Django Account Hijacking Vulnerability

Django is an open source web application framework. Django suffers from an account hijacking vulnerability that can be exploited by an attacker to obtain a valid password reset token for a user account...

Sonatype Nexus Repository Manager Operating System Command Injection Vulnerability

Sonatype Nexus Repository Manager NXRM is a Maven repository manager from Sonatype USA. An operating system command injection vulnerability exists in Sonatype NXRM that can be exploited by an attacker to execute code...

CloudBees Jenkins Token Macro Plugin XML External Entity Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Token Macro Plugin is used in one of the...

CloudBees Jenkins Script Security Plugin Sandbox Bypass Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A sandbox bypass vulnerabilit...

Apache HTTP Server Authorization Issues Vulnerability

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. Apache HTTP Server is vulnerable to an authorization issue. The vulnerability stems from modsession detecting the expiration time ...

Ansible Information Disclosure Vulnerability (CNVD-2018-25747)

Ansible is a computer system configuration manager from Ansible, Inc. that can be used to publish, manage and orchestrate computer systems. An information disclosure vulnerability exists in Ansible, which can be exploited by an attacker to obtain sensitive data in vvv+ mode...

LibTIFF tif_unix function null pointer reference vulnerability

LibTIFF is a library for reading and writing TIFF Tagged Image File Format files. The library contains some command line tools for working with TIFF files. A null pointer reference vulnerability exists in the LibTIFF tifunix function. An attacker could exploit this vulnerability to cause a denial...

Red Hat OpenShift Container Platform Denial of Service Vulnerability

Red Hat OpenShift Container Platform is an application platform from Red Hat that enables organizations to develop, deploy and manage existing container-based applications across physical, virtual and public cloud infrastructures. A denial of service vulnerability exists in Red Hat OpenShift...

Atlassian Jira issue collector cross-site scripting vulnerability

Atlassian JIRA is a defect tracking management system from Atlassian Australia. The system is mainly used to track and manage all kinds of issues and defects in the workplace. issue collector is one of the issue collectors. A cross-site scripting vulnerability exists in the error message of a...

Simple DirectMedia Layer SDL2_image Double Release Vulnerability

Simple DirectMedia Layer is a multi-platform library for accessing low-level hardware and graphics and providing support for games, software, and emulators. sdl2image is a component used in it for parsing and displaying various image file formats. A double release vulnerability exists in the XCF...

Apache HTTP Server Denial of Service Vulnerability (CNVD-2018-06536)

Apache HTTP Server is the United States Apache Apache Software Foundation, an open source web server. The server is fast, reliable and can be expanded through a simple API. There is a security vulnerability in Apache HTTP Server. An attacker can exploit this vulnerability by sending a specially...

Artifex Software MuPDF and Ghostscript Artifex jbig2dec Denial of Service Vulnerability

Artifex Software Ghostscript and MuPDF are both products of the United States Artifex Software. Artifex Ghostscript is an open source PostScript parser; MuPDF is a free, lightweight PDF reader. jbig2dec is an for Ghostscript and MuPDF in the decoding of PDF files in the JBIG2 stream implementatio...

MCabber Security Bypass Vulnerability

MCabber is a small XMPP Jabber console client. A security bypass vulnerability exists in MCabber that could allow an attacker to perform a man-in-the-middle attack or emulate a trusted server...

Remote Control Backdoor Vulnerability in Canon Canon vb-c60 Camera

Canon Japan is a Japanese company dedicated to imaging, optical and office automation products, including cameras, camcorders, copiers, fax machines, image scanners and printers. A remote control backdoor vulnerability exists in the Canon vb-c60 camera, which allows an attacker to send a get...

Microsoft windows DLL Load Arbitrary Code Execution Vulnerability

Microsoft Windows is an operating system developed by Microsoft. Microsoft Windows fails to properly parse shortcuts, allowing attackers to build malicious DLLs that are tricked into being loaded by applications and executed with application privileges...

Cisco Webex Meetings Cross-Site Scripting Vulnerability (CNVD-2025-21256)

Cisco Webex Meetings is a set of video conferencing solutions from Cisco USA. A cross-site scripting vulnerability exists in Cisco Webex Meetings that stems from insufficient validation of user input and can be exploited by an attacker to cause a cross-site scripting attack...

Online Fire Reporting System bwdates-report-result.php File SQL Injection Vulnerability

Online Fire Reporting System is an online fire reporting system. Online Fire Reporting System suffers from a SQL injection vulnerability that originates from the lack of validation of the fromdate/todate parameter in the file /admin/bwdates-report-result.php for externally entered SQL statements...

