Microsoft Web Media Extensions Remote Code Execution Vulnerability (CNVD-2021-101708)

The Web Media Extensions package extends Microsoft Edge and Windows 10 to support open source formats commonly found on the Web.A remote code execution vulnerability exists in Microsoft Web Media Extensions. An attacker could exploit this vulnerability to execute code on the target host...

GNOME Web Cross-Site Scripting Vulnerability

GNOME Web Epiphany is a Web browser based on the WebKit rendering engine. The product provides paginated browsing, cookie management, pop-up ad control, etc. GNOME Web has a cross-site scripting vulnerability that can be exploited by attackers to conduct exploit attacks via false pages...

Fortinet FortiClientEms Information Disclosure Vulnerability

Fortinet FortiClientEms is a centralized central management system from Fortinet, Inc. An information disclosure vulnerability exists in Fortinet FortiClientEms, which stems from a lack of encryption of sensitive data in FortiClientEMS. An authenticated attacker could view sensitive information i...

Google TensorFlow Input Validation Error Vulnerability (CNVD-2022-09874)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow suffers from an input validation error vulnerability that can be exploited by an attacker to cause an abort and denial of service related to a CHECK failure...

Lantronix PremierWave 2050 OS Command Injection Vulnerability

The Lantronix PremierWave 2050 is an embedded enterprise Wi-Fi module from Lantronix, Inc. The Lantronix PremierWave 2050 in version 8.9.0.0R4 is vulnerable to OS command injection, which stems from a Web Manager Diagnostics:Ping feature that fails to properly filter special characters, commands,...

Siemens SIMATIC PCS 7 and SIMATIC WinCC Path Traversal Vulnerability (CNVD-2021-89422)

Siemens SIMATIC PCS 7 and SIMATIC WinCC are both products of Siemens, a German company. SIMATIC PCS 7 is a process control system and SIMATIC WinCC is an automated data acquisition and monitoring SCADA system. A path traversal vulnerability exists in SIMATIC PCS 7 and SIMATIC WinCC. The...

Incorrect Input Validation Vulnerability in Multiple Siemens Products

Capital VSTAR is a complete solution. the Nucleus NET module integrates a range of standards-compliant networking and communications protocols, drivers and utilities to provide full-featured networking support in any embedded device. the Nucleus RTOS is a microkernel-based real-time operating...

OSIsoft PI Server Cross-Site Scripting Vulnerability

Osisoft OSIsoft PI is a commercial software application platform based on the Ckient/Server architecture from OSIsoft Osisoft, USA. The platform supports data collection, analysis and visualization, etc. A security vulnerability exists in OSIsoft PI Server, which can be exploited by remote...

Microsoft Azure Sphere Information Disclosure Vulnerability (CNVD-2021-93635)

Microsoft Azure Sphere is a security vulnerability in Microsoft Azure Sphere, an appliance used by Microsoft to provide security in cloud environments. No details of the vulnerability are currently available...

Google TensorFlow Heap Out-of-Bounds Access Vulnerability (CNVD-2021-85883)

Google TensorFlow, an end-to-end open source machine learning platform, suffers from a heap out-of-bounds access vulnerability in the SparseBinCount implementation in versions prior to TensorFlow 2.7.0. The vulnerability stems from missing validation between the elements of the values parameter a...

Adobe Audition Arbitrary Code Execution Vulnerability (CNVD-2022-00591)

Adobe Audition is an audio editor and post-production suite. Adobe Audition 14.4 and earlier versions contain an arbitrary code execution vulnerability that could be exploited by attackers to execute arbitrary code...

openSIS SQL Injection Vulnerability (CNVD-2021-101542)

openSIS is a free, open source student information system/school management software. A SQL injection vulnerability exists in ForgotPassUserName.php in openSIS Community Edition version 8.0. An attacker can exploit this vulnerability to obtain sensitive database information...

Google Chrome Heap Buffer Overflow Vulnerability (CNVD-2021-84817)

Chrome is a web browsing tool developed by Google. a heap buffer overflow vulnerability exists in WebRTC in versions prior to Google Chrome 94.0.4606.81. An attacker could exploit this vulnerability to exploit heap corruption via a crafted HTML page...

Mozilla Rust Command Injection Vulnerability (CNVD-2021-85291)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. Mozilla Rust is vulnerable to a command injection vulnerability that can be exploited by attackers to cause memory corruption...

FAAD2 Stack Buffer Overflow Vulnerability (CNVD-2021-89950)

Freeware Advanced Audio Decoder 2 FAAD2 is an open source MPEG-4 and MPEG-2 AAC decoder licensed under the GPLv2 license. a stack buffer overflow vulnerability exists in the ftypin function in mp4read.c in FAAD2 2.10.0 and earlier versions. An attacker could exploit this vulnerability to execute...

Mozilla Rust Command Injection Vulnerability (CNVD-2021-85288)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. Mozilla Rust is vulnerable to a command injection vulnerability that can be exploited by attackers to cause memory corruption...

fig2dev stack buffer overflow vulnerability

fig2dev is used to convert .fig files to various graphics languages and formats. A stack buffer overflow vulnerability exists in the readtextobject function in read.c in fig2dev version 3.2.7b. No detailed vulnerability details are currently available...

