InvenTree CSV Injection Vulnerability

InvenTree is an open source inventory management system from InvenTree Open Source. Provides powerful low-level inventory control and parts tracking . A CSV injection vulnerability exists in InvenTree versions prior to 0.7.2, which stems from an application that does not filter the escaping of...

Virtua SQL注入漏洞 charging

Virtua Cobranca, a CRM software for call centers and collection and finance departments from Virtua Brazil, is vulnerable to SQL injection in versions prior to Virtua Cobranca 12R. The vulnerability stems from a missing data filter escape in the idusuario parameter in login.php. An attacker could...

WordPress Note Press plugin SQL injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Note Press plugin 0.1.10 and earlier versions are vulnerable to SQL injection, which stems...

WordPress Note Press plugin SQL injection vulnerability (CNVD-2022-64665)

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. FormCraft is one of the form creation plugins used in it. WordPress plugin is an application plugin. WordPress Note Press plugin 0.1.10 and earlier...

TOTOLINK EX1200T Command Injection Vulnerability (CNVD-2022-53569)

TOTOLINK EX1200T is a Wi-Fi range extender from China-based Gion Electronics TOTOLINK.TOTOLINK EX1200T has a command injection vulnerability, which originates from the NTPSyncWithHost function of the file system containing a remote command injection issue that can be exploited by an attacker to...

Illumina Local Run Manager Information Disclosure Vulnerability

Illumina Local Run Manager is an integrated solution from Illumina, Inc. Designed to create sequencing runs, monitor run status, analyze sequencing data, and view results, Illumina Local Run Manager contains an information disclosure vulnerability that could be exploited by remote attackers to...

DHIS2 SQL Injection Vulnerability

DHIS2 is an information system for data capture, management, validation, analysis, and visualization. DHIS2 is vulnerable to SQL injection, which can be exploited by attackers to read, edit, and delete data in the DHIS2 instance database...

Mozilla Firefox Cross-Site Scripting Vulnerability (CNVD-2023-06863)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from a cross-site scripting vulnerability that stems from incorrect input validation when handling HTML comment tags. The vulnerability can be exploited by an attacker to launch...

OctoPrint webcam stream test cross-site scripting vulnerability

OctoPrint is an application that provides a fast web interface for controlling consumer 3D printers. A cross-site scripting vulnerability exists in versions prior to OctoPrint 1.8.0, which stems from a lack of filtering and escaping of data in the software webcam stream test. An attacker could us...

Publify Access Control Error Vulnerability

Publify is a simple but full-featured web publishing software.An access control error vulnerability exists in versions of Publify prior to 9.2.8. The vulnerability stems from an access control error in draft mode, which could be exploited by an attacker to comment on articles in draft mode...

Terminalfour Cross-Site Scripting Vulnerability

Terminalfour is a digital marketing and web content management platform for higher education from Terminalfour, Inc. A cross-site scripting vulnerability exists in versions prior to Terminalfour 8.3.8, which could be exploited by attackers to execute JavaScript code...

MediaWiki SQL Injection Vulnerability

MediaWiki is a set of web-based wiki engines from the U.S. Wikimedia MediaWiki Foundation. The product can be used to deploy internal knowledge management and content management systems. A security vulnerability exists in MediaWiki version 1.37.2 and earlier, which stems from a SemanticDrilldown...

Microsoft Windows Remote Procedure Call Runtime Remote Code Execution Vulnerability

Microsoft Windows Remote Procedure Call Runtime is a technology used to create distributed client/server programs from Microsoft Corporation USA.Microsoft Windows Remote Procedure Call Runtime is vulnerable to remote code execution vulnerability. The vulnerability stems from the failure of a...

Microsoft SharePoint Server Remote Code Execution Vulnerability (CNVD-2022-59592)

Microsoft SharePoint is a suite of enterprise business collaboration platforms from Microsoft Corporation. Microsoft SharePoint Server is vulnerable to a remote code execution vulnerability that can be exploited to cause arbitrary code execution...

TOTOLINK N600R Command Injection Vulnerability (CNVD-2022-53559)

TOTOLINK N600R is a wireless router from Taiwan-based TOTOLINK Electronics. TOTOLINK N600R has a command injection vulnerability, which originates from the "Main" function containing command injection, and can be exploited to execute arbitrary commands via the QUERYSTRING parameter...

Zammad Denial of Service Vulnerability (CNVD-2022-70097)

Zammad is a suite of ticket management software from Zammad Germany. v5.1.0 of Zammad suffers from a denial of service vulnerability that stems from a lack of a password length limit allowing the creation of extremely long passwords, which could be exploited by an attacker to cause a denial of...

