Lucene search
+L
CnvdMost viewed

131391 matches found

CNVD
CNVD
added 2022/06/02 12:0 a.m.65 views

Mozilla Firefox Buffer Overflow Vulnerability (CNVD-2023-06864)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from a buffer overflow vulnerability that originates from a boundary error when processing HTML content. An attacker could exploit this vulnerability to execute arbitrary code o...

9.8CVSS9.6AI score0.00656EPSS
SaveExploits0References1
CNVD
CNVD
added 2022/05/31 12:0 a.m.65 views

Mini-XML Denial of Service Vulnerability (CNVD-2022-68515)

Mini-XML is a small XML parser developed in C. A denial of service vulnerability exists in Mini-XML v3.2, which stems from the failure to validate input strings in mxmlLoadString and can be exploited by attackers to cause a denial of service...

5CVSS4.6AI score0.01021EPSS
SaveExploits1Affected Software1
CNVD
CNVD
added 2022/05/25 12:0 a.m.65 views

WordPress Imagemap Selector plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress Imagemap Selector plugin, which stems from t...

6.1CVSS1.5AI score0.02176EPSS
SaveExploits1References1
CNVD
CNVD
added 2022/05/24 12:0 a.m.65 views

Cisco Common Services Platform Collector Cross-Site Scripting Vulnerability (CNVD-2022-64191)

Cisco Common Services Platform Collector CSPC is a common services platform data collector from Cisco USA. The product analyzes network performance and identifies risks and vulnerabilities by polling basic inventory and configuration data from Cisco devices.Cisco Common Services Platform Collecto...

6.1CVSS2.5AI score0.0072EPSS
SaveExploits0References1
CNVD
CNVD
added 2022/05/23 12:0 a.m.65 views

Open Policy Agent Denial of Service Vulnerability

Open Policy Agent is a general-purpose policy engine that enables unified, context-aware policy enforcement across the stack. v0.39.0 of Open Policy Agent is vulnerable to a denial-of-service vulnerability that stems from an application misinterpreting each expression, triggering out-of-scope...

5CVSS4AI score0.00999EPSS
SaveExploits0Affected Software1
CNVD
CNVD
added 2022/05/23 12:0 a.m.65 views

Cisco Common Services Platform Collector Cross-Site Scripting Vulnerability (CNVD-2022-64196)

Cisco Common Services Platform Collector CSPC is a common services platform data collector from Cisco USA. The product analyzes network performance and identifies risks and vulnerabilities by polling basic inventory and configuration data from Cisco devices. Information...

6.1CVSS2.4AI score0.0072EPSS
SaveExploits0References1
CNVD
CNVD
added 2022/05/19 12:0 a.m.65 views

Aruba ClearPass Policy Manager Remote Command Injection Vulnerability (CNVD-2022-55532)

Aruba ClearPass Policy Manager is an application from Aruba, Inc. that provides a wireless network security access management system. A remote command injection vulnerability exists in the web management interface of Aruba ClearPass Policy Manager versions 6.10.4 and earlier, 6.9.9 and earlier, a...

9.1CVSS9.5AI score0.02171EPSS
SaveExploits0References1
CNVD
CNVD
added 2022/05/16 12:0 a.m.65 views

InHand Networks InRouter302 Information Disclosure Vulnerability (CNVD-2022-59185)

InHand Networks InRouter Series is a series of routers from InHand Networks, Inc. An information disclosure vulnerability exists in InHand Networks InRouter302 V3.5.4, which stems from the lack of the HttpOnly flag in the session cookie, which could be exploited by an attacker to The vulnerabilit...

7.5CVSS1.5AI score0.01019EPSS
SaveExploits1References1
CNVD
CNVD
added 2022/05/16 12:0 a.m.65 views

Online Sports Complex Booking System SQL注入漏洞(CNVD-2022-58670)

Online Sports Complex Booking System is an online stadium booking system by Carlo Montero, a personal developer. page=user/manageuser&id= lacks validation of external input SQL statements, which can be exploited to execute illegal SQL commands to steal sensitive database data...

9.8CVSS5.2AI score0.01124EPSS
SaveExploits1References1
CNVD
CNVD
added 2022/05/12 12:0 a.m.65 views

TOTOLINK N600R Command Injection Vulnerability (CNVD-2022-53553)

TOTOLINK N600R is a wireless router from Taiwan-based TOTOLINK, which is vulnerable to a command injection attack via the devicename parameter in /etting/setDeviceName...

