SAP Business Objects Data Forgery Issue Vulnerability

SAP Business Objects is a business intelligence suite from SAP Germany. A security vulnerability exists in SAP Business Objects version 420 that stems from inadequate input validation. An attacker exploits the vulnerability to submit a malicious request...

Tenda M3 formSetAccessCodeInfo function stack overflow vulnerability

Tenda M3 is an access controller from Tenda, China. Tenda M3 V1.0.0.12 is vulnerable to a stack overflow vulnerability, which stems from the formSetAccessCodeInfo function info parameter not checking the length of the input data. An attacker could exploit this vulnerability to cause a denial of...

Orwell-Dev-Cpp Hijacking Vulnerability

Orwell-Dev-Cpp is a free, portable, fast and simple C/C++ IDE. A hijacking vulnerability exists in Orwell-Dev-Cpp v5.11, which can be exploited by an attacker to execute arbitrary code via a specially crafted exe file...

Shopware Cross-Site Scripting Vulnerability (CNVD-2022-58390)

Shopware is a German Shopware company's open source e-commerce software. A cross-site scripting vulnerability exists in Shopware versions prior to 5.7.12, which stems from a lack of checksum filtering of user-supplied and output data during login authentication. An attacker can exploit this...

Weave GitOps Log Information Disclosure Vulnerability

Weave GitOps is a simple open source developer platform open source by Weaveworks. Weave GitOps has a log information disclosure vulnerability. The vulnerability stems from insufficient protection of sensitive information and can be exploited by an authenticated remote attack to view sensitive...

WordPress Active Products Tables for WooCommerce plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Active Products Tables for WooCommerce plugin version prior to 1.0.5 has a cross-site scripting...

Google Android Resource Management Error Vulnerability in Android (CNVD-2022-53370)

Google Android is a Linux-based open source operating system from Google, Inc. A resource management error vulnerability exists in Google Android, which stems from resource exhaustion in the addAutomaticZenRule of ZenModeHelper.java, and can be exploited by attackers to cause a local denial of...

74cmsSE SQL Injection Vulnerability (CNVD-2022-61440)

74cmsSE is a free open source professional recruitment system based on PHP MYSQL. 74cmsSE is vulnerable to SQL injection, which results from the lack of validation of external input SQL statements in the /freelance/resumelist keyword parameter. An attacker could use this vulnerability to execute...

Jenkins CRX Content Package Deployer Plugin Cross-Site Scripting Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. Jenkins Plugin is an application that provides hundreds of plug-ins to support building, deploying, and automating any project. a cross-site scripting vulnerability exists in Jenkins CRX Content Package...

WordPress WP SVG Icons plugin remote code execution vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress WP SVG Icons plugin version 3.2.3 and prior versions contain a remote code execution...

HelpDeskZ cross-site scripting vulnerability (CNVD-2022-59046)

HelpDeskZ is a PHP-based software that allows you to manage your site's support using a web-based support ticket system. Provides quality support. A cross-site scripting vulnerability exists in HelpDeskZ version v2.0.2, which stems from a lack of parameter filtering and escaping in...

FacturaScripts Cross-Site Scripting Vulnerability

FacturaScripts is an ERP software. A cross-site scripting vulnerability exists in FacturaScripts versions prior to 2022.06, which can be exploited by an attacker to execute JavaScript code on the client side...

WordPress Ultimate Member plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. WordPress Ultimate...

IBM Spectrum Copy Data Management Access Control Error Vulnerability

IBM Spectrum Copy Data Management, an IBM company that modernizes, simplifies, and automates data center copy management processes, has an access control error in IBM Spectrum Copy Data Management Admin versions 2.2.0.0 through 2.2.15.0. vulnerability, which stems from a lack of proper session...

WordPress WP Simple Adsense Insertion plugin跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress WP Simple Adsense Insertion plugin prior to version 2.1 is vulnerable to cross-site request...

epub2txt2 denial of service vulnerability

epub2txt is a simple command-line utility for extracting text from an EPUB document and optionally rearranging it to fit a specific number of columns of text to be displayed. epub2txt2 version v2.04 is vulnerable to a denial-of-service vulnerability stemming from an integer overflow error in the...

ZKEACMS Cross-Site Scripting Vulnerability

ZKEACMS v3.5.2 is a cross-site scripting vulnerability that can be exploited by attackers to inject malicious JavaScript programs to steal other users' cookies, etc...

Parallels H-Sphere Cross-Site Scripting Vulnerability

Parallels H-Sphere is a web-hosting automation control panel from Parallels, Inc. It is used for shared web hosting services. Parallels H-Sphere version 3.6.2 contains a cross-site scripting vulnerability that can be exploited by attackers to perform XSS via indexen.php in the parameters...

