GPAC Denial of Service Vulnerability (CNVD-2022-59871)

GPAC is a multimedia framework. GPAC MP4Box version 1.1.0 suffers from a denial of service vulnerability that originates in the gfhintertrackfinalize function. An attacker could exploit this vulnerability to cause a denial of service via a specially crafted file in the MP4Box command...

Mozilla Firefox Remote Code Execution Vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A remote code execution vulnerability exists in Mozilla Firefox due to a lack of restriction and filtering of extensions in the drag-and-drop image feature. The vulnerability can be exploited to execut...

JerryScript memory mis-reference vulnerability

JerryScript is a lightweight JavaScript engine from the Jerryscript project. version 2.4.0 of JerryScript is vulnerable to a memory misquoting vulnerability that originates in ecma-helpers- in ecmacompareecmanondirectstrings. string.c:1940, which is responsible for freeing memory, is garbled. An...

Cisco Identity Services Engine授权问题漏洞

Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The platform oversees networks by collecting real-time information from networks, users, and devices to develop and implement appropriate policies.The Cisco Identity Services Engine is...

WordPress Google Places Reviews plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress Note Press plugin SQL injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Note Press plugin 0.1.10 and earlier versions are vulnerable to SQL injection, which stems...

Elitecms SQL Injection Vulnerability

Elitecms is a web content management from elitecms India. elitecms version 1.01 is vulnerable to SQL injection, which originates from admin/editsidebar.php?page=2 & sidebar The page sidebar parameter lacks validation for external input SQL statements, and an attacker could exploit the vulnerabili...

Illumina Local Run Manager Information Disclosure Vulnerability

Illumina Local Run Manager is an integrated solution from Illumina, Inc. Designed to create sequencing runs, monitor run status, analyze sequencing data, and view results, Illumina Local Run Manager contains an information disclosure vulnerability that could be exploited by remote attackers to...

Rancher Labs Rancher Sensitive Data Encryption Missing Vulnerability

Rancher Labs Rancher is an open source, enterprise-class container management platform from Rancher Labs, Inc. Rancher Labs Rancher is vulnerable to a sensitive data encryption miss vulnerability, which stems from the presence of sensitive data encryption misses. An attacker could exploit this...

Publify arbitrary file upload vulnerability

Publify is a simple but full-featured web publishing software.An arbitrary file upload vulnerability exists in versions of Publify prior to 9.2.9, which stems from the application's lack of validation of uploaded files. An attacker could exploit this vulnerability to upload malicious files to...

Pix-Link MiniRouter 28K.MiniRouter.20190211 Cross-Site Scripting Vulnerability (CNVD-2022-77885)

Pix-Link MiNi Router 28K.MiniRouter.20190211 is a router from Pix-Link China.Pix-Link MiniRouter 28K.MiniRouter.20190211 suffers from a cross-site scripting vulnerability, which stems from an unhandled security key parameter. An attacker could exploit the vulnerability to execute JavaScript code ...

InHand Networks InRouter302硬编码凭证漏洞

InHand Networks InRouter Series is a series of routers from InHand Networks, Inc. InHand Networks InRouter302 version 3.5.37 contains a hard-coded credential vulnerability that could be exploited by an attacker to send specially crafted network requests that could lead to the execution of...

FacturaScripts Cross-Site Scripting Vulnerability (CNVD-2022-76230)

FacturaScripts is an ERP software. cross-site scripting vulnerability exists in versions prior to FacturaScripts 2022.07, which can be exploited by attackers to execute arbitrary javascript code, steal user cookies, execute HTTP requests, obtain "same-origin " page content, etc...

HUAWEI HarmonyOS Resource Management Error Vulnerability (CNVD-2022-53578)

HUAWEI HarmonyOS is an operating system from the Chinese company Huawei HUAWEI. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in the HUAWEI HarmonyOS kernel that stems from a use-after-release vulnerability in a kernel module, whi...

USU Oracle Optimization Command Injection Vulnerability

USU Oracle Optimization is used to improve the performance of Oracle queries. command injection vulnerability exists in versions of USU Oracle Optimization prior to 5.17.5. The vulnerability stems from the fact that some common OS commands are blocked, but OS commands for base64 decoding are not...

WordPress插件Users Ultra SQL注入漏洞

WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin Users Ultra has a SQL injection vulnerability, which stems from the inability to properly clean and escape the datatarget...

