WordPress wpDataTables Lite plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. wpDataTables Lite is a chart management plugin used in it. A cross-site scripting vulnerability exists in WordPress wpDataTables Lite...

Domoticz SQL Injection Vulnerability

Domoticz is an open source smart home system. The system supports monitoring and controlling a wide range of smart home devices. A SQL injection vulnerability exists in Domoticz versions prior to 4.10578, which stems from a lack of validation of externally entered SQL statements in database-based...

Netatalk Out-of-Bounds Write Vulnerability

Netatalk is a server for providing Appletalk network protocol services on the Linux platform. An out-of-bounds write vulnerability exists in the dsiopensess.c file in versions prior to Netatalk 3.1.12, which stems from the program's failure to perform a boundary check on attacker-controlled data...

nginx denial of service vulnerability (CNVD-2018-22805)

nginx is a lightweight web server/reverse proxy server and email IMAP/POP3 proxy server. A security vulnerability exists in the HTTP/2 implementation of nginx versions prior to 1.15.6 and 1.14.1. An attacker can exploit the vulnerability to consume a large amount of memory space...

Cisco Webex Meetings Desktop App Update Service Command Injection Vulnerability

Cisco WebEx Meetings are web conferencing solutions. A command injection vulnerability exists in the Cisco Webex Meetings Desktop App Update Service due to insufficient validation of user-supplied parameters. An attacker exploiting this vulnerability could invoke the update service command by usi...

Red Hat OpenShift Container Platform Denial of Service Vulnerability

Red Hat OpenShift Container Platform is an application platform from Red Hat that enables organizations to develop, deploy and manage existing container-based applications across physical, virtual and public cloud infrastructures. A denial of service vulnerability exists in Red Hat OpenShift...

Simple DirectMedia Layer SDL2_image Double Release Vulnerability

Simple DirectMedia Layer is a multi-platform library for accessing low-level hardware and graphics and providing support for games, software, and emulators. sdl2image is a component used in it for parsing and displaying various image file formats. A double release vulnerability exists in the XCF...

Artifex Software MuPDF and Ghostscript Artifex jbig2dec Denial of Service Vulnerability

Artifex Software Ghostscript and MuPDF are both products of the United States Artifex Software. Artifex Ghostscript is an open source PostScript parser; MuPDF is a free, lightweight PDF reader. jbig2dec is an for Ghostscript and MuPDF in the decoding of PDF files in the JBIG2 stream implementatio...

Apache Tika Remote Code Execution Vulnerability

Apache Tika is the United States Apache Apache Software Foundation, an integrated POI using Java programs to provide read and write Microsoft Office format documents open-source library, Pdfbox read and create PDF documents pure Java class library and for text extraction work provides a unified...

Multiple Vulnerabilities in OpenStack Object Storage

OpenStack is a cloud platform management program developed by the National Aeronautics and Space Administration in collaboration with Rackspace in the U.S. OpenStack Object Storage a.k.a. Swift is one of these programs used to storage project for storing permanent static data. A security...

IPsec-Tools IKE Daemon Remote Denial of Service Vulnerability

IPsec-Tools is a user-space implementation of different IPSecs ported from KAME's libipsec, setkey and racoon, and supports various BSD systems. A null pointer reference error in the IPsec-Tools 'gssapiinit' function src/racoon/gssapi.c allows a remote attacker to submit special UDP packets that...

Google Chrome TextEncoding Resource Management Error Vulnerability

Google Chrome is a free web browser developed by Google Inc. A security vulnerability exists in Google Chrome TextEncoding, which originates from re-referencing or using freed memory, and can be exploited by remote attackers to execute arbitrary code...

JetBrains TeamCity Cross-Site Scripting Vulnerability

JetBrains TeamCity is a Continuous Integration CI/CD tool developed by JetBrains, Inc. to automate the software build, test and deployment process. JetBrains TeamCity suffers from a cross-site scripting vulnerability that stems from the presence of reflective cross-site scripting on the...

HDF5 Buffer Overflow Vulnerability (CNVD-2025-16249)

HDF5 is a data management suite developed by The HDF Group for storing and managing large-scale scientific data. A security vulnerability exists in the H5Omtimenewencode function in the src/H5Omtime.c file of HDF5 version 1.14.6, which stems from improper handling of data boundaries. An attacker...

Fortinet FortiPortal Log Message Disclosure Vulnerability

Fortinet FortiPortal is an advanced, feature-rich hosted security analysis and management support tool for Fortinet's FortiGate, FortiWiFi and FortiAP product lines, available as a virtual machine for MSPs. Fortinet FortiPortal suffers from a log information disclosure vulnerability that originat...

Mattermost Permission Issues Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a privilege issue vulnerability that stems from insufficient privilege validation, which can be exploited by an attacker to access team invitation IDs...