WordPress plugin Videos sync PDF file contains vulnerabilities

WordPress is a set of blogging platform developed using the PHP language. WordPress plugin Videos sync PDF version 1.7.4 and before there is a file inclusion vulnerability, the vulnerability stems from the plugin in the inclusion statement using the p parameter before failing to validate, an...

Mattermost has an unspecified vulnerability (CNVD-2022-65351)

Mattermost is an open source collaboration platform from Mattermost, a US-based company. mattermost has a security vulnerability and no details of the vulnerability are available at this time...

Desire2Learn Learning Management System Access Control Error Vulnerability

An access control error vulnerability exists in Desire2Learn Learning Management System, a learning management system from Desire2Learn Canada, due to improper access controls. A remote attacker could disable the "Disable Right Click Control"...

REDCap Cross-Site Scripting Vulnerability (CNVD-2022-81345)

A cross-site scripting vulnerability exists in versions of REDCap prior to 11.4.0, which stems from a lack of data validation filtering of user-supplied data and output in the missing data code functionality of the program. An attacker could exploit this vulnerability to execute JavaScript code o...

HTMLy cross-site scripting vulnerability (CNVD-2022-82257)

HTMLy is an open source database-free PHP blogging platform. A cross-site scripting vulnerability exists in HTMLy version 2.8.1, which originates from the presence of the "copyright" field in the /admin/config page. The vulnerability can be exploited to execute malicious code, manipulate pages to...

Reolink Rlc-410W Denial of Service Vulnerability (CNVD-2022-37388)

Reolink Rlc-410W is a Wifi security camera from Reolink China.A denial of service vulnerability exists in Reolink RLC-410W, which can be exploited by attackers to cause a reboot via a compiled HTTP request...

ClassApps SelectSurvey.NET SQL Injection Vulnerability

Net is a survey software from ClassApps, Inc. built using Microsoft's cutting-edge . A SQL injection vulnerability exists in the ID parameter of the UploadedImageDisplay.aspx endpoint, which can be exploited by an unauthenticated attacker to retrieve data from the application's back-end database...

Pascom Cloud Phone System Server Request Forgery Vulnerability

Pascom Cloud Phone System is a cloud-based phone system from Pascom. A server request forgery vulnerability exists in Pascom Cloud Phone System, which stems from the product's failure to properly validate user input and could be exploited by attackers to probe server intranet resources...

WordPress WooCommerce plugin SQL注入漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blogging sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. SQL injection vulnerability exists in versions of...

Orchard Coret Cross-Site Scripting Vulnerability

Net Core, an open source modular and multi-tenant application framework built using Asp.Net Core, and a content management system Cms built on top of the framework.A cross-site scripting vulnerability exists in Orchard Core, which stems from the lack of proper validation of client-side data in th...

FreeTAKServer-UI has an unspecified vulnerability

FreeTAKServer-UI is an open source FTS web interface from the FreeTAKTeam team.FreeTAKServer-UI has a security vulnerability that could be exploited by an attacker to place arbitrary files anywhere on the system...

Siemens RUGGEDCOM ROS Cross-Site Scripting Vulnerability

Siemens RuggedCom ROS is an operating system used in the RuggedCom family of switches from Siemens, Germany. Siemens RUGGEDCOM ROS is vulnerable to cross-site scripting, which can be exploited by attackers to retrieve sensitive information via cross-site scripting...

D-Link DAP-1620 Path Traversal Vulnerability

A path traversal vulnerability exists in the D-Link DAP-1620, a wireless repeater extender from D-Link, Taiwan, China, which results from a path traversal in the D-Link DAP-1620 that causes local file inclusion to lead to unauthorized internal file reads of /etc/passwd and / etc/shadow. No detail...

WordPress Yoast SEO plugin information leakage vulnerability

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. An information disclosure vulnerability exists in versions of the WordPress Yoast SEO plugin prior to...

Microweber logic flaw vulnerability

Microweber is an online store management system from the Microweber community in the United States that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. A logic flaw vulnerability exists in Microweber, which stems from an error in the business...

Apache Airflow OS Command Injection Vulnerability (CNVD-2022-18263)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow suffers from an operating system command injection vulnerability tha...

Siemens Simcenter Femap Out-of-Bounds Write Vulnerability (CNVD-2022-12808)

Simcenter Femap is an advanced simulation application for creating, editing, and inspecting finite element models of complex products or systems.Siemens Simcenter Femap out-of-bounds write vulnerability can be exploited by attackers to execute code in the context of the current process...

Tenda Ax3 Command Injection Vulnerability (CNVD-2022-13933)

Tenda Ax3 is an Ax1800 Gigabit Port Dual Band Wifi 6 Wireless Router from Tenda China. A command injection vulnerability exists in Tenda AX3 v16.03.12.10CN, which can be exploited by an attacker to cause a denial of service DoS via the remoteIp parameter...