Microsoft Windows Print Spooler Elevation of Privilege Vulnerability (CNVD-2022-84119)

Microsoft Windows is an operating system used for personal devices, Microsoft Windows Server is a server operating system, and Windows Print Spooler is a print backend processor that is vulnerable to an elevation-of-privilege vulnerability that could be exploited to execute arbitrary code with...

livehelperchat Cross-Site Scripting Vulnerability (CNVD-2022-71405)

livehelperchat is available via livehelperchat, which provides free live support on the website. livehelperchat versions prior to 3.97 are vulnerable to a cross-site scripting vulnerability that originates in the GitHub repository livehelperchat/livehelperchat in livehelperchat An XSS vulnerabili...

Zoho ManageEngine ADAudit Plus Remote Code Execution Vulnerability

Zoho ManageEngine Adaudit Plus, from Zoho Corporation, is used to simplify auditing, prove compliance, and detect threats. remote code execution vulnerability exists in versions of Zoho ManageEngine ADAudit Plus prior to 7060, which can be exploited by unauthenticated attackers to remote code...

WordPress CleanTalk plugin cross-site scripting vulnerability (CNVD-2022-67605)

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress plugin is a WordPress application plugin. WordPress CleanTalk plugin 5.173 and earlier versions have a cross-sit...

Jenkins Proxmox Plugin Information Disclosure Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.Jenkins Proxmox Plugin 0.5.0 and earlier...

TOTOLINK N600R Command Injection Vulnerability (CNVD-2022-53561)

TotoLink N600R is a wireless router from TotoLink, a Taiwan-based company. TotoLink N600R is vulnerable to command injection, which can be exploited by attackers via the pingCheck function...

WordPress miniOrange's Google Authenticator plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the Wordpress Foundation using the PHP language. WordPress plugin is a WordPress application plugin. WordPress miniOrange's Google Authenticator plugin version 5.5 or earlier is vulnerable to a cross-site request forgery vulnerability that stems from...

MIcrosoft Windows CD-ROM Driver Elevation of Privilege Vulnerability

Microsoft Windows is a CD-ROM driver from Microsoft Corporation, and an elevation of privilege vulnerability exists in the Microsoft Windows CD-ROM Driver, which could be exploited by attackers to execute arbitrary code with elevated privileges...

Subrion CMS Cross-site Request Forgery Vulnerability (CNVD-2022-20162)

Subrion CMS is a PHP-based content management system CMS from the Subrion team. The system can be integrated into websites and supports multiple extension plugins, etc. A security vulnerability exists in Subrion CMS 4.2.1, which allows a remote, unauthenticated, malicious user to send authorizati...

Jenkins GitLab Authentication Plugin User Redirection Vulnerability

Jenkins is a Jenkins open source application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.A user redirection vulnerability exists in Jenkins GitLab Authentication Plugin 1.13 and earlier versions, which stems fr...

Tp-link TL-WR840N Command Injection Vulnerability

Tp-link TL-WR840N is a wireless router from Tp-link.TP-LINK TL-WR840NES V6.20 180709 is vulnerable due to a lack of filtering and escaping of command parameters in the component oalsetIp6DefaultRoute. No detailed vulnerability details are available at this time...

Tor Browser Information Disclosure Vulnerability

Tor Browser is a browser used to access the Internet anonymously. Tor Browser is vulnerable to an information disclosure vulnerability that could be exploited by attackers to bypass the expected anonymity features and obtain information about the Onion service accessed by local users...

Imagemagick Studio ImageMagick Buffer Overflow Vulnerability (CNVD-2022-20173)

Imagemagick Studio ImageMagick is a set of open source image processing software from ImageMagick Studio Imagemagick Studio, Inc. The software can read, convert, or write images in a variety of formats.ImageMagick suffers from a buffer overflow vulnerability that stems from a heap-based buffer...

Oracle MySQL Cluster Input Validation Error Vulnerability (CNVD-2022-17690)

Oracle MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database developed by Oracle Corporation. Oracle MySQL Cluster is vulnerable to an input validation error, which can be exploited by attackers to execute arbitrary code...

Envoy has an unspecified vulnerability (CNVD-2022-16291)

Envoy is an open source distributed proxy server. Envoy has a security vulnerability that stems from Envoy's internal redirection selection configured for direct response or redirection actions, specifically so that generic routers will have segmentation failures that can be exploited by attacker...

Google TensorFlow numeric error vulnerability (CNVD-2022-14994)

TensorFlow is an end-to-end open source platform for machine learning from Google. Google TensorFlow is vulnerable to a numerical error that could be exploited to crash the TensorFlow process by dividing it by zero...

Google Chrome Security Feature Issue Vulnerability (CNVD-2022-20551)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a security signature issue vulnerability that can be exploited by attackers to bypass security restrictions...