Unspecified vulnerability in Huawei HarmonyOS (CNVD-2025-02240)

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS suffers from a security vulnerability that can be exploited by an attacker to compromise availability...

Dell ECS Buffer Overflow Vulnerability

Dell ECS Elastic Cloud Storage is an enterprise-class cloud-scale object storage platform from Dell Technologies. A buffer overflow vulnerability exists in Dell ECS. The vulnerability is due to an arithmetic overflow in the ECS's retention period processing. An attacker could exploit the...

PbootCMS Code Injection Vulnerability (CNVD-2025-0171060)

PbootCMS is PbootCMS open source an open source enterprise building content management system CMS developed using the PHP language. PbootCMS version 3.2.3 and earlier versions of the code injection vulnerability exists , the vulnerability stems from apps/home/controller/IndexController.php page t...

Microsoft SQL Server Remote Code Execution Vulnerability (CNVD-2024-38791)

Microsoft SQL Server is the United States Microsoft Microsoft company's set of applications in the Microsoft Windows system under the large commercial database system. A remote code execution vulnerability exists in Microsoft SQL Server, which can be exploited by an attacker to execute arbitrary...

Unspecified Vulnerability in Palo Alto Networks PAN-OS (CNVD-2024-20502)

Palo Alto Networks PAN-OS is a next-generation firewall software from Palo Alto Networks, USA. A security vulnerability exists in Palo Alto Networks PAN-OS that stems from the presence of a memory leak. No details of the vulnerability are provided at this time...

SAP NetWeaver AS Cross-Site Scripting Vulnerability (CNVD-2024-13534)

SAP NetWeaver AS is a SAP network application server from SAP. It not only provides network services, but also the basic platform for SAP software. A cross-site scripting vulnerability exists in SAP NetWeaver AS ABAP, which stems from insufficiently coded user-controlled input in SAP GUI for...

Kingdee CloudStar ERP suffers from deserialization vulnerability

Kingdee Cloudstar is a cloud-based enterprise resource management ERP software that provides integrated solutions for financial management, supply chain management, and business process management. A deserialization vulnerability exists in Kingdee CloudStar ERP, which can be exploited by attacker...

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CNVD-2024-07793)

Microsoft Edge is a web browser from the American company Microsoft that comes with systems after Windows 10. An elevation of privilege vulnerability exists in Microsoft Edge Chromium-based, which can be exploited by an attacker to gain elevated privileges on a system...

Mozilla Firefox Denial of Service Vulnerability (CNVD-2024-10437)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A denial of service vulnerability exists in Mozilla Firefox, which can be exploited by attackers to cause the browser to crash...

FreeImage Out-of-Bounds Read Vulnerability

FreeImage is a cross-platform open source library for supporting popular graphic image formats. An out-of-bounds read vulnerability exists in FreeImage version 3.18.0, which stems from the lack of proper validation of user-supplied data by the component Exif.cpp::ReadInt32, and can be exploited b...

GetSimple CMS Cross-Site Scripting Vulnerability

GetSimple CMS is a content management system CMS written in PHP. A cross-site scripting vulnerability exists in GetSimple CMS version 3.3.16, which stems from the lack of effective filtering and escaping of user-supplied data when adding articles to the /admin/edit.php page, and can be exploited ...

Apache Airflow Cross-Site Scripting Vulnerability (CNVD-2024-0101622)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow Apache Airflow cross-site scripting vulnerability , the vulnerabilit...

Hitachi Energy RTU500 Scripting interface Trust Management Issue Vulnerability

RTU500 is a series of industrial control components from Hitachi, Japan, mainly used for industrial control systems.RTU500 Scripting interface is part of Hitachi Energy RTU500 series of industrial control components, mainly used to provide scripting programming interface to realize specific...

Foxit Reader Arbitrary File Creation Vulnerability (CNVD-2023-96090)

Foxit Reader is a Chinese Foxit Foxit company's a PDF document reader. An arbitrary file creation vulnerability exists in Foxit Reader before version 12.1.3.15356, which can be exploited by an attacker to execute arbitrary code on the system...

Apache Airflow Authorization Problem Vulnerability (CNVD-2023-93318)

Apache HTTP Server Buffer Overflow Vulnerability CNVD-2023-93320...

Google Android Information Disclosure Vulnerability (CNVD-2023-84090)

Google Android is a Linux-based open source operating system from Google. Google Android has an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

Siemens SICAM A8000 Device CPCI85 Firmware Hardcoded Credentials Vulnerability

The SICAM A8000 RTU Remote Terminal Unit series is a modular family of devices for remote control and automation applications in all areas of energy supply. A hard-coded credentials vulnerability exists in the CPCI85 firmware of the Siemens SICAM A8000 device, which can be exploited by an attacke...

