ThinkPHP SQL Injection Vulnerability (CNVD-2021-103660)

ThinkPHP is a set of PHP-based, open source, lightweight Web application development framework from China Top Think Information Technology. thinkPHP has SQL injection vulnerability, there is no detailed vulnerability details provided...

Bentley View J2K File Parsing Memory Misreference Vulnerability

Bentley View is a free viewer from Bentley Systems, Inc. A memory mis-reference vulnerability exists in Bentley View J2K File Parsing, which results from not verifying the existence of an object prior to J2K File Parsing. An attacker could exploit this vulnerability to execute code in the context...

Open-xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2021-90764)

Open-xchange OX App Suite is a Web cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. A cross-site scripting vulnerability exists in Open-xchange OX App Suite, which can be exploited by...

Linux kernel array index out-of-bounds vulnerability

Linux kernel is a computer operating system kernel written in C and assembly language, POSIX-compliant, and distributed under the GNU General Public License. detachcapictr function in drivers/isdn/capi/kcapi.c in versions of Linux kernel prior to 5.14.15 is vulnerable to array index out-of-bounds...

Hashicorp HashiCorp Vault has an unspecified vulnerability

HashiCorp HashiCorp Vault is a private key access management tool from HashiCorp Hashicorp, U.S. A security vulnerability exists in HashiCorp Vault and Vault Enterprise, which stems from allowing a user with write access to an entity alias ID to share with another user load visitors to gain acces...

WeeChat Buffer Overflow Vulnerability (CNVD-2021-70118)

A security vulnerability in WeeChat, an extensible live chat client application, stems from the fact that WeeChat before version 3.2.1 allows remote attackers to trigger, via a crafted WebSocket framework, an out-of-bounds read, resulting in a denial of service crash. No detailed vulnerability...

EyouCms Cross-Site Scripting Vulnerability

EyouCms EyouCms is a ThinkPHP-based open source content management system CMS from Hainan Zanzan Network Technology Co. An attacker can use the vulnerability to execute arbitrary web scripts or HTML...

Incorrect security UI vulnerability in Google Chrome navigation

Chrome is a web browsing tool developed by Google. versions prior to Google Chrome 92.0.4515.131 are vulnerable to an incorrect security UI in navigation. An attacker could exploit this vulnerability to bypass security restrictions...

WordPress W3 Total Cache plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. A cross-site scripting vulnerability exists in the WordPress plugin W3 Total Cache in versions prior to 2.1.4, which stems from a lack of validation of client-side data in the "extension" parameter of t...

Google Golang Trust Management Issue Vulnerability

Google Golang is a statically strongly typed, compiled language from Google, U.S. A trust management issue vulnerability exists in Google Golang, which can be exploited by attackers to cause a TLS client panic...

Microsoft Windows/Windows Server Elevation of Privilege Vulnerability (CNVD-2021-66082)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation USA, Microsoft Windows is an operating system for personal devices, and Microsoft Windows Server is a server operating system. An elevation of privilege vulnerability exists in the Windows Kernel in Microsof...

Red Hat OpenShift has unexplained holes

Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform from Red Hat that supports building, testing, deploying, and running applications.A security vulnerability exists in versions prior to OpenShift version 4.8, which stems from a certificate generated by a service CA within ...

Siemens Jt2go and Siemens Teamcenter Visualization Out-of-Bounds Read Vulnerability (CNVD-2021-53349)

Siemens Jt2go and Siemens Teamcenter Visualization are both products of Siemens AG, Germany. Siemens Jt2go is a JT file viewer. An out-of-bounds read vulnerability exists in Siemens JT2Go versions prior to 13.2 and Teamcenter Visualization versions prior to 13.2. The vulnerability stems from a...

baigo CMS Cross-Site Scripting Vulnerability (CNVD-2021-53924)

baigo CMS is an open source PHP-based web content management system CMS. baigo CMS v4.0 contains a cross-site scripting vulnerability that can be exploited by attackers to execute arbitrary web script or HTML by submitting form parameters to a public console configuration file...

Insyde InsydeH2O has an unspecified vulnerability (CNVD-2022-10035)

Insyde H2OFFT is a set of tools for BIOS firmware development from Insyde Software Taiwan, China.Insyde InsydeH2O has a security vulnerability that could be exploited by attackers to gain control of the system via system administration mode privileges...

Siemens Tecnomatix Plant Simulation Buffer Error Vulnerability

Siemens Tecnomatix Plant Simulation is an industrial control device from Siemens, Germany. The power of discrete-event simulation is used to analyze and optimize throughput and thus improve manufacturing system performance. A buffer error vulnerability exists in Tecnomatix Plant Simulation versio...

