exists in Google TensorFlow due to a lack of valid restrictions in tf.rawops.ResourceGather in the affected version, which could be exploited by an attacker to A crash ca...

Linux kernel denial-of-service vulnerability (CNVD-2021-60514)

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. Linux kernel is vulnerable due to a failure to properly access permissions flaw in the shadow page in arch/x86/kvm/mmu/pagingtmpl.h. By sending a build request, a local attacker could exploit this flaw t...

Hotel Druid SQL Injection Vulnerability

Hotel Druid is an open source application for hotel management developed by DigitalDruid.Net. A security vulnerability exists in Hotel Druid version 3.0.2, which stems from the fact that malicious attackers can exploit the vulnerability to issue SQL commands to SQLite databases via the vulnerable...

TYPO3 Cross-Site Scripting Vulnerability (CNVD-2022-17987)

TYPO3 is a free and open source content management system framework CMS/CMF from the TYPO3 Typo3 association in Switzerland.TYPO3 suffers from a cross-site scripting vulnerability that stems from the fact that when the settings of the back-end layout are not properly coded, the corresponding grid...

Microsoft HEVC Video Extensions Remote Code Execution Vulnerability (CNVD-2021-70130)

Microsoft HEVC Video Extensions is a video extension application from Microsoft Corporation USA. The application enables computers and devices to read High Efficiency Video Encoding or HEVC video.A remote code execution vulnerability exists in Microsoft HEVC Video Extensions. An attacker could...

Booking Core has an unspecified vulnerability

Booking Core is an application. A Laravel-based booking system designed for travel websites, malls, travel agents, tour operators, B&Bs, villa rentals, resort rentals, Make Travel websites.Booking Core has a security vulnerability that stems from the subscription functionality in Ultimate Booking...

Fortinet FortiMail Injection Vulnerability

Fortinet FortiMail is a set of e-mail security gateway products of the U.S. Fita Fortinet. The product provides e-mail security and data protection features. An injection vulnerability exists in Fortinet FortiMail due to a missing encryption step in the implementation of the hash digest algorithm...

Google TensorFlow Buffer Overflow Vulnerability (CNVD-2021-48861)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A buffer overflow vulnerability exists in Google TensorFlow 2.4.2, 2.3.3, 2.2.3, 2.1.4, which can be exploited by an attacker to cause a read to exceed the bounds of the heap allocation data...

XWiki Platform cross-site request forgery vulnerability

XWiki Platform is a generic wiki platform that provides runtime services for applications built on it. XWiki Platform is vulnerable to cross-site request forgery, which can be exploited by attackers to reset the password of any user in XWiki via a spoofed URL...

Realtek RTL8710 Buffer Overflow Vulnerability (CNVD-2021-56811)

The Realtek RTL8710 is an IoT microcontroller from Realtek Semiconductor Taiwan, China.The Realtek RTL8710 suffers from a buffer overflow vulnerability that could be exploited by attackers to remotely execute code via the "memcpy" function...

Rust buffer overflow vulnerability (CNVD-2021-29835)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A buffer overflow vulnerability exists in reorder crate for Rust 2021-02-24 and earlier, which stems from the fact that swapindex may return uninitialized values if the len returned by the iterator is too large...

Invigo Automatic Device Management Command Injection Vulnerability

Invigo Automatic Device Management ADM is a native management tool for cellular operators that enables them to detect, maintain and manage millions of devices cost-effectively and with a high degree of reliability. A command injection vulnerability exists in /admin/broadcast.php in Invigo Automat...

Cisco IOS XR and Cisco NX-OS Software Access Control Error Vulnerability

Cisco NX-OS Software and Cisco IOS XR are both products of Cisco U.S.A. Cisco NX-OS Software is a suite of data center-class operating system software for switches. cisco IOS XR is a suite of operating systems developed for its network devices. cisco IOS XR and Cisco NX-OS Software is vulnerable ...