WordPress Plugin Cross-Site Scripting Vulnerability (CNVD-2021-94153)

WordPress is a PHP, MySQL and JavaScript based project and uses Node as its JavaScript dependency. A native development environment is available for getting up and running quickly. An XSS vulnerability exists in WordPress in version 5.8 beta 1, which is related to the affected version not properl...

Mozilla Rust Memory Corruption Vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in Rust im crate through 2020-11-09, which stems from a limitation that TreeFocus does not have a send feature or a synchronization feature, resulting in a data contention...

Matrix Information Breach Vulnerability

Matrix is an ambitious new ecosystem for open federated instant messaging and VoIP. Matrix suffers from an information disclosure vulnerability that stems from the product not doing valid authentication of access user privileges. An attacker could access members' sensitive information via another...

Exiv2 infinite loop vulnerability (CNVD-2021-61796)

Exiv2 is a cross-platform C++ library and command line utility for managing image metadata. An infinite loop vulnerability exists in Exiv2 0.27.4 and earlier versions. An attacker could exploit this vulnerability to cause a denial of service via a specially crafted image file...

Liferay Portal and Liferay DXP code issue vulnerability

Liferay Portal and Liferay DXP are both products of Liferay, a J2EE-based portal solution that uses EJB and JMS technologies and serves as a web publishing and shared workspace, enterprise collaboration platform, social network, etc. Liferay DXP is a digital experience collaboration platform...

Nexus Control Panel Buffer Overflow Vulnerability

Swisslog Healthcare Nexus Panel, a medical device from Swisslog Healthcare, is vulnerable to an integer underflow vulnerability in versions prior to Nexus Control Panel 7.2.5.7. An attacker could use this vulnerability to override the internal queue data structure, which could enable remote code...

Foxit PDF Reader Post-release Reuse Vulnerability (CNVD-2021-79774)

Foxit PDF Reader formerly known as Foxit Reader is a set of software used to read PDF format files, developed by Foxit Software Fujian. The vulnerability stems from not verifying the existence of the object before performing operations on it. An attacker could exploit this vulnerability to execut...

GPAC MP4Box code issue vulnerability

GPAC MP4Box is a multimedia packager. It is mainly used to process ISOBMF files e.g. MP4, 3GP, but can also be used to import/export media from AVI, MPG, MKV, MPEG-2 TS and other container files.GPAC MP4Box version 0.8.0 has a security vulnerability, which stems from an issue found in...

Atlassian JIRA Server Cross-Site Scripting Vulnerability (CNVD-2021-55940)

Atlassian JIRA Server is the server version of a defect tracking management system from Atlassian Australia. The system is mainly used for tracking and managing various types of problems and defects in work. A cross-site scripting vulnerability exists in Atlassian JIRA Server, which can be...

Adobe Character Animator Memory Out-of-Bounds Access Vulnerability

Adobe Character Animator is a motion capture and animation tool that provides everyone with an easy-to-use solution for intuitive 2D character animation, real-time animation, and easy sharing and publishing of characters. A memory out-of-bounds access vulnerability exists in Adobe Character...

NVIDIA GeForce Experience Cross-Site Scripting Vulnerability

NVIDIA GeForce Experience is a set of automatic graphics card update tools from Nvidia Corporation. A cross-site scripting vulnerability exists in NVIDIA GeForce Experience, which could be exploited by attackers to trick users into clicking on a maliciously formatted link in their browser and...

Unspecified Vulnerability in JerryScript (CNVD-2021-42991)

JerryScript is a lightweight JavaScript engine . A security vulnerability exists in parserparsefunctionarguments in /home/JerryScript/jerry-core/parser/js/js-parser.c in JerryScript version 2.2.0. No details of the vulnerability are provided at this time...

Unspecified vulnerability in Genvini dlt-daemon

Genvini Dlt-daemon is a Genvini organization's software for logging and tracing. The software provides a logging and tracing interface using the standardized protocols specified in the AUTOSAR Standard 4.0 DLT, and is used as a logging framework in some programs. A security vulnerability exists i...

Google TensorFlow unicode ops heap out-of-bounds access vulnerability

Google TensorFlow is an end-to-end open source machine learning platform. A heap out-of-bounds access vulnerability exists in Google TensorFlow unicode ops. An attacker can exploit the vulnerability to access data outside of heap allocation array boundaries in tf.raw\u ops.unicodeNCode...

Amazon FreeRTOS integer overflow vulnerability (CNVD-2021-31956)

Amazon FreeRTOS is an open source operating system for microcontrollers from Amazon USA. An integer overflow vulnerability exists in queue.c in Amazon FreeRTOS versions prior to 10.4.3. No details of the vulnerability are provided at this time...

Jenkins Matrix Authorization Strategy Access Control Error Vulnerability

Jenkins Matrix Authorization Strategy is a Jenkins open source application plugin . The plug-in in Jenkins to achieve fine-grained access control . An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows attackers with Item/Read permissions to nested...

