PbootCMS Code Injection Vulnerability (CNVD-2025-0171060)

PbootCMS is PbootCMS open source an open source enterprise building content management system CMS developed using the PHP language. PbootCMS version 3.2.3 and earlier versions of the code injection vulnerability exists , the vulnerability stems from apps/home/controller/IndexController.php page t...

ImageSharp Denial of Service Vulnerability

ImageSharp is a new, full-featured, fully managed, cross-platform 2D graphics API from ImageSharp. ImageSharp suffers from a denial of service vulnerability that stems from the fact that processing specially crafted files may cause the image decoder to use too much memory, which can be exploited ...

Unspecified Vulnerability in Palo Alto Networks PAN-OS (CNVD-2024-20502)

Palo Alto Networks PAN-OS is a next-generation firewall software from Palo Alto Networks, USA. A security vulnerability exists in Palo Alto Networks PAN-OS that stems from the presence of a memory leak. No details of the vulnerability are provided at this time...

Microsoft Office Remote Code Execution Vulnerability (CNVD-2024-10429)

Microsoft Office is a suite of office software based on the Windows operating system developed by Microsoft. A remote code execution vulnerability exists in Microsoft Office, which can be exploited by an attacker to execute arbitrary code on a system...

Arbitrary File Read Vulnerability in Yonghong One-Stop Big Data BI Platform of Beijing Yonghong Business Intelligence Technology Co.

Yonghong One-Stop Big Data BI Platform is a one-stop big data analysis platform. Beijing Yonghong Business Intelligence Technology Co., Ltd. Yonghong One-Stop Big Data BI Platform suffers from an arbitrary file read vulnerability, which can be exploited by attackers to obtain sensitive informatio...

Mozilla Firefox Denial of Service Vulnerability (CNVD-2024-10437)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A denial of service vulnerability exists in Mozilla Firefox, which can be exploited by attackers to cause the browser to crash...

Google Chrome Security Bypass Vulnerability (CNVD-2024-10261)

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome version 121.0.6167.85 and earlier versions, which stems from an incorrect security user interface in the Payments module. An attacker can exploit this vulnerability to bypass...

Apache Airflow Cross-Site Scripting Vulnerability (CNVD-2024-0101622)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow Apache Airflow cross-site scripting vulnerability , the vulnerabilit...

Apache IoTDB Deserialization Vulnerability

Apache IoTDB is an integrated data management engine designed for time-series data from the Apache USA Foundation, which provides data collection, storage, and analysis services, among other things. A deserialization vulnerability exists in Apache IoTDB versions 0.13.0 through 0.13.4, which can b...

Foxit Reader Arbitrary File Creation Vulnerability (CNVD-2023-96090)

Foxit Reader is a Chinese Foxit Foxit company's a PDF document reader. An arbitrary file creation vulnerability exists in Foxit Reader before version 12.1.3.15356, which can be exploited by an attacker to execute arbitrary code on the system...

Siemens SICAM A8000 Device CPCI85 Firmware Hardcoded Credentials Vulnerability

The SICAM A8000 RTU Remote Terminal Unit series is a modular family of devices for remote control and automation applications in all areas of energy supply. A hard-coded credentials vulnerability exists in the CPCI85 firmware of the Siemens SICAM A8000 device, which can be exploited by an attacke...

Google Android onCreate module authorization issue vulnerability

Google Android is a Linux-based open source operating system from Google. Google Android onCreate module has an authorization issue vulnerability that stems from a lack of permission checking in the onCreate module of ManagePermissionsActivity.java, with one possible way to bypass the Restore...

Fortinet FortiOS Buffer Overflow Vulnerability (CNVD-2023-64450)

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. Fortinet FortiOS suffers from a...

Microsoft Excel Remote Code Execution Vulnerability (CNVD-2023-64864)

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. A remote code execution vulnerability exists in Microsoft Excel, which can be exploited by an attacker to execute arbitrary code on a system...

Linux kernel memory misreference vulnerability (CNVD-2023-62923)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. The Linux kernel suffers from a memory misreference vulnerability that originates when a user triggers the nftpipaporemove function using an element without NFTSETEXTKEYEND,...

Milesight UR32L vtysh_ubus tcpdump_start_cb function command injection vulnerability

The Milesight UR32L is a 4G industrial router from China's Milesight. A command injection vulnerability exists in the Milesight UR32L vtyshubus tcpdumpstartcb function, which can be exploited by an attacker to execute arbitrary commands on the system...

Microsoft SharePoint Server Spoofing Vulnerability (CNVD-2023-53462)

Microsoft SharePoint Server is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A spoofing...

Mozilla Firefox Information Disclosure Vulnerability (CNVD-2023-68481)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security bypass vulnerability exists in Mozilla Firefox, which can be exploited by attackers to bypass network security checks...