Zoom Client Path Traversal Vulnerability

Zoom Client is a video conferencing client application from Zoom USA that supports multiple platforms. A path traversal vulnerability exists in Zoom Client version 4.6.10. An attacker can exploit this vulnerability to execute arbitrary code with the help of a specially crafted message...

Tortoise ORM SQL Injection Vulnerability

Tortoise ORM is an open source object-relational mapper . A SQL injection vulnerability exists in MySQL in Tortoise ORM versions prior to 0.15.23 and prior to 0.16.6. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based applications. An attacker...

Python Resource Management Error Vulnerability

Python is an open source, object-oriented programming language from the Python Software Foundation. The language is extensible, supports modules and packages, and supports multiple platforms. There is a security vulnerability in Python. The vulnerability stems from mismanagement of system resourc...

TYPO3 code issue vulnerability (CNVD-2020-04075)

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. A security vulnerability exists in the QueryGenerator and QueryView classes in TYPO3 versions prior to 8.7.30, 9.x versions prior to 9.5.12, and 10.x versions prior to 10.2.2. An attacker...

Domoticz SQL Injection Vulnerability

Domoticz is an open source smart home system. The system supports monitoring and controlling a wide range of smart home devices. A SQL injection vulnerability exists in Domoticz versions prior to 4.10578, which stems from a lack of validation of externally entered SQL statements in database-based...

WIBU-SYSTEMS WibuKey.sys 0x8200E804 IOCTL Kernel Information Disclosure Vulnerability

Wibu-Systems WibuKey is a digital rights management DRM system from Wibu-Systems. A security vulnerability in WIBU-SYSTEMS WibuKey.sys 0x8200E804 IOCTL handling allows local attackers to exploit the vulnerability by submitting a special request to obtain a kernel memory information disclosure...

Netwide Assembler (NASM) Denial of Service Vulnerability (CNVD-2019-01857)

Netwide Assembler NASM is a Linux-based assembler that creates binaries and writes bootloaders. A security vulnerability exists in the eval.c file in NASM 2.14.02 and earlier versions. A remote attacker can exploit this vulnerability to cause a denial of service infinite recursion and stack...

Smarty path traversal vulnerability

New Digital Group Smarty is a template engine written in PHP by New Digital Group. A path traversal vulnerability exists in the 'SmartySecurity::isTrustedResourceDir' function in New Digital Group Smarty versions prior to 3.1.33, which stems from the program's failure to adequately filter templat...

Red Hat OpenShift Container Platform Denial of Service Vulnerability

Red Hat OpenShift Container Platform is an application platform from Red Hat that enables organizations to develop, deploy and manage existing container-based applications across physical, virtual and public cloud infrastructures. A denial of service vulnerability exists in Red Hat OpenShift...

WordPress Plainview Activity Monitor Plugin OS Command Injection Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . Plainview Activity Monitor plugin is used in one of the website user activity monitoring plugin . An operating syst...

WordPress Web-Dorado Instagram Feed WD Plugin Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Software Foundation using the PHP language, which supports setting up personal blog sites on servers with PHP and MySQL.Web-Dorado Instagram Feed WD plugin is a social media content sharing plugin used in ... A cross-site scripting...

GNU Guile Local Security Bypass Vulnerability

GNU Guile is a set of programming languages developed by the GNU Project for creating flexible applications. A local security bypass vulnerability exists in GNU Guile 2.0.12 and earlier versions, which can be exploited by an attacker to bypass security restrictions and perform unauthorized...

ASUS Router Authentication Bypass Vulnerability (CNVD-2025-29936)

ASUS Router is a router product and accompanying management application from ASUS, primarily used for wireless connectivity and management of home and business networks. An authentication bypass vulnerability exists in ASUS Router, which stems from an unexpected side effect of Samba functionality...