10CVSS3.9AI score0.02565EPSS
SaveExploits1References1
CNVD
CNVD
added 2022/05/07 12:0 a.m.65 views

F5 BIG-IP cross-site scripting vulnerability in multiple products

F5 BIG-IP and F5 BIG-IP Guided Configuration GC are both products of F5, Inc. F5 BIG-IP is an application delivery platform that integrates network traffic management, application security management, load balancing, etc. F5 BIG-IP Guided Configuration is a configuration template. cross-site...

6.8CVSS1.8AI score0.00878EPSS
SaveExploits0References1
CNVD
CNVD
added 2022/05/07 12:0 a.m.65 views

F5 Traffix SDC Cross-Site Template Injection Vulnerability

F5 Traffix Signaling Delivery Controller F5 Traffix SDC is a signaling delivery controller from F5 USA, Inc. F5 Traffix SDC is vulnerable to cross-site template injection, which can be exploited by attackers to execute language-specific commands in the template server context...

4.8CVSS5.7AI score0.00465EPSS
SaveExploits0References1
CNVD
CNVD
added 2022/04/28 12:0 a.m.65 views

CuppaCMS SQL Injection Vulnerability (CNVD-2022-63581)

CuppaCMS is a content management system CMS.A SQL injection vulnerability exists in CuppaCMS v1.0, which originates from the lack of validation of external input SQL statements in /administrator/alerts/alertLightbox.php. An attacker could use this vulnerability to execute illegal SQL commands to...

9.8CVSS4.3AI score0.06598EPSS
SaveExploits1References1
CNVD
CNVD
added 2022/04/27 12:0 a.m.65 views

WordPress plugin myCred authorization problem vulnerability

WordPress is a set of blogging platform developed using the PHP language. myCred 2.4.4, a WordPress plugin, previously had an authorization issue vulnerability, which stems from the plugin's failure to perform any authorization and CSRF checks in the myCred tool's import and export AJAX operation...

4CVSS2.2AI score0.00339EPSS
SaveExploits1Affected Software1
CNVD
CNVD
added 2022/04/27 12:0 a.m.65 views

WordPress plugin RRatingg SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WordPress plugin is an application plugin. WordPress...

9.8CVSS1.4AI score0.01722EPSS
SaveExploits2References1
CNVD
CNVD
added 2022/04/18 12:0 a.m.65 views

SWHKD has unspecified vulnerabilities (CNVD-2022-36045)

SWHKD is a display protocol-independent hotkey daemon made in Rust. SWHKD has a security vulnerability that stems from keyboard events using an unintended user, which can be exploited by an attacker to cause information disclosure, but is usually a denial of functionality...

4.4CVSS1.9AI score0.00444EPSS
SaveExploits1References1
CNVD
CNVD
added 2022/04/14 12:0 a.m.65 views

AeroCMS Cross-Site Scripting Vulnerability (CNVD-2022-30784)

AeroCMS is a content management system from AeroCMS, Inc. A cross-site scripting vulnerability exists in AeroCMS v0.0.1, which can be exploited to execute arbitrary Web script or HTML by injecting a specially crafted payload into the "comment" text field...

6.1CVSS1.9AI score0.01444EPSS
SaveExploits3References1
CNVD
CNVD
added 2022/04/13 12:0 a.m.65 views

JHipster SQL Injection Vulnerability

JHipster is an open source application builder that develops web applications and microservices primarily using Angular or React and Spring Framework.JHipster suffers from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements, whic...

8.1CVSS4.8AI score0.01356EPSS
SaveExploits1References1
CNVD
CNVD
added 2022/04/12 12:0 a.m.65 views

Pillow Input Validation Error Vulnerability (CNVD-2022-28799)

Pillow is a Python based image processing library. An input validation error vulnerability exists in versions of Pillow prior to 9.0.1, which stems from the product's remove operation not validating user input data, and can be exploited by an attacker to delete files...

9.1CVSS6.4AI score0.02879EPSS
SaveExploits0References1
CNVD
CNVD
added 2022/04/02 12:0 a.m.65 views

IdeaRe SpA IdeaRE RefTree File Upload Vulnerability

IdeaRe SpA IdeaRE RefTree is a web application for managing complex real estate situations from IdeaRe SpA in Italy.IdeaRe SpA IdeaRE RefTree versions prior to 2021.09.17 contain a file upload vulnerability that stems from a lack of valid validation of uploaded files by the application. An attack...