Schneider Electric Interactive Graphical SCADA System缓冲区溢出漏洞（CNVD-2022-13075）

Schneider Electric Interactive Graphical SCADA System IGSS is a SCADA data acquisition and monitoring system system for monitoring and controlling industrial processes from Schneider Electric, a French company. Electric Interactive Graphical SCADA System is vulnerable to a buffer overflow...

SaltStack Salt Command Injection Vulnerability (CNVD-2021-15056)

SaltStack Salt is a new way to manage infrastructure, easy to deploy, up and running in minutes, scales well, easily manages tens of thousands of servers, and is fast enough to communicate between servers in seconds. SaltStack Salt A command injection vulnerability exists in the restart check for...

Unspecified Vulnerability in Rust (CNVD-2021-13698)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in Rust glsl-layout crate before 0.4.0, which stems from double deletion of maparray when panic occurs. No details of the vulnerability are provided at this time...

Microsoft Windows/Windows Server Elevation of Privilege Vulnerability (CNVD-2021-90796)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, an operating system for personal devices, and Microsoft Windows Server, a server operating system. An elevation of privilege vulnerability exists in the Common Log File System driver in Microsoft...

GitLab Privilege Control Error Vulnerability

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. A privilege control error vulnerability exists in GitLab 11.2 and later versions, which can be...

phpMyAdmin cross-site scripting vulnerability (CNVD-2021-45285)

phpMyAdmin is a PHP written, Web-based MySQL and MariaDB open source management tools. A cross-site scripting vulnerability exists in the conversion function in phpMyAdmin. An attacker can exploit this vulnerability to execute malicious JavaScript via a specially crafted link...

Mozilla Rust Input Validation Error Vulnerability

Rust is a general-purpose, compiled programming language. An input validation error vulnerability exists in Mozilla Rust version 0.6.2, which originates in the nonlinearray implementation and can be exploited by an attacker to generate unaligned references for types with large alignment...

Palo Alto Networks PAN-OS Management Interface Command Injection Vulnerability

Palo Alto Networks PAN-OS is a set of operating systems developed for its firewall appliances. An OS command injection vulnerability exists in the Palo Alto Networks PAN-OS management interface that could be exploited by an attacker to execute arbitrary operating system commands...

Microsoft Windows/Windows Server Elevation of Privilege Vulnerability (CNVD-2021-90801)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation USA.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. An elevation of privilege vulnerability exists in Microsoft Windows/Windows Server. Th...

CloudBees Jenkins Fortify on Demand Plugin Authorization Issue Vulnerability

CloudBees Jenkins Hudson Labs is a set of Java-based continuous integration tools from CloudBees. The product is mainly used to monitor the continuous software version of the release/testing project and some timed tasks . Fortify on Demand Plugin is used in one of the support for uploading code...

IBM Spectrum Protect Plus Command Injection Vulnerability

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A command injection vulnerability exists in...

Netis WF2419 Remote Code Execution Vulnerability

The Netis WF2419 is a 300Mbps wireless router. A remote code execution vulnerability exists in Netis WF2419 1.2.31805, 2.2.36123. The vulnerability stems from a lack of validation of user input. An authenticated attacker can exploit this vulnerability to execute system commands as root via a web...

TYPO3 Path Traversal Vulnerability

TYPO3 is a free and open source content management system written in PHP under the GNU General Public License. A path traversal vulnerability exists in the extraction of manually uploaded ZIP archive files in Extension Manager in TYPO3 versions prior to 8.7.30, 9.x versions prior to 9.5.12, and...

Unspecified Vulnerabilities in NVIDIA GPUModeSwitch Tool and NVIDIA NVFlash

NVIDIA NVFlash and GPUModeSwitch Tool are both products of NVIDIA Corporation.NVIDIA NVFlash is a tool for flashing the BIOS firmware of NVIDIA graphics cards.GPUModeSwitch Tool is an NVIDIA GPU mode change utility program. A security vulnerability exists in NVIDIA GPUModeSwitch Tool and NVIDIA...

Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CNVD-2019-27086)

Edge is Microsoft's browser for Windows 10, characterized by fast and secure.ChakraCore is a Microsoft open source, efficient JS scripting engine for Windows IE/Edge kernel. A memory corruption vulnerability exists in Microsoft Edge. The vulnerability stems from a problem with the way the Chakra...

LIVE555 Buffer Overflow Vulnerability

LIVE555 is a set of open source C++ libraries for multimedia streaming. Live555 suffers from a buffer overflow vulnerability. The vulnerability stems from handleRequestBytes having an unrestricted memmove, which can be exploited to cause a denial of service via a large integer in the Content-Leng...

Apache OpenOffice Integer Overflow Vulnerability

Apache OpenOffice is the United States Apache Apache Software Foundation of an open source office software suite. The suite contains text documents, spreadsheets, presentations, drawings, databases and so on. An integer overflow vulnerability exists in Apache OpenOffice, which can be exploited by...