Google Chrome on ChromeOS Memory Misreference Vulnerability

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in Google Chrome on ChromeOS versions prior to 113.0.5672.114. An attacker can exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system...

Google Chrome on ChromeOS Code Execution Vulnerability

Google Chrome is a web browser from Google, an American company. A code execution vulnerability exists in Google Chrome on ChromeOS. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system...

Checkmk Information Disclosure Vulnerability (CNVD-2023-32192)

Checkmk is an editor. An information disclosure vulnerability exists in the Checkmk Appliance that stems from inadequate protection of sensitive information in Webconf. An attacker could exploit the vulnerability by reading log files to retrieve passwords...

Apache UIMA DUCC Command Injection Vulnerability

Apache UIMA DUCC is a cluster management system from the Apache Apache Foundation in the United States. The system provides tools, management and scheduling tools. Apache UIMA DUCC suffers from a command injection vulnerability that arises from improper neutralization of specific elements used wh...

Foxit PDF Editor Remote Code Execution Vulnerability (CNVD-2023-23563)

Foxit PDF Editor is China Foxit Foxit company a PDF editor. Foxit PDF Editor has a remote code execution vulnerability that can be exploited by an attacker to execute arbitrary code in the context of the current process...

Google Chrome Web Payments API Component Code Issue Vulnerability

Google Chrome is a web browser from Google, an American company. A code issue vulnerability exists in versions prior to Google Chrome 111.0.5563.64, which stems from a weak policy enforcement issue in the Web Payments API component. A remote attacker could exploit the vulnerability to bypass...

Siemens JT Open Toolkit Stack Buffer Overflow Vulnerability

Siemens JT Open Toolkit Siemens JTTK is a C++ application programming interface API from Siemens, Germany. It provides support for 64-bit application development on Microsoft Windows, Linux and MacOS. Siemens JT Open Toolkit suffers from a stack buffer overflow vulnerability that can be exploited...

F5 BIG-IP APM Virtual Server Open Redirect Vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. An open redirection vulnerability exists in the F5 BIG-IP APM virtual server, which can be exploited by an unauthenticated...

Oracle VM VirtualBox has an unspecified vulnerability (CNVD-2023-05477)

A security vulnerability exists in Oracle VM VirtualBox, a virtual machine management software from Oracle Corporation. A low privilege attacker can compromise Oracle VM VirtualBox by logging into the infrastructure where Oracle VM VirtualBox is executing...

Microsoft PowerShell Remote Code Execution Vulnerability

PowerShell is a task automation and configuration management framework developed by Microsoft Corporation USA, consisting of a command line interface shell layer related manuscript language built from . exploit this vulnerability to bypass sandbox restrictions and execute arbitrary code on the...

Mozilla Firefox Resource Misuse Vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from a resource mishandling vulnerability that stems from the way the browser handles XSL documents. An attacker could use the vulnerability to trick a victim into loading a...

OpenImageIO Stack Buffer Overflow Vulnerability

OpenImageIO is an image read and write library that also provides several tools and applications. A stack buffer overflow vulnerability exists in the TGA file format parser in OpenImageIO v2.3.19.0. An attacker could exploit this vulnerability to cause out-of-bounds writes and arbitrary code...

Apache Traffic Server Cross-Site Scripting Vulnerability (CNVD-2023-03922)

Apache Traffic Server ATS is a set of scalable HTTP proxy and cache servers from the Apache Foundation. Apache Traffic Server suffers from a cross-site scripting vulnerability that can be exploited by attackers to cause cross-site scripting and cache poisoning attacks...

Buildah has unspecified vulnerabilities

Bulidah is an open source, Linux-based tool from Containers open source. It is used to build containers that are compatible with the Open Container Initiative OCI.Containers Buildah suffers from a security vulnerability. An attacker could exploit the vulnerability to cause local path and...

Insyde InsydeH2O Buffer Overflow Vulnerability

Insyde InsydeH2O is a C language source from Insyde Taiwan, China that implements the new technology "EFI/UEFI" specification, designed to replace the traditional BIOS Basic Input/Output System. Insyde A buffer overflow vulnerability exists in InsydeH2O 5.0 and later, 5.5 and earlier versions,...

OpenSSL Denial of Service Vulnerability (CNVD-2022-73349)

OpenSSL is a powerful, commercial-grade, full-featured open source toolkit for the Transport Layer Security TLS protocol, which is implemented based on the Full Strength Common Cryptographic Library for protecting communications on computer networks from eavesdropping and is widely used by Intern...

Democritus Project d8s-networking Code Execution Vulnerability

Democritus Project is a collection of simple, effective, modular, well-tested and well-documented features from Democritus. A backdoor vulnerability exists in Democritus Project d8s-networking version 0.1.0, which stems from the presence of a potential code execution package democritus-hashes...