F5 BIG-IP path traversal vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A path traversal vulnerability exists in F5 BIG-IP, which can be exploited by attackers to read arbitrary files...

WordPress AdRotate plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. Cross-site scripting vulnerabilities exist in versions of WordPress AdRotate plugin prior to 5.8.23, which st...

QEMU Resource Management Error Vulnerability (CNVD-2022-84160)

QEMU Quick Emulator is a set of emulation processor software by Fabrice Bellard, a French personal developer. A denial of service vulnerability exists in versions prior to QEMU 7.0.0, which stems from EHCI's failure to verify that the buffer pointer overlaps with its MMIO region when transferring...

Command Execution Vulnerability in Atlassian Bitbucket Data Center

Atlassian Bitbucket Data Center is the data center version of Atlassian Bitbucket by Atlassian Australia. Atlassian Bitbucket Data Center suffers from a command execution vulnerability that can be exploited by an attacker to execute arbitrary code via Java deserialization...

Selenium Server Cross-Site Request Forgery Vulnerability

Selenium Grid is an intelligent proxy server for the Selenium community. It can easily run tests in parallel on multiple machines.A cross-site request spoofing vulnerability exists in versions prior to Selenium Server 4, which can be exploited by attackers to spoof malicious requests to trick...

nconf has unspecified vulnerabilities

nconf is a TOML-formatted plugin. nconf versions prior to 0.11.4 have a security vulnerability that stems from the .set function, which is responsible for setting configuration properties, being vulnerable to prototype contamination, which can be exploited by attackers to override JavaScript...

Pimcore SQL Injection Vulnerability (CNVD-2022-29569)

Pimcore is an open source Web content management platform for creating and managing Web applications from the Austrian company Pimcore. The platform integrates Web content management, e-commerce frameworks and product information management applications.A SQL injection vulnerability exists in...

Jenkins promoted builds Plugin cross-site scripting vulnerability

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.A cross-site scripting vulnerability exists in the Jenkins promoted builds Plugin, which stems from the application not...

Fortinet FortiWAN SQL Injection Vulnerability

Fortinet FortiWan is a network appliance from Fortinet, Inc. It is used to perform load balancing and fault tolerance across different networks. SQL injection vulnerability exists in versions prior to Fortinet FortiWAN 4.5.9, which stems from a program that does not properly filter special elemen...

ZoneMinder Cross-Site Scripting Vulnerability (CNVD-2022-57803)

ZoneMinder is an open source video surveillance software system. The system supports IP, USB and analog cameras, etc. A cross-site scripting vulnerability exists in ZoneMinder 1.32.3 and previous versions, which can be exploited by remote attackers to execute HTML or JavaScript code with the help...

VMware vCenter Server Information Disclosure Vulnerability (CNVD-2022-55066)

VMware vCenter Server is a suite of server and virtualization management software from Vmware, Inc. VMware vCenter Server is vulnerable to an information disclosure vulnerability that could be exploited by an attacker with unmanaged access to gain access to sensitive information...

Reolink Rlc-410W Denial of Service Vulnerability (CNVD-2022-37386)

Reolink Rlc-410W is a Wifi security camera from Reolink China.A denial of service vulnerability exists in Reolink RLC-410W, which can be exploited by attackers to cause a reboot via a compiled HTTP request...

Apache Gobblin Trust Management Issue Vulnerability

Apache Gobblin is a distributed data integration framework from the Apache Foundation USA. Used to simplify common aspects of big data integration, Apache Gobblin is vulnerable to a trust management issue that stems from Apache Gobblin trusting all certificates used for LDAP connections in...

ARRIS TR3300 OS Command Injection Vulnerability

ARRIS TR3300 is an 802.11ac Wi-Fi router from ARRIS, Inc. ARRIS TR3300 v1.0.13 is vulnerable to an operating system command injection vulnerability that could be exploited by attackers to execute arbitrary commands via crafted requests...

WordPress Sync QCloud COS plugin cross-site scripting vulnerability

WordPress is a set of blogging platform developed by Wordpress Foundation using PHP language. WordPress plugin is a WordPress application plugin. WordPress Sync QCloud COS plugin version prior to 2.0.1 contains a cross-site scripting vulnerability that stems from the plugin's failure to escape so...

Jeecg-Boot Cross-Site Scripting Vulnerability

Jeecg-Boot is a low-code platform based on the code generator from the JeecgBoot community. Jeecg-Boot 3.0 has a security vulnerability that stems from a cross-site script in /jeecg-boot/jmreport/view that causes a mouse hover event. No details of the vulnerability are currently available...