9CVSS3.7AI score0.04628EPSS
SaveExploits3References1
CNVD
CNVD
added 2022/04/01 12:0 a.m.65 views

Firmware Analysis and Comparison Tool跨站脚本漏洞

Firmware Analysis and Comparison Tool FACT, a firmware analysis and comparison tool, is vulnerable to a cross-site scripting vulnerability in Firmware Analysis and Comparison Tool v3.2. The vulnerability stems from a lack of data validation filtering of user-supplied data and output in the user...

4.8CVSS2.7AI score0.00561EPSS
SaveExploits1References1
CNVD
CNVD
added 2022/03/31 12:0 a.m.65 views

Reolink Rlc-410W Denial of Service Vulnerability (CNVD-2022-37384)

Reolink Rlc-410W is a Wifi security camera from Reolink China.A denial of service vulnerability exists in Reolink RLC-410W, which can be exploited by attackers to cause a reboot via a compiled HTTP request...

8.6CVSS2.8AI score0.01145EPSS
SaveExploits1References1
CNVD
CNVD
added 2022/03/31 12:0 a.m.65 views

Jenkins Continuous Integration with Toad Edge Plugin任意文件读取漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. An attacker with Item/Configure privileges can read arbitrary files on the...

6.5CVSS2.7AI score0.01807EPSS
SaveExploits0References1
CNVD
CNVD
added 2022/03/14 12:0 a.m.65 views

TP-Link Omada Controller Software Licensing Issue Vulnerability

TP-Link Omada Controller Software is a set of software from Tp-link that supports the management of wireless access points.TP-Link Omada Controller Software versions prior to 5.0.15 are vulnerable to authorization issues, which stem from a lack of authentication measures or insufficient...

7.5CVSS4AI score0.01792EPSS
SaveExploits1References1
CNVD
CNVD
added 2022/03/14 12:0 a.m.65 views

IBM Guardium Data Encryption has an unspecified vulnerability (CNVD-2022-20154)

IBM Guardium Data Encryption GDE is an application from IBM of America, Inc. IBM Guardium Data Encryption versions 4.0.0.0 and 5.0.0.0 contain a security vulnerability that stems from the fact that the software saves user information in a CSV form file with a comma as the separator symbol, but it...

8.8CVSS2.3AI score0.0049EPSS
SaveExploits0References1
CNVD
CNVD
added 2022/03/14 12:0 a.m.65 views

Jeecg-Boot Cross-Site Scripting Vulnerability

Jeecg-Boot is a low-code platform based on the code generator from the JeecgBoot community. Jeecg-Boot 3.0 has a security vulnerability that stems from a cross-site script in /jeecg-boot/jmreport/view that causes a mouse hover event. No details of the vulnerability are currently available...

6.1CVSS1AI score0.00907EPSS
SaveExploits1References1
CNVD
CNVD
added 2022/03/10 12:0 a.m.65 views

Microsoft Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CNVD-2022-78054)

Microsoft Windows Ancillary Function Driver for WinSock is an auxiliary function driver for Winsock from Microsoft. WinSock contains an elevation of privilege vulnerability that could be exploited by attackers to execute arbitrary code with elevated privileges...

7.8CVSS7.5AI score0.03867EPSS
SaveExploits0References1
CNVD
CNVD
added 2022/03/04 12:0 a.m.65 views

Elasticsearch Kibana authorization issue vulnerability

Elasticsearch Kibana is an open source, browser-based analysis and search Elasticsearch dashboard tool from the Dutch company Elasticsearch.Elasticsearch Kibana is vulnerable to an authorization issue that could be exploited by an attacker to create new alert rules or override existing rules...

4.3CVSS2.9AI score0.00552EPSS
SaveExploits0References1
CNVD
CNVD
added 2022/03/04 12:0 a.m.65 views

Fortinet FortiToken Mobile Access Control Error Vulnerability

Fortinet FortiToken Mobile is an Oath-compliant, event-based and time-based one-time password Otp generator application from Fortinet U.S.A. An access control error vulnerability exists in Fortinet FortiToken Mobile versions 5.1.0 and below, which stems from a network system or the product does n...

4.1CVSS2.9AI score0.00646EPSS
SaveExploits0References1
CNVD
CNVD
added 2022/03/03 12:0 a.m.65 views

seacms arbitrary code execution vulnerability

seacms Ocean Video Management System is a video-on-demand system designed for webmasters with different needs. seacms V11.5 has an arbitrary code execution vulnerability, which can be exploited by attackers to write malicious files to the site and execute commands...