Google Chrome Buffer Overflow Vulnerability (CNVD-2023-71680)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a buffer overflow vulnerability that originates from a boundary error when the application handles untrusted input, which can be exploited by an attacker to execute arbitrary code on the system or cause th...

ScienceLogic SL1 Command Execution Vulnerability (CNVD-2023-66410)

ScienceLogic SL1 is an application from ScienceLogic, Inc. Connect your real estate together to automate multidirectional data flow and workflow. A command execution vulnerability exists in ScienceLogic SL1 11.1.2 and earlier versions, which stems from the ARP ping device tool feature failing to...

Adobe Acrobat Reader post-release reuse vulnerability (CNVD-2023-71757)

Adobe Acrobat Reader is a PDF viewer from the American company Audobee Adobe. The software is used to print, sign and annotate PDF. Adobe Acrobat Reader has a post-release reuse vulnerability that can be exploited by an attacker to bypass ASLR and cause a sensitive memory leak...

Linux kernel resource management error vulnerability (CNVD-2023-56640)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. The Linux kernel suffers from a resource management error vulnerability that stems from a hash conflict problem. An attacker could exploit this vulnerability to cause a denial ...

Milesight UR32L set_openvpn_client function buffer overflow vulnerability (CNVD-2023-65481)

The Milesight UR32L is a 4G industrial router from China's Milesight. A buffer overflow vulnerability exists in the Milesight UR32L setopenvpnclient function, which can be exploited by an attacker to cause a buffer overflow and execute arbitrary code on the system, or cause an application to cras...

Milesight UR32L zebra vlan_name function command injection vulnerability

The Milesight UR32L is a Lite industrial cellular router from Milesight. A command injection vulnerability exists in the Milesight UR32L zebra vlanname function, which can be exploited by an attacker to execute arbitrary commands on the system...

Apache Airflow ODBC Provider and MSSQL Provider Arbitrary File Read Vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. An arbitrary file read vulnerability exists in the Apache Airflow ODBC Provider and MSSQL Provider, which stems from the fact that getsqlalchemyconnection can...

Microsoft SharePoint Server Spoofing Vulnerability (CNVD-2023-53462)

Microsoft SharePoint Server is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A spoofing...

Google Chrome Code Execution Vulnerability (CNVD-2023-46125)

Google Chrome is a web browser from Google, an American company. A code execution vulnerability exists in Google Chrome, which can be exploited by an attacker to execute arbitrary code on a system or cause an application to crash...

Google Chrome on ChromeOS Memory Misreference Vulnerability

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in Google Chrome on ChromeOS versions prior to 113.0.5672.114. An attacker can exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system...

Adobe Digital Editions Buffer Overflow Vulnerability (CNVD-2023-29804)

Adobe Digital Editions DE is a set of eBook reading management software from the American company Odobi Adobe. The software supports opening, reading and managing files in PDF, XML, Flash and other formats. Adobe Digital Editions 4.5.11.187303 and earlier versions contain a buffer overflow...

Denial of Service Vulnerability in Multiple Siemens Products (CNVD-2023-35759)

Siemens SIMATIC IPC DiagMonitor is a suite of system monitoring and troubleshooting software from Siemens, Germany.The SIMATIC CP 1242-7 and CP 1243-7 LTE communication processors connect SIMATIC S7-1200 controllers to a wide area network WAN. They provide integrated security features such as...

Apache UIMA DUCC Command Injection Vulnerability

Apache UIMA DUCC is a cluster management system from the Apache Apache Foundation in the United States. The system provides tools, management and scheduling tools. Apache UIMA DUCC suffers from a command injection vulnerability that arises from improper neutralization of specific elements used wh...

Schneider Electric IGSS Data Server Access Control Error Vulnerability

Schneider Electric IGSS Data Server is a data server for the interactive graphical Scada system from Schneider Electric France. An access control error vulnerability exists in Schneider Electric IGSS Data Server, which stems from a lack of authentication of key functional identities and could be...

Adobe ColdFusion Path Traversal Vulnerability (CNVD-2023-100303)

Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. A path traversal vulnerability exists in Adobe ColdFusion. The vulnerability arises from a failure of a...

Siemens RUGGEDCOM CROSSBOW Access Control Error Vulnerability

RUGGEDCOM CROSSBOW is a secure access management solution designed to provide NERC CIP-compliant access to intelligent electronic devices. an access control error vulnerability exists in Siemens RUGGEDCOM CROSSBOW, which stems from the failure of the affected application's client-side query handl...