Unspecified Vulnerability in HCL AION (CNVD-2025-25409)

HCL AION is an AI lifecycle management platform from HCL India. HCL AION suffers from a security vulnerability that stems from a script whitelist configuration bypass and a misconfigured Content-Security-Policy header, which can be exploited by an attacker to cause cross-site scripting and other...

Mozilla Firefox for Android Security Bypass Vulnerability (CNVD-2025-19559)

Mozilla Firefox for Android is a web browser designed for Android devices by the US-based Mozilla Foundation. A security bypass vulnerability exists in Mozilla Firefox for Android prior to version 141, which stems from improper truncation of URL display in the address bar and can be exploited by...

Linux kernel bnxt driver code issue vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. The Linux kernel suffers from a code issue vulnerability that stems from the bnxt driver not properly recalculating network device characteristics after XDP is disabled, which...

WAVLINK AC3000 nas.cgi disk_part parameter command injection vulnerability in the nas.cgi add_dir function

WAVLINK AC3000 is a wireless router from China Ruiyin WAVLINK. A command injection vulnerability exists in the WAVLINK AC3000 M33A8.V5030.210505 version, which stems from the diskpart parameter of the nas.cgi adddir function failing to correctly filter the constructor command special characters,...

PbootCMS Code Injection Vulnerability (CNVD-2025-0171060)

PbootCMS is PbootCMS open source an open source enterprise building content management system CMS developed using the PHP language. PbootCMS version 3.2.3 and earlier versions of the code injection vulnerability exists , the vulnerability stems from apps/home/controller/IndexController.php page t...

Microsoft GroupMe Access Control Error Vulnerability

Microsoft GroupMe is a confidential group messaging service from Microsoft. Users can conduct and manage SMS group chat via cell phone SMS or client. Microsoft GroupMe suffers from an Access Control Error vulnerability that stems from improper access control. An attacker could exploit the...

Fortinet FortiOS Command Execution Vulnerability (CNVD-2024-29330)

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. Fortinet FortiOS suffers from a...

Tenda W30E fromRouteStatic function buffer overflow vulnerability

The Tenda W30E is a router from the Chinese company Tenda. A buffer overflow vulnerability exists in Tenda W30E version 1.0.1.25633, which originates from the parameter page of the fromRouteStatic function in /goform/fromRouteStatic that fails to correctly validate the length of the input data, a...

Customer Support System Cross-Site Scripting Vulnerability (CNVD-2024-14025)

Customer Support System is a customer support system by oretnom23 Personal Developer that helps a particular business or company to provide customer support after a customer has purchased a product from them. Customer Support System suffers from a cross-site scripting vulnerability that stems fro...

Apache InLong Code Issue Vulnerability (CNVD-2024-08088)

Apache InLong is the U.S. Apache Apache Foundation's one-stop massive data integration framework. Provides automated, secure and reliable data transfer capabilities. Apache InLong has a code issue vulnerability that stems from the presence of a deserialization vulnerability. An attacker can explo...

Apache IoTDB Deserialization Vulnerability

Apache IoTDB is an integrated data management engine designed for time-series data from the Apache USA Foundation, which provides data collection, storage, and analysis services, among other things. A deserialization vulnerability exists in Apache IoTDB versions 0.13.0 through 0.13.4, which can b...

IceCMS Cross-Site Scripting Vulnerability (CNVD-2023-98191)

IceCMS is a content management system based on Spring Boot + Vue front-end and back-end separation . A cross-site scripting vulnerability exists in IceCMS version 2.0.1. The vulnerability stems from the application's lack of effective filtering and escaping of user-supplied data, which can be...

TP-LINK Tapo C100 Denial of Service Vulnerability

TP-LINK Tapo C100 is a webcam device from China P&L TP-LINK. The TP-LINK Tapo C100 suffers from a denial of service vulnerability that stems from not properly handling incoming error messages, which can be exploited by an attacker to cause a denial of service DoS by serving a crafted web request...