Microsoft Windows/Windows Server Elevation of Privilege Vulnerability (CNVD-2021-66099)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, an operating system for personal devices, and Microsoft Windows Server, a server operating system. An elevation of privilege vulnerability exists in the "Container Manager Service" of Microsoft...

Atlassian Jira Server and Data Center has an unspecified vulnerability (CNVD-2021-55941)

Atlassian JIRA Server and Atlassian JIRA Data Center are both products of Atlassian Australia, Atlassian JIRA Server is a server version of the defect tracking management system. Atlassian JIRA Data Center is the data center version of Atlassian JIRA. Atlassian Jira Server and Data Center have a...

Unauthorized Access Vulnerability in webcamxpXP 5

webcamXP is webcam and webcam software for Windows. An unauthorized access vulnerability exists in webcamxpXP 5. An attacker can exploit the vulnerability to obtain sensitive information...

Siemens Nucleus Products DNS Module Predicts UDP Port Number Vulnerabilities

The Nucleus NET module includes a range of standards-compliant networking and communications protocols, drivers and utilities to provide full-featured networking support in any embedded device.Nucleus RTOS provides a highly scalable microkernel-based real-time operating system designed for...

Zen Cart Cross-Site Scripting Vulnerability (CNVD-2021-22861)

Zen Cart is open source, free mall system for building professional online stores. A reflective cross-site scripting vulnerability exists in Zen Cart 1.5.6d. An attacker can execute malicious script via the includes/templates/templatedefault/common/tplmainpage.php or...

SAP Netweaver Application Server Java Reverse Tag Phishing Vulnerability

SAP Netweaver Application Server Java is part of the SAP NetWeaver Application Platform, which provides a complete infrastructure for deploying and running Java applications. A reverse tag phishing vulnerability exists in SAP Netweaver Application Server Java 7.00, 7.10, 7.11, 7.20, 7.30, 7.31,...

Unspecified Vulnerability in Mozilla Firefox (CNVD-2021-15354)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox. No details of the vulnerability are provided at this time...

Huawei AIS-BW80H-00 Input Validation Error Vulnerability

Huawei AIS-BW80H-00 is a smart speaker device from Huawei China. Huawei AIS-BW80H-00 is vulnerable to an input validation error, which could be exploited by an attacker to load a crafted software package onto the device...

Smart Template Engine Injection Vulnerability

The Smart1 template engine is one of the most famous PHP engines in the industry today. It provides an easy-to-manage way to separate business logic from presentation logic. A vulnerability has been reported in the Smart template engine, which allows an attacker to write to a cache file via the...

Star Computer Star Practice Management Web Access Control Error Vulnerability (CNVD-2021-56824)

Star Computer Star Practice Management Web is a web service used for time-based billing by Star Computer UK.An access control error vulnerability exists in Star Practice Management Web version 2019.2.0.6, which could be exploited by an attacker to The vulnerability can be exploited to change the...

Wing FTP Cross-Site Scripting Vulnerability

Wing FTP Server is a cross-platform FTP server software. A cross-site scripting vulnerability exists in Wing FTP version 6.4.4, where an arbitrary IFRAME element can be included in a help page via a specially crafted link, which can be exploited by an attacker to execute sandbox arbitrary HTML an...

GitLab Access Control Error Vulnerability (CNVD-2021-26106)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An Access Control Error vulnerability exists in GitLab...

Schneider Electric Interactive Graphical SCADA System Out-of-Bounds Write Vulnerability

Schneider Electric Interactive Graphical SCADA System IGSS is a SCADA Data Acquisition and Supervisory System system for monitoring and controlling industrial processes from Schneider Electric, France. An out-of-bounds write vulnerability exists in Interactive Graphical SCADA System version...

Xen Data Forgery Issue Vulnerability

Xen is an open source virtual machine monitor product from the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. A security vulnerability exists in the Xen...

JerryScript has an unspecified vulnerability (CNVD-2022-11531)

JerryScript is a lightweight JavaScript engine from the JerryScript project. A security vulnerability exists in JerryScript vm/opcodes.c version 2.2.0, which can be exploited by attackers to hijack the control flow via the control register...

Froala WYSIWYG HTML Editor Cross-Site Scripting Vulnerability

Froala WYSIWYG HTML Editor is a U.S. Froala company's Web-based WYSIWYG rich text editor . A cross-site scripting vulnerability exists in Froala WYSIWYG HTML Editor versions 3.0.6 through 3.1.1. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. A...