Democritus Project d8s-xml Code Execution Vulnerability

Democritus Project is a collection of simple, effective, modular, well-tested and well-documented features from Democritus. A code execution vulnerability exists in Democritus Project d8s-xml version 0.1.0, which stems from the presence of a potential code execution package democritus-html insert...

SAP 3D Visual Enterprise Author .dxf Denial of Service Vulnerability

SAP 3D Visual Enterprise Author is a desktop application for managing 2D, 3D, animation, video and audio assets from SAP. A denial of service vulnerability exists in SAP 3D Visual Enterprise Author version 9, which stems from a lack of proper memory management and can be exploited by an attacker ...

SAP 3D Visual Enterprise Viewer .jt Buffer Overflow Vulnerability

SAP 3D Visual Enterprise Viewer is a 3D view viewer from SAP, Germany. The software supports the publishing of 2D and 3D scenes in all industry-standard desktop applications and supports separate installation as a stand-alone executable program and ActiveX space. A buffer overflow vulnerability...

Google Chrome Survey Memory Misreference Vulnerability

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in versions of Google Chrome prior to 106.0.5249.62, which stems from a confusion in the instructions responsible for freeing memory in Survey. An attacker could exploit the vulnerability t...

ZFile arbitrary file upload vulnerability

ZFile is a Java-based online web development program open-sourced by zfile-dev. ZFile v4.1.1 contains an arbitrary file upload vulnerability that stems from a lack of validation of uploaded files in its component /file/upload/1. An attacker could exploit this vulnerability to upload malicious fil...

Google TensorFlow Denial of Service Vulnerability (CNVD-2023-10600)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A denial-of-service vulnerability exists in Google TensorFlow, which stems from the fact that when AudioSummaryV2 receives an input samplerate containing multiple elements, it gives an assertion failure...

Siemens RUGGEDCOM ROS Denial of Service Vulnerability

Siemens RuggedCom ROS is an operating system used in the RuggedCom family of switches from Siemens, Germany. Siemens RUGGEDCOM ROS suffers from a denial-of-service vulnerability that could be exploited by an attacker to create a denial-of-service condition that lasts until the end of the attack...

Helm Resource Management Error Vulnerability

Helm is a Kubernetes package manager. Helm version 3.9.3 and earlier are vulnerable to a resource management error that stems from a fuzz test provided by CNCF that identifies input to a function in the strvals package that could cause an out-of-memory panic. No detailed vulnerability details are...

Tenda AC1206 Buffer Overflow Vulnerability (CNVD-2022-78510)

Tenda AC1206 is a wireless through-the-wall king gigabit router from Tenda China. Tenda AC1206 version V15.03.06.23 is vulnerable to a buffer overflow vulnerability caused by incorrect boundary checking of the formSetClientState function. An attacker could exploit this vulnerability to overflow t...

Adobe Acrobat and Adobe Acrobat Reader Buffer Overflow Vulnerability

Adobe Acrobat and Adobe Acrobat Reader are both products of the United States Ordoby Adobe.Adobe Acrobat is a set of PDF file editing and conversion tools.Adobe Acrobat Reader is a PDF viewer. The software is used to print, sign and annotate PDF. Adobe Acrobat and Adobe Reader has a buffer overfl...

yasm find_cc function denial of service vulnerability

yasm is yasm open source a completely rewritten Netwide assembler. A denial of service vulnerability exists in yasm version 1.3.0, which stems from the presence of a NULL pointer dereference in the findcc function in modules/preprocs/nasm/nasm-pp.c. An attacker could exploit this vulnerability to...

Oracle Solaris Denial of Service Vulnerability (CNVD-2022-54629)

Oracle Solaris is a set of UNIX operating systems from Oracle. A denial of service vulnerability exists in the Filesystem component of Oracle Solaris 11. An attacker could exploit this vulnerability to corrupt Oracle Solaris, which could result in unauthorized updates, insertions, or deletions of...

Siemens PADS Standard/Plus Viewer越界读取漏洞

PADS Standard and Standard Plus provide PCB schematic design and layout functionality in an intuitive and easy-to-use environment.An out-of-bounds read vulnerability exists in Siemens PADS Standard/Plus Viewer, which could be exploited by an attacker to execute code in the context of the current...

Annotation Tool path traversal vulnerability

Annotation Tool is a Bonn activity map annotation tool open sourced by bonn-activity-maps. 2021-08-31 and earlier versions of Annotation Tool are vulnerable to a path traversal vulnerability that stems from a failure of Flask's sendfile function to properly filter special elements in a resource o...

Vega Charts Kibana Cross-Site Scripting Vulnerability

Vega is a Javscript-based software from the Vega team that can be used to create interactive visual displays. The software can use JSON format to describe the data visualization and use HTML5 Canvas or SVG to generate interactive views. A cross-site scripting vulnerability exists in Vega Charts...