Luocms Cross-Site Scripting Vulnerability

Luocms is an article management system. A cross-site scripting vulnerability exists in Luocms v2.0, which stems from a lack of data validation filtering of user-supplied data and output in /admin/news/sortadd.php and /inc/function.php. An attacker could use this vulnerability to execute JavaScrip...

livehelperchat Cross-Site Scripting Vulnerability (CNVD-2022-18521)

livehelperchat is available through Live Helper Chat, which provides free live support on the website. livehelperchat suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data by the WEB application. An attacker could exploit the...

Shopware Cross-Site Scripting Vulnerability (CNVD-2022-18526)

Shopware is a set of open source e-commerce software from the German company Shopware.Shopware suffers from a cross-site scripting vulnerability that stems from the program's lack of data validation filtering of user-supplied and output data. An attacker could exploit this vulnerability to inject...

Siemens RUGGEDCOM ROS Heap Buffer Overflow Vulnerability

Siemens RuggedCom ROS is an operating system used in the RuggedCom family of switches from Siemens, Germany. Siemens RUGGEDCOM ROS suffers from a heap buffer overflow vulnerability that can be exploited by attackers to cause a heap overflow...

Subrion CMS Cross-Site Scripting Vulnerability (CNVD-2022-20164)

Subrion CMS is a PHP-based content management system CMS from the Subrion team. The system can be integrated into websites and supports multiple extension plugins, etc. A security vulnerability exists in Subrion CMS 4.2.1, which can be exploited by attackers via the q parameter in the Kickstart...

Microweber Cross-Site Scripting Vulnerability (CNVD-2022-15527)

Microweber is an online store management system from the Microweber community in the United States that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. A cross-site scripting vulnerability exists in GitHub, which stems from the lack of proper...

Tp-link TL-WR840N Command Injection Vulnerability

Tp-link TL-WR840N is a wireless router from Tp-link.TP-LINK TL-WR840NES V6.20 180709 is vulnerable due to a lack of filtering and escaping of command parameters in the component oalsetIp6DefaultRoute. No detailed vulnerability details are available at this time...

snapd competition condition issue vulnerability

Snapd is an open source, cross-platform package management tool. snapd is vulnerable to a contention issue, which can be exploited by local attackers to gain root privileges and execute arbitrary code to gain privilege escalation by binding to mount their own content in snap's private mount...

Foxit PDF Reader Buffer Overflow Vulnerability (CNVD-2023-49839)

Foxit PDF Reader is a Chinese Foxit Foxit company's a PDF reader. A security vulnerability exists in Foxit PDF Reader, which stems from carefully crafted data in JP2 images that can trigger the reading of data beyond the end of the allocated buffer. The vulnerability can be exploited by an attack...

librenms Cross-Site Scripting Vulnerability (CNVD-2022-12754)

Librenms is a PHP and MySQL based open source network monitoring system from the Librenms community. The system features custom alerts, auto-discovery of network environments and automatic updates.Librenms suffers from a cross-site scripting vulnerability that stems from a lack of data validation...

CuppaCMS SQL Injection Vulnerability (CNVD-2022-22322)

CuppaCMS is a content management system CMS.A SQL injection vulnerability exists in CuppaCMS, which stems from the lack of validation of externally entered SQL statements in the database-based application. An attacker could exploit this vulnerability to execute illegal SQL commands...

McAfee Agent Command Injection Vulnerability

The McAfee McAfee Agent MA is a set of client components from McAfee, Inc. that provides secure communications between ePolicy Orchestrator the antivirus management platform and managed products. A security vulnerability exists in the McAfee Agent that originates from allowing a local user to...

Discourse Information Disclosure Vulnerability (CNVD-2022-05504)

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features.Discourse is vulnerable to an information disclosure vulnerability that could be exploited by attackers to obtain private configuration files...

Apache Kylin server-side request forgery vulnerability

Apache Kylin is an open source distributed analytic data warehouse from the Apache Foundation. The product mainly provides Hadoop/Spark on top of the SQL query interface and multidimensional analysis OLAP and other functions. Apache kylin has a server-side request forgery vulnerability, which ste...

Google Android Elevation of Privilege Vulnerability (CNVD-2022-06157)

Google Android is a Linux-based open-source operating system from the US company Google. Google Android 11 has a security vulnerability that could be exploited by attackers to cause a local privilege escalation...

HDF5 has an unspecified vulnerability

HDF5 is a suite of tools for managing and storing different types of data from HDF, Inc. The product supports managing, manipulating, viewing and analyzing data, and generating files in portable formats.A security vulnerability exists in HDF5, stemming from a segmentation error in HDF5 1.13.1-1,...