HP Support Assistant Licensing Issue Vulnerability (CNVD-2022-15173)

HP Support Assistant is a solution from Hewlett-Packard HP that provides support and other functions for PCs and printers. HP Support Assistant is vulnerable to authorization issues, which stem from the product's failure to effectively authenticate users, and can be exploited by attackers to...

Google Android Buffer Overflow Vulnerability (CNVD-2022-47682)

Google Android is a Linux-based open source operating system from Google, Inc. A buffer overflow vulnerability exists in Google Android, which originates in GKIgetbuf in gkibuffer.cc. Due to a heap buffer overflow, an out-of-bounds write may exist, and an attacker could use this vulnerability to...

GLPI Cross-Site Scripting Vulnerability (CNVD-2022-11518)

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build a database to fully manage IT computers, monitors, servers, printers, network devices, phones, even toner cartridges...

Foxit PDF Reader pdf Buffer Overflow Vulnerability

Foxit PDF Reader is a PDF reader. Foxit PDF Reader has a security vulnerability that can be exploited by remote attackers to submit a special file request, which induces the user to parse it and can crash the application or execute arbitrary code in the application context...

Unspecified Vulnerability in Bentley Systems Bentley View (CNVD-2022-15836)

Bentley Systems Bentley View is a free viewer from Bentley Systems, USA. A security vulnerability exists in Bentley View that can be exploited by an attacker to execute code in the context of the current process...

Insyde InsydeH2O has an unspecified vulnerability (CNVD-2022-10288)

Insyde InsydeH2O is a C source from Insyde Software Taiwan, China that implements the new technology "EFI/UEFI" specification, designed to replace the legacy BIOS Basic Input/Output System.A security vulnerability exists in Insyde InsydeH2O. The vulnerability stems from the System Management...

Oracle VM VirtualBox Input Validation Error Vulnerability (CNVD-2022-09137)

Oracle VM VirtualBox is a virtual machine management software from Oracle. Oracle VM VirtualBox has an input validation error vulnerability that originates from an input validation error in the Core component. An attacker could exploit the vulnerability to access sensitive information...

Reolink RLC-410W netserver recv_command denial of service vulnerability

Reolink Rlc-410W is a Wifi security camera from Reolink China.A denial of service vulnerability exists in Reolink RLC-410W v3.0.0.13620121102, which stems from the fact that the incoming error message is not properly handled in the recvcommand function and can be exploited by an attacker to cause...

Google Chrome Security Feature Issue Vulnerability (CNVD-2022-15139)

Google Chrome is a web browser from Google, Inc. A security feature vulnerability exists in Google Chrome that could be exploited by attackers to bypass site quarantine via crafted HTML pages...

phpMyAdmin Authorization Issues Vulnerability

phpMyAdmin is a free, web-based MySQL database management tool from the Phpmyadmin team. The tool is capable of creating and deleting databases, creating, deleting, and modifying database tables, executing SQL script commands, and more. A security vulnerability exists in phpMyAdmin, which stems...

Oracle MySQL Cluster Input Validation Error Vulnerability (CNVD-2022-13058)

Oracle MySQL is an open source relational database management system from Oracle Corporation. MySQL Cluster is a highly useful and redundant version for distributed computing environments. Oracle MySQL Cluster is vulnerable to an input validation error, which can be exploited to execute arbitrary...

JerryScript has an unspecified vulnerability (CNVD-2022-07245)

JerryScript is a lightweight JavaScript engine for the JerryScript Jerryscript project. version 3.0.0 of JerryScript has a security vulnerability, there are no details of the vulnerability provided...

JerryScript has an unspecified vulnerability (CNVD-2022-07246)

JerryScript is a lightweight JavaScript engine from the JerryScript Jerryscript project.A security vulnerability exists in JerryScript version 3.0.0, which stems from a stack overflow in /ecma/operations/ecma-objects.c. No detailed vulnerability details are currently available...

Buffer Overflow Vulnerability in Multiple Huawei Products (CNVD-2022-17397)

The Huawei CloudEngine 12800 is a 12800 series data center switch, and the Huawei Cloudengine 5800 is a 5800 series data center switch. Buffer overflow vulnerability exists in several Huawei products. The vulnerability stems from insufficient validation of certain parameters in messages, which ca...

microweber cross-site scripting vulnerability

Microweber is an online store management system from the Microweber community in the United States that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. A cross-site scripting vulnerability exists in microweber, which stems from a lack of data...

F5 BIG-IP profile vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A configuration file vulnerability exists in F5 BIG-IP, which can be exploited by attackers to cause a denial of service on t...