Adobe Photoshop Digital Error Vulnerability (CNVD-2025-24445)

Adobe Photoshop is a set of image processing software from the American company Audobee Adobe. The software is mainly used for processing pictures. Adobe Photoshop suffers from a numeric error vulnerability that can be exploited by an attacker to cause arbitrary code to be executed in the current...

Delta Electronics CNCSoft-G2 Out-of-Bounds Write Vulnerability

Delta Electronics CNCSoft-G2 is a human-machine interface HMI software from Delta Electronics, China. Delta Electronics CNCSoft-G2 suffers from an out-of-bounds write vulnerability that can be exploited by an attacker to execute code in the context of the current process...

Ivanti EPM SQL Injection Vulnerability

Ivanti EPM is a one-stop shop for managing user profiles and all client devices from Ivanti USA. An SQL injection vulnerability exists in Ivanti EPM 2022 SU5 and prior versions, which can be exploited by an attacker to execute arbitrary code...

Stack buffer overflow vulnerability in libigl readOFF.cpp function

libigl is libigl open source a simple C++ geometry processing library . A stack buffer overflow vulnerability exists in the libigl readOFF.cpp function. The vulnerability is caused by incorrect boundary checking of the readOFF function. An attacker can exploit this vulnerability to cause a buffer...

Tenda W30E fromRouteStatic function buffer overflow vulnerability

The Tenda W30E is a router from the Chinese company Tenda. A buffer overflow vulnerability exists in Tenda W30E version 1.0.1.25633, which originates from the parameter page of the fromRouteStatic function in /goform/fromRouteStatic that fails to correctly validate the length of the input data, a...

Unspecified Vulnerability in Oracle VM VirtualBox (CNVD-2024-20437)

Oracle Virtualization and Oracle VM VirtualBox are both products of Oracle Corporation.Oracle Virtualization is a suite of virtualization solutions. The product is used to unify the management of the entire hardware and software system from the application to the disk, can be achieved from the...

IBM Security verify Access Appliance Security Vulnerability

IBM Security Verify Access ISAM is a service from International Business Machines IBM that improves user access security. The service enables secure and simple access to platforms such as web, mobile, IoT and cloud technologies through the use of risk-based access, single sign-on, integrated acce...

Scholars Tracking System SQL Injection Vulnerability (CNVD-2024-14045)

Scholars Tracking System is a scholars tracking system by the individual developer Fabian Ros. Scholars Tracking System suffers from a SQL injection vulnerability that can be exploited by an attacker to send crafted SQL statements to Eligibility Information Update...

Apache Answer Cross-Site Scripting Vulnerability

Apache Answer is a community platform of the Apache USA Foundation. Apache Answer 1.2.1 and earlier versions suffer from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data, which can be exploited by an attacker to...

Unspecified vulnerability in wolfSSL (CNVD-2024-37452)

wolfSSL CyaSSL is the United States wolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. A security vulnerability exists in wolfSSL versions prior to 5.6.6, which can be exploited by an attacker to trigger a 5-byte buffer out-of-bounds read...

Adobe Acrobat Reader Input Validation Error Vulnerability (CNVD-2024-12461)

Adobe Acrobat Reader is a PDF viewer from the American company Audobee Adobe. The software is used to print, sign and annotate PDF. An input validation error vulnerability exists in Adobe Acrobat Reader. An attacker could exploit this vulnerability to compromise an affected system...

TP-LINK ER7206 OS Command Injection Vulnerability (CNVD-2024-13527)

The TP-LINK ER7206 is a multi-function Gigabit router from China P&L TP-LINK. An operating system command injection vulnerability exists in the TP-LINK ER7206 version 1.3.0 build 20230322 Rel.70591, which stems from a specially crafted HTTP request that could lead to arbitrary command injection. ...

Siemens Tecnomatix Plant Simulation Buffer Overflow Vulnerability (CNVD-2024-09319)

Tecnomatix Plant Simulation models, simulates, explores and optimizes logistics systems and their processes. These models allow material flow, resource utilization and logistics analysis of all manufacturing plans from global production facilities to local plants and specific production lines pri...

Google Chrome Canvas Module Memory Misreference Vulnerability

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in the Google Chrome Canvas module, which can be exploited by an attacker to execute arbitrary code on a system...

Microsoft Win32K Elevation of Privilege Vulnerability (CNVD-2024-11164)

Microsoft Win32k is a system file for Windows multi-user management from Microsoft USA. An elevation of privilege vulnerability exists in Microsoft Win32K, which can be exploited by an attacker to gain elevated privileges on a system...

Gila CMS Area Parameter SQL Injection Vulnerability

Gila CMS is an open source content management system CMS based on PHP and MySQL. A SQL injection vulnerability exists in Gila CMS 1.15.4 and earlier versions, which stems from the application's lack of validation of externally entered SQL statements. The vulnerability can be exploited by a remote...

Apache Airflow Security Bypass Vulnerability (CNVD-2024-0101523)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A security bypass vulnerability exists in Apache Airflow versions prior to 2.8.0,...

