Siemens Solid Edge Stack Buffer Overflow Vulnerability

Siemens Solid Edge is a 3D CAD software from Siemens, Germany. A stack buffer overflow vulnerability exists in Siemens Solid Edge, which can be exploited by an attacker to execute code in the context of the current process...

Qnap Systems QNAP HBS 3 Authorization Issues Vulnerability

Qnap Systems QNAP HBS 3 is an application from China Weilian Qnap Systems. A comprehensive data backup and disaster recovery solution. An authorization issue vulnerability exists in HBS 3 Hybrid Backup Sync that stems from a failure to perform adequate authorization checks. An attacker could use...

Seafile Cross-Site Scripting Vulnerability

Seafile is an open source, cross-platform file hosting software system. A cross-site scripting vulnerability exists in Seafile 7.0.5. The vulnerability can be exploited to inject and execute malicious JavaScript code via the "shared library feature"...

Zen Cart Cross-Site Scripting Vulnerability (CNVD-2021-22861)

Zen Cart is open source, free mall system for building professional online stores. A reflective cross-site scripting vulnerability exists in Zen Cart 1.5.6d. An attacker can execute malicious script via the includes/templates/templatedefault/common/tplmainpage.php or...

SAP Netweaver Application Server Java Reverse Tag Phishing Vulnerability

SAP Netweaver Application Server Java is part of the SAP NetWeaver Application Platform, which provides a complete infrastructure for deploying and running Java applications. A reverse tag phishing vulnerability exists in SAP Netweaver Application Server Java 7.00, 7.10, 7.11, 7.20, 7.30, 7.31,...

ytnef heap buffer overflow vulnerability (CNVD-2021-16918)

ytnef is a program that collaborates with procmail to decode TNEF streams. A heap buffer overflow vulnerability exists in the SwapWord function in lib/ytnef.c in ytnef 1.9.3. A remote attacker can exploit this vulnerability via specially crafted files to cause a denial of service and possibly...

Cisco Application Services Engine Unauthorized Access Vulnerability (CNVD-2021-12827)

Cisco Application Services Engine provides a common platform for deploying Cisco data center applications. An unauthorized access vulnerability exists in Cisco Application Services Engine 1.13d and earlier versions, which can be exploited by a remote, unauthenticated attacker to elevate access to...

Huawei AIS-BW80H-00 Input Validation Error Vulnerability

Huawei AIS-BW80H-00 is a smart speaker device from Huawei China. Huawei AIS-BW80H-00 is vulnerable to an input validation error, which could be exploited by an attacker to load a crafted software package onto the device...

NVIDIA GeForce Experience Arbitrary File Deletion Vulnerability

NVIDIA GeForce Experience is graphics card driver update software that helps to check your computer's geforce drivers and update them to the latest version. An arbitrary file deletion vulnerability exists in GameStream rxdiag.dll in NVIDIA GeForce Experience versions prior to 3.21. The...

SoftMaker Office PlanMaker Memory Corruption Vulnerability

SoftMaker Office PlanMaker is a German Softmaker SoftMaker company supports multi-platform office software in the spreadsheet suite. SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 suffers from a memory corruption vulnerability that can be exploited by an attacker to cause a heap buffer...

Unspecified vulnerability in Mozilla Rust flatbuffers crate

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in flatbuffers crate in versions of Mozilla Rust prior to 2020-04-11, no details of the vulnerability are provided at this time...

libvips Information Disclosure Vulnerability

libvips is a demand-driven multi-threaded image processing library. libvips versions prior to 8.8.2 are vulnerable to an information disclosure. The vulnerability stems from imvips2dz in /libvips/libvips/deprecated/imvips2dz.c in libvips having uninitialized variables. An attacker could use this...

Unspecified Vulnerability in PHPMailer

PHPMailer is a PHP class library for sending e-mail . A security vulnerability exists in versions of PHPMailer prior to 6.1.6, which stems from the program failing to properly escape double quote characters when the name of a file attachment contains them. An attacker can exploit this vulnerabili...

Inductive Automation Ignition Access Control Error Vulnerability

Inductive Automation Ignition is a suite of integrated software platforms for SCADA systems from Inductive Automation, Inc. The platform supports SCADA data acquisition and monitoring systems, HMI human machine interface and more. An access control error vulnerability exists in Inductive Automati...

Wordpress LearnPress SQL Injection Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.LearnPress is a learning management system plugin used in it. A SQL injection vulnerability exists in Wordpress LearnPress...

Ansible path traversal vulnerability

Ansible is a computer system configuration manager from the American company Ansible. The product can be used to publish, manage and organize computer systems. A path traversal vulnerability exists in Ansible. The vulnerability stems from a failure of a networked system or product to properly...