Unspecified Vulnerability in PowerDNS Recursor

PowerDNS Recursor pdnsrecursor is a domain name resolution server from the Dutch company PowerDNS. A security vulnerability exists in PowerDNS Recursor versions 4.1.0 through 4.3.0, which can be exploited by an attacker to cause a degradation in service performance...

WordPress Cross-Site Scripting Vulnerability (CNVD-2020-27081)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the 'stats' method of the class-wp-object-cache.php file in...

Valve Source Elevation of Privilege Vulnerability

Valve Source is a 3D game engine from the American company Valve. A security vulnerability exists in Valve Source. The vulnerability stems from a failure of a properly programmed call to an advanced native procedure. A local attacker can exploit the vulnerability by writing a file to...

Django Account Hijacking Vulnerability

Django is an open source web application framework. Django suffers from an account hijacking vulnerability that can be exploited by an attacker to obtain a valid password reset token for a user account...

Sonatype Nexus Repository Manager Operating System Command Injection Vulnerability

Sonatype Nexus Repository Manager NXRM is a Maven repository manager from Sonatype USA. An operating system command injection vulnerability exists in Sonatype NXRM that can be exploited by an attacker to execute code...

CloudBees Jenkins Token Macro Plugin XML External Entity Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Token Macro Plugin is used in one of the...

Atlassian Jira Username Enumeration Vulnerability

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. A username enumeration vulnerability exists in Atlassian Jira versions prior to 7.13.3, 8.0.4, and 8.1.1, which can be exploited...

CloudBees Jenkins Script Security Plugin Sandbox Bypass Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A sandbox bypass vulnerabilit...

Apache HTTP Server Authorization Issues Vulnerability

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. Apache HTTP Server is vulnerable to an authorization issue. The vulnerability stems from modsession detecting the expiration time ...

Ansible Information Disclosure Vulnerability (CNVD-2018-25747)

Ansible is a computer system configuration manager from Ansible, Inc. that can be used to publish, manage and orchestrate computer systems. An information disclosure vulnerability exists in Ansible, which can be exploited by an attacker to obtain sensitive data in vvv+ mode...

LibTIFF tif_unix function null pointer reference vulnerability

LibTIFF is a library for reading and writing TIFF Tagged Image File Format files. The library contains some command line tools for working with TIFF files. A null pointer reference vulnerability exists in the LibTIFF tifunix function. An attacker could exploit this vulnerability to cause a denial...

Red Hat OpenShift Container Platform Denial of Service Vulnerability

Red Hat OpenShift Container Platform is an application platform from Red Hat that enables organizations to develop, deploy and manage existing container-based applications across physical, virtual and public cloud infrastructures. A denial of service vulnerability exists in Red Hat OpenShift...

Atlassian Jira issue collector cross-site scripting vulnerability

Atlassian JIRA is a defect tracking management system from Atlassian Australia. The system is mainly used to track and manage all kinds of issues and defects in the workplace. issue collector is one of the issue collectors. A cross-site scripting vulnerability exists in the error message of a...

Simple DirectMedia Layer SDL2_image Double Release Vulnerability

Simple DirectMedia Layer is a multi-platform library for accessing low-level hardware and graphics and providing support for games, software, and emulators. sdl2image is a component used in it for parsing and displaying various image file formats. A double release vulnerability exists in the XCF...

Apache HTTP Server Denial of Service Vulnerability (CNVD-2018-06536)

Apache HTTP Server is the United States Apache Apache Software Foundation, an open source web server. The server is fast, reliable and can be expanded through a simple API. There is a security vulnerability in Apache HTTP Server. An attacker can exploit this vulnerability by sending a specially...

WordPress Plugin Site Editor Local File Inclusion Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.Site Editor plugin is used in one of the WYSIWYG front-end editor. A local file inclusion vulnerability exists in...

Artifex Software MuPDF and Ghostscript Artifex jbig2dec Denial of Service Vulnerability

Artifex Software Ghostscript and MuPDF are both products of the United States Artifex Software. Artifex Ghostscript is an open source PostScript parser; MuPDF is a free, lightweight PDF reader. jbig2dec is an for Ghostscript and MuPDF in the decoding of PDF files in the JBIG2 stream implementatio...

MCabber Security Bypass Vulnerability

MCabber is a small XMPP Jabber console client. A security bypass vulnerability exists in MCabber that could allow an attacker to perform a man-in-the-middle attack or emulate a trusted server...