Hitachi Energy RTU500 Scripting interface Trust Management Issue Vulnerability

RTU500 is a series of industrial control components from Hitachi, Japan, mainly used for industrial control systems.RTU500 Scripting interface is part of Hitachi Energy RTU500 series of industrial control components, mainly used to provide scripting programming interface to realize specific...

Adobe InDesign Code Issues Vulnerabilities

Adobe InDesign is a set of layout and editing applications from the American company Audobee Adobe. Adobe InDesign has a security vulnerability that can be exploited by attackers to cause a denial of service...

Apache Superset Cross-Site Scripting Vulnerability (CNVD-2023-9665948)

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. A cross-site scripting vulnerability exists in Apache Superset versions prior to 2.1.2, which stems from the presence of incorrect payload validation and incorrect REST API response type issues. ...

Microsoft Windows Layer 2 Tunneling Protocol Remote Code Execution Vulnerability (CNVD-2023-81880)

Microsoft Windows is a set of operating systems for use on personal devices from the American company Microsoft. A remote code execution vulnerability exists in the Microsoft Windows Layer 2 Tunneling Protocol, which can be exploited by an attacker to remotely execute code...

Mozilla Firefox ImageBitmap Post-Release Use Vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A post-release use vulnerability exists in Mozilla Firefox ImageBitmap on process shutdown, which can be exploited by a remote attacker to submit a special Web request, tricking the user into parsing i...

Rockwell Automation Pavilion8 License Issue Vulnerability

Rockwell Automation Pavilion8 is a model prediction console from Rockwell Automation. Rockwell Automation Pavilion8 suffers from an authorization issue vulnerability that stems from the fact that the JMX Console is publicly available to users and does not require authentication. An attacker could...

FreeImage LoadPixelDataRLE8 function buffer overflow vulnerability

FreeImage is a cross-platform open source library for supporting popular graphic image formats. A buffer overflow vulnerability exists in the FreeImage LoadPixelDataRLE8 function, which can be exploited by an attacker to execute arbitrary code on a system or cause a denial of service attack...

FreeImage ofLoad function buffer overflow vulnerability

FreeImage is a cross-platform open source library for supporting popular graphic image formats. A buffer overflow vulnerability exists in the FreeImage ofLoad function, which can be exploited by an attacker to execute arbitrary code on a system or cause a denial of service attack...

Milesight UR32L vtysh_ubus tcpdump_start_cb function command injection vulnerability

The Milesight UR32L is a 4G industrial router from China's Milesight. A command injection vulnerability exists in the Milesight UR32L vtyshubus tcpdumpstartcb function, which can be exploited by an attacker to execute arbitrary commands on the system...

Apache OFBiz Path Traversal Vulnerability

Apache OFBiz is the United States Apache Apache Foundation of a set of enterprise resource planning ERP system. The system provides a set of Java-based Web application components and tools. Apache OFBiz suffers from a path traversal vulnerability that stems from the application failing to properl...

D-Link DIR-867 Command Injection Vulnerability

The D-Link DIR-867 is a wireless router from China Youxun D-Link.A command injection vulnerability exists in the D-Link DIR-867, which is caused by a command injection vulnerability in the SetVirtualServerSettings function. By sending a carefully crafted request using the LocalIPAddress parameter...

Fortinet FortiWeb OS Command Injection Vulnerability (CNVD-2023-18291)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. An operating system command injection...

Adobe Acrobat and Reader Buffer Overflow Vulnerability (CNVD-2023-51685)

Adobe Acrobat Reader is the United States of America Audobee Adobe, a PDF viewer. A buffer overflow vulnerability exists in Adobe Acrobat and Reader, which can be exploited by an attacker to execute arbitrary code in the context of the current user...

Siretta QUARTZ-GOLD OS Command Injection Vulnerability (CNVD-2023-17093)

Siretta QUARTZ-GOLD is a high-speed dual-port Gigabit Ethernet industrial router from Siretta.The Siretta QUARTZ-GOLD is vulnerable to an operating system command injection vulnerability that could be exploited by an attacker to cause arbitrary command execution by sending a crafted network reque...

phpMyFAQ cross-site scripting vulnerability (CNVD-2023-04313)

phpMyFAQ is a multi-language, fully database-driven FAQ system. A cross-site scripting vulnerability exists in versions prior to phpMyFAQ 3.1.10, which stems from the presence of stored cross-site scripting XSS. No details of the vulnerability are provided at this time...

Mozilla Firefox Trust Management Issue Vulnerability (CNVD-2023-05204)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the U.S. Mozilla Firefox is vulnerable to trust management issues, which can be exploited by attackers to read and modify data...

TRENDnet TEW-755AP stack overflow vulnerability (CNVD-2023-18948)

The TRENDnet TEW-755AP is a router from TRENDnet. The TRENDnet TEW-755AP suffers from a stack overflow vulnerability that stems from a lack of size checking of input data in the REMOTEUSER parameter of the getaccess sub45AC2C function, which can be exploited by an attacker to execute arbitrary co...