Django Account Hijacking Vulnerability

Django is an open source web application framework. Django suffers from an account hijacking vulnerability that can be exploited by an attacker to obtain a valid password reset token for a user account...

OpenDetex Buffer Overflow Vulnerability

OpenDetex is a tool to extract plain text from TeX and LaTeX sources. A buffer overflow vulnerability exists in TexOpen in detex.l in OpenDetex 2.8.5. No details of the vulnerability are provided at this time...

CloudBees Jenkins Token Macro Plugin XML External Entity Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Token Macro Plugin is used in one of the...

Atlassian Jira Username Enumeration Vulnerability

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. A username enumeration vulnerability exists in Atlassian Jira versions prior to 7.13.3, 8.0.4, and 8.1.1, which can be exploited...

CloudBees Jenkins Code Issue Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . LTS is a long-term support for...

CloudBees Jenkins Code Execution Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is a Java-based continuous integration tool from CloudBees, Inc. It is mainly used to monitor continuous software releases/testing projects and a number of timed tasks.LTS Long-Term Support is a long-supported version of CloudBees Jenkins a long-ter...

Quest KACE System Management Appliance Command Injection Vulnerability (CNVD-2018-10907)

The Quest KACE System Management Appliance provides comprehensive system management for all network-connected devices. A command injection vulnerability exists in the '/common/downloadagentinstaller.php' script in Quest KACE System Management Appliance 8.0.318. An anonymous user can exploit this...

Atlassian Jira issue collector cross-site scripting vulnerability

Atlassian JIRA is a defect tracking management system from Atlassian Australia. The system is mainly used to track and manage all kinds of issues and defects in the workplace. issue collector is one of the issue collectors. A cross-site scripting vulnerability exists in the error message of a...

IBM InfoSphere Information Server Information Disclosure Vulnerability (CNVD-2017-21256)

IBM InfoSphere Information Server is a set of data integration platforms from IBM in the United States. The platform can be used to integrate data information obtained from various sources. An information disclosure vulnerability exists in IBM InfoSphere Information Server versions 9.1, 11.3, and...

WordPress Mail Masta plugin SQL injection vulnerability (CNVD-2017-02398)

WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . A SQL injection vulnerability exists in the WordPress Mail Masta plugin, which originates when the program fails...

Apache Tika Remote Code Execution Vulnerability

Apache Tika is the United States Apache Apache Software Foundation, an integrated POI using Java programs to provide read and write Microsoft Office format documents open-source library, Pdfbox read and create PDF documents pure Java class library and for text extraction work provides a unified...

IPsec-Tools IKE Daemon Remote Denial of Service Vulnerability

IPsec-Tools is a user-space implementation of different IPSecs ported from KAME's libipsec, setkey and racoon, and supports various BSD systems. A null pointer reference error in the IPsec-Tools 'gssapiinit' function src/racoon/gssapi.c allows a remote attacker to submit special UDP packets that...

F5 BIG-IP TMM Denial of Service Vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, and remote access policy management. A denial-of-service vulnerability exists in BIG-IP's TMM Traffic Management Microkernel module, which arises because specific...

Huawei EnzoH OS Command Injection Vulnerability (CNVD-2025-23594)

Huawei EnzoH is a wireless access device from Huawei China. Huawei EnzoH suffers from an operating system command injection vulnerability that can be exploited by an attacker to cause arbitrary command execution...

MB CONNECT LINE mbNET.mini SQL Injection Vulnerability

The mbNET.mini from MB CONNECT LINE is an industrial router designed for industrial scenarios and is primarily used to enable secure remote connections to machines and systems. MB CONNECT LINE mbNET.mini suffers from a SQL injection vulnerability that stems from improper neutralization of special...

HDF5 Buffer Overflow Vulnerability (CNVD-2025-16249)

HDF5 is a data management suite developed by The HDF Group for storing and managing large-scale scientific data. A security vulnerability exists in the H5Omtimenewencode function in the src/H5Omtime.c file of HDF5 version 1.14.6, which stems from improper handling of data boundaries. An attacker...

WordPress WP User Frontend Pro plugin code issue vulnerability

WordPress WP User Frontend Pro plugin is a WordPress front-end user center plugin that provides powerful front-end administration features. WordPress WP User Frontend Pro plugin has a code issue vulnerability, the vulnerability stems from the lack of file type validation in the uploadfiles...

Google gVisor elevation of privilege vulnerability (CNVD-2025-07534)

Google gVisor is a container sandboxing technology developed by Google to provide greater isolation and security for containers. An elevation of privilege vulnerability exists in Google gVisor, which can be exploited by an attacker to access restricted files...