9.8CVSS6.3AI score0.022EPSS
SaveExploits1References1
CNVD
CNVD
added 2022/03/02 12:0 a.m.65 views

Fortinet FortiWLM Command Injection Vulnerability

A command injection vulnerability exists in Fortinet FortiWLC, a wireless LAN controller from Fortinet, which stems from a failure to properly validate input data in the alert dashboard and controller configuration handler. HTTP requests and execute arbitrary operating system commands on the targ...

9CVSS1.6AI score0.01623EPSS
SaveExploits0References1
CNVD
CNVD
added 2022/03/01 12:0 a.m.65 views

Microweber Cross-Site Scripting Vulnerability (CNVD-2022-15527)

Microweber is an online store management system from the Microweber community in the United States that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. A cross-site scripting vulnerability exists in GitHub, which stems from the lack of proper...

8CVSS2.8AI score0.00902EPSS
SaveExploits1References1
CNVD
CNVD
added 2022/02/25 12:0 a.m.65 views

Oracle MySQL Cluster Input Validation Error Vulnerability (CNVD-2022-17690)

Oracle MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database developed by Oracle Corporation. Oracle MySQL Cluster is vulnerable to an input validation error, which can be exploited by attackers to execute arbitrary code...

6.3CVSS5.6AI score0.02621EPSS
SaveExploits0References1
CNVD
CNVD
added 2022/02/22 12:0 a.m.65 views

microweber cross-site scripting vulnerability (CNVD-2022-13205)

Microweber is an online store management system from the US Microweber community that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. Microweber has a cross-site scripting vulnerability, and no details of the vulnerability are available at this...

8.8CVSS2AI score0.01105EPSS
SaveExploits1References1
CNVD
CNVD
added 2022/02/15 12:0 a.m.65 views

Samsung Wear Os StTheaterModeReceiver Access Control Error Vulnerability (CNVD-2022-56487)

Samsung Wear Os is a version of the Android operating system from Samsung South Korea designed for wearable computer devices such as smartwatches. An access control error vulnerability exists in versions of Samsung Wear OS prior to 3.0, which is designed for wearable computer devices such as...

4.3CVSS3.5AI score0.00449EPSS
SaveExploits0References1
CNVD
CNVD
added 2022/02/13 12:0 a.m.65 views

Huawei EMUI Security Bypass Vulnerability

Huawei Emui is an Android-based mobile operating system developed by Huawei, a Chinese company. A security bypass vulnerability exists in HUAWEI EMUI/Magic UI, which stems from a security protection bypass vulnerability in the modem. An attacker could exploit the vulnerability to cause a memory...

7.8CVSS7.5AI score0.00174EPSS
SaveExploits0References1
CNVD
CNVD
added 2022/02/11 12:0 a.m.65 views

Radareorg Radare2 Buffer Overflow Vulnerability (CNVD-2022-13392)

radare2 is a set of libraries and tools for working with binary files. radareorg Radare2 suffers from a buffer overflow vulnerability that stems from the product's failure to effectively determine memory boundaries, which could be exploited by an attacker to cause a buffer overflow...

7.1CVSS5.1AI score0.00954EPSS
SaveExploits1References1
CNVD
CNVD
added 2022/02/10 12:0 a.m.65 views

WordPress Perfect Survey plugin cross-site scripting vulnerability

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. WordPress Perfect Survey plugin in version 1.5.2 and prior versions suffers from a cross-site scripting vulnerability that stems from not validating and escaping the X-Forwarded-For header value,...

6.1CVSS1.8AI score0.01405EPSS
SaveExploits2References1
CNVD
CNVD
added 2022/02/09 12:0 a.m.65 views

Google Tensorflow has an unspecified vulnerability (CNVD-2022-09894)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A security vulnerability exists in Google TensorFlow, which stems from the er optimizer in TensorFlow that can cause a denial of service by modifying the SavedModel so that issimplifiableshape will...

6.5CVSS2.9AI score0.01151EPSS
SaveExploits1References1
CNVD
CNVD
added 2022/01/28 12:0 a.m.65 views

Mcafee Agent has an unspecified vulnerability (CNVD-2022-08725)

McAfee McAfee Agent MA is a client component from Mcafee that provides secure communication between ePolicy Orchestrator antivirus management platform and the managed products. Agent uses openssl.cnf to specify the OPENSSLDIR variable as a subdirectory in the installation directory during the bui...

7.8CVSS3.9AI score0.02969EPSS
SaveExploits0References1
CNVD
CNVD
added 2022/01/26 12:0 a.m.65 views

YetiForceCrm Cross-Site Request Forgery Vulnerability (CNVD-2022-08153)

YetiForceCrm is an open source Crm system from the Polish company YetiForce. A cross-site request forgery vulnerability exists in YetiForceCrm prior to version 6.3.0, which stems from a lack of proper validation of client-side data by the WEB application. An attacker could exploit this...