Samsung Wear Os StTheaterModeReceiver access control error vulnerability

Samsung Wear Os is a version of the Android operating system from South Korea's Samsung Samsung. Versions of Samsung Wear OS prior to 3.0 are vulnerable to an access control error. The vulnerability stems from the lack of protective measures in the vulnerable component, which could be exploited b...

Oracle MySQL Input Validation Error Vulnerability (CNVD-2022-09142)

Oracle MySQL Server is a relational database from Oracle Corporation. An input validation error vulnerability exists in MySQL Server, which originates from an input validation error in the Server: Optimizer component in MySQL Server. An attacker can exploit the vulnerability to corrupt or delete...

phpMyAdmin Authorization Issues Vulnerability

phpMyAdmin is a free, web-based MySQL database management tool from the Phpmyadmin team. The tool is capable of creating and deleting databases, creating, deleting, and modifying database tables, executing SQL script commands, and more. A security vulnerability exists in phpMyAdmin, which stems...

Oracle MySQL Cluster Input Validation Error Vulnerability (CNVD-2022-17692)

Oracle MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database developed by Oracle Corporation USA. Oracle MySQL Cluster is vulnerable to an input validation error that could be exploited by attackers to corrupt or delete data...

JerryScript has an unspecified vulnerability (CNVD-2022-07245)

JerryScript is a lightweight JavaScript engine for the JerryScript Jerryscript project. version 3.0.0 of JerryScript has a security vulnerability, there are no details of the vulnerability provided...

Jenkins batch task Plugin cross-site request forgery vulnerability

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins batch task Plugin 1.19 and earlier versions are vulnerable to cross-site request forgery. An attacker with...

F5 BIG-IP APM Access Control Error Vulnerability (CNVD-2022-26840)

F5 BIG-IP APM is a suite of access and security solutions from F5 USA. The product provides unified access to business-critical applications and networks. F5 BIG-IP APM suffers from an Access Control Error vulnerability that arises from a connection to the BIG-IP Edge Client on Mac and Windows wh...

F5 BIG-IP code issue vulnerability (CNVD-2022-70627)

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. F5 BIG-IP is vulnerable to a code issue that could be exploited by an attacker to cause a denial of service on the BIG-IP...

Expat addBinding function buffer overflow vulnerability

Expat is a fast streaming XML parser written in C. A buffer overflow vulnerability exists in versions of Expat prior to 2.4.3, which stems from a boundary error in the addBinding in xmlparse.c when handling untrusted input. A remote attacker could exploit this vulnerability to execute arbitrary...

Microsoft SharePoint Server Remote Code Execution Vulnerability (CNVD-2022-59594)

Microsoft SharePoint is a suite of enterprise business collaboration platforms from Microsoft Corporation. Microsoft SharePoint Server is vulnerable to a remote code execution vulnerability that could be exploited to execute arbitrary code on the system...

Google Chrome SwiftShader Code Execution Vulnerability (CNVD-2022-65577)

Google Chrome is a web browser from Google, Inc. A code execution vulnerability exists in Google Chrome SwiftShader, which can be exploited by remote attackers to execute arbitrary code on a system or cause a denial of service condition...

Latte Cross-Site Scripting Vulnerability

Latte is a template engine for Nette Foundation's Php. Latte in version 2.8.0 contains a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied data and output. An attacker could exploit this vulnerability to execute JavaScript code on the client...

WordPress LiteSpeed Cache plugin cross-site scripting vulnerability

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in versions of the WordPress LiteSpeed Cache plugin prior t...

Polycom Trio Remote Code Execution Vulnerability

The Polycom Trio is a Trio series of business conference phones from Polycom USA. A remote code execution vulnerability exists in Polycom Trio, which can be exploited by an attacker to execute commands via unspecified vectors...

Mozilla Rust has an unspecified vulnerability (CNVD-2022-03127)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation.A security vulnerability exists in versions of Rust tectonicxdv crate prior to 0.1.12, which stems from XdvParser::::process can read data from uninitialized memory locations. No detailed vulnerability details ar...

Mozilla Rust has an unspecified vulnerability (CNVD-2022-03123)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. a security vulnerability exists in versions of Rust prior to ckb crate 0.40.0, which stems from a failed getblocktemplate RPC call. No details of the vulnerability are currently available...

Bentley View BMP File Parsing Stack Buffer Overflow Vulnerability

Bentley View, a free viewer from Bentley Systems, Inc. A stack buffer overflow vulnerability exists in Bentley View BMP file parsing, which is due to a failure to properly validate the length of user-supplied data before copying it to the heap buffer. An attacker could exploit this vulnerability ...