Dell PowerEdge FX2 and Dell PowerEdge VRTX Buffer Overflow Vulnerability

The Dell PowerEdge FX2 and Dell PowerEdge VRTX are both products of Dell, Inc.The Dell PowerEdge FX2 is a 2U hybrid rackmount computing platform.The Dell PowerEdge VRTX is a mini server with a built-in storage system.... The Dell PowerEdge FX2 and Dell PowerEdge VRTX have a buffer overflow...

WAVLINK AC3000 Buffer Overflow Vulnerability (CNVD-2025-08331)

WAVLINK AC3000 is a wireless router from China Ruiyin WAVLINK. The WAVLINK AC3000 suffers from a buffer overflow vulnerability that originates in the qos.cgi qosstasettings function that fails to properly validate the length and size of input data, which can be exploited by an attacker to execute...

Craft CMS Unauthenticated Remote Code Execution Vulnerability

Craft CMS is a user-friendly, web-based content management system for creating and managing website content. Craft CMS has a security vulnerability due to the opening of registerargcargv in the PHP configuration, which can be exploited by an attacker to execute arbitrary code and take control of...

IBM Cognos Controller File Upload Vulnerability (CNVD-2025-01788)

IBM Cognos Controller is a suite of business intelligence and planning solutions from International Business Machines IBM. The product features process automation, financial audit control, and the creation and management of financial reports. A file upload vulnerability exists in IBM Cognos...

IBM webMethods Integration Elevation of Privilege Vulnerability

IBM webMethods Integration is a hybrid enterprise iPaaS from International Business Machines IBM. An elevation of privilege vulnerability exists in IBM webMethods Integration version 10.15, which can be exploited by an authenticated attacker to create scheduler tasks that elevate their privileges...

Ivanti EPM SQL Injection Vulnerability

Ivanti EPM is a one-stop shop for managing user profiles and all client devices from Ivanti USA. An SQL injection vulnerability exists in Ivanti EPM 2022 SU5 and prior versions, which can be exploited by an attacker to execute arbitrary code...

Adobe Commerce Input Validation Error Vulnerability (CNVD-2024-19008)

Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. Adobe Commerce has an input validation error vulnerability that stems from vulnerability to incorrect input validation vulnerability, which could lead t...

Tenda AC10 OS Command Injection Vulnerability (CNVD-2024-15743)

The Tenda AC10 is a wireless router from the Chinese company Tenda. Tenda AC10U version 15.03.06.49 suffers from an operating system command injection vulnerability, which originates from the mac parameter of the formWriteFacMac function of the /goform/WriteFacMac file failing to correctly filter...

Mattermost Denial of Service Vulnerability (CNVD-2024-14305)

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a denial-of-service vulnerability that stems from an inability to limit the number of mentions processed per message, which can be exploited by an authenticated attacker to cras...

Unspecified vulnerability in wolfSSL (CNVD-2024-37452)

wolfSSL CyaSSL is the United States wolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. A security vulnerability exists in wolfSSL versions prior to 5.6.6, which can be exploited by an attacker to trigger a 5-byte buffer out-of-bounds read...

Siemens SENTRON 3KC ATC6 Ethernet Module Hidden Function Vulnerability

The Siemens SENTRON 3KC ATC6 Expansion Module is a power distribution protection device from Siemens, Germany, for monitoring and protecting power systems. A hidden function vulnerability exists in the Siemens SENTRON 3KC ATC6 Ethernet Module due to affected devices exposing unused and unstable...

IBM Security Guardium XML External Entity Injection Vulnerability (CNVD-2024-12704)

IBM Security Guardium is a suite of platforms from International Business Machines IBM that provide data protection capabilities. The platform includes features such as custom UI, report management and streamlined audit process building. IBM Security Guardium Key Lifecycle Manager suffers from an...

wolfSSL Input Validation Error Vulnerability

wolfSSL CyaSSL is the United States wolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. An input validation error vulnerability exists in WolfSSL versions prior to 5.6.6, which stems from a failure to check if a message crosses a key boundary...

Cisco Identity Services Engine Cross-Site Scripting Vulnerability (CNVD-2024-06170)

Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. A cross-site scripting vulnerability exists in...

Microsoft Office Code Execution Vulnerability

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. The product's common components include Word, Excel, Access, Powerpoint, FrontPage, etc.. Microsoft Office has a code execution vulnerability that can be exploited by an attacker to execute arbitra...

GTKWave Integer Overflow Vulnerability

GTKWave is a full-featured, GTK+-based waveform viewer from GTKWave. An integer overflow vulnerability exists in GTKWave version 3.3.115, which can be exploited by an attacker to cause memory corruption via specially crafted .fst files...