8CVSS7.7AI score0.00531EPSS
SaveExploits1References1
CNVD
CNVD
added 2022/01/26 12:0 a.m.65 views

Oracle MySQL Cluster Buffer Overflow Vulnerability (CNVD-2022-07918)

Oracle MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database developed by Oracle Corporation. Oracle MySQL Cluster is vulnerable to a buffer overflow vulnerability that could be exploited by an attacker to read the contents of memory or crash the application...

2.9CVSS4.5AI score0.01443EPSS
SaveExploits0References1
CNVD
CNVD
added 2022/01/25 12:0 a.m.65 views

Oracle MySQL Cluster Input Validation Error Vulnerability (CNVD-2022-13055)

Oracle MySQL is an open source relational database management system from Oracle Corporation. MySQL Cluster is a highly useful and redundant version for distributed computing environments. Oracle MySQL Cluster is vulnerable to an input validation error, which can be exploited by attackers to...

6.3CVSS4.9AI score0.03193EPSS
SaveExploits0References1
CNVD
CNVD
added 2022/01/24 12:0 a.m.65 views

JerryScript has an unspecified vulnerability (CNVD-2022-07241)

JerryScript, a lightweight JavaScript engine from the JerryScript project, has a security vulnerability in JerryScript 3.0.0, which originates in /parser/js/js-parser-expr.cparserparseclassbody. classbody has a failed assertion opts & PARSERCLASSLITERALCTORPRESENT. No detailed vulnerability detai...

5.5CVSS1.1AI score0.00644EPSS
SaveExploits1References1
CNVD
CNVD
added 2022/01/17 12:0 a.m.65 views

NUUO NVRmini2 Authorization Issues Vulnerability

NUUO NVRMini2 is a small network DVR device from NUUO, Taiwan, China. The NUUO NVRmini2 suffers from an authorization issue vulnerability that can be exploited by attackers to upload encrypted TAR archives...

10CVSS9.3AI score0.49431EPSS
SaveExploits1References1
CNVD
CNVD
added 2022/01/16 12:0 a.m.65 views

Jenkins Bitbucket Branch Source Plugin Cross-Site Request Forgery Vulnerability

Jenkins is a Jenkins open source application . An open source automation server Jenkins provides hundreds of plug-ins to support building, deploying and automating any project . The Jenkins Bitbucket Branch Source Plugin suffers from a cross-site request forgery vulnerability that stems from a WE...

7.1CVSS7AI score0.00655EPSS
SaveExploits0References1
CNVD
CNVD
added 2022/01/14 12:0 a.m.65 views

Teedy Cross-Site Scripting Vulnerability

Teedy is a French open source, lightweight document management system for individuals and businesses. Teedy suffers from a cross-site scripting vulnerability in versions v1.5 through v1.9 that stems from a lack of checksum filtering of user-supplied data and output. An attacker can exploit this...

9.6CVSS8.8AI score0.01296EPSS
SaveExploits1References1
CNVD
CNVD
added 2022/01/13 12:0 a.m.65 views

McAfee TechCheck Code Issues Vulnerabilities

McAfee TechCheck is a software from McAfee USA to keep your computer running smoothly. It is used to diagnose machine problems. A code issue vulnerability exists in versions prior to McAfee TechCheck 4.0.0.2 that allows local administrators to load their own Dynamic Link Library DLL to gain...

7.4CVSS6.8AI score0.0028EPSS
SaveExploits0References1
CNVD
CNVD
added 2022/01/12 12:0 a.m.65 views

Apache Guacamole Information Disclosure Vulnerability (CNVD-2022-04988)

Apache Guacamole is a clientless remote desktop gateway from the Apache Foundation in the United States. The product supports protocols such as VNC, RDP, and SSH. A security vulnerability exists in Apache Guacamole 1.3.0, which stems from the fact that Apache Guacamole 1.3.0 and earlier versions...

6.5CVSS3.1AI score0.01933EPSS
SaveExploits0References1
CNVD
CNVD
added 2022/01/06 12:0 a.m.65 views

Latte Cross-Site Scripting Vulnerability

Latte is a template engine for Nette Foundation's Php. Latte in version 2.8.0 contains a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied data and output. An attacker could exploit this vulnerability to execute JavaScript code on the client...

8.2CVSS3.2AI score0.00817EPSS
SaveExploits0References1
Total number of security vulnerabilities5000