MediaWiki has an unspecified vulnerability (CNVD-2023-06083)

MediaWiki is a free and free-to-use web-based wiki engine from the U.S. Wikimedia MediaWiki Foundation. A security vulnerability exists in MediaWiki, which stems from the use of file mode 0644 when installed using a pre-existing data directory with weak privileges, which allows local users to rea...

Siemens Mendix Workflow Commons Module Improper Access Control Vulnerability

Siemens Mendix Workflow Commons Module provides out-of-the-box content to help you get started building workflows in Mendix.A security vulnerability exists in Siemens Mendix Workflow Commons Module due to a failure of the affected module version to properly handle access control for certain modul...

Siemens SCALANCE X-200RNA Switch Devices Information Disclosure Vulnerability

The SCALANCE X-204RNA Industrial Ethernet Access Point enables non-PRP endpoint devices to connect to a separate parallel network as needed.An information disclosure vulnerability exists in Siemens SCALANCE X-200RNA Switch Devices, which could be exploited by an attacker to gain access to sensiti...

Google Android Elevation of Privilege Vulnerability (CNVD-2023-07647)

Google Android is a Linux-based open source operating system from Google, Inc. An elevation of privilege vulnerability exists in Google Android due to a resource exhaustion vulnerability in the NotificationChannel.java component. The vulnerability can be exploited by attackers to gain elevated...

chocolatey Python3 Permission Design Vulnerability

Python is an open source object-oriented programming language. A privilege design vulnerability exists in the Chocolatey Python3 package v3.11.0 and earlier versions, which originates from all users in the Authenticated users group having write access to the subfolder C:\Python311 and all files i...

AVEVA Edge DLL Hijacking Vulnerability

AVEVA Edge is a highly scalable and flexible HMI/SCADA software from AVEVA Software UK. A DLL hijacking vulnerability exists in AVEVA Edge 2020 R and prior versions, which could be exploited by an attacker to compromise the confidentiality, availability or integrity of a system. Details of the...

D-Link DIR-882 webGetVarString function buffer overflow vulnerability

D-Link DIR-882 is a wireless router from D-Link, China. D-Link DIR-882 firmware versions 1.10B02 and 1.20B06 contain a buffer overflow vulnerability that stems from a lack of length validation of input data in its webGetVarString function, which could be exploited to cause a denial of service or...

MyBB File Name Cross-Site Scripting Vulnerability

MyBB MyBulletinBoard is a free and web-based forum software developed by MYBB team using PHP and MySQL. The software is characterized by its simplicity, multi-language support and extensibility. A cross-site scripting vulnerability exists in MyBB before version 1.8.31, which stems from the lack o...

WBCE CMS Cross-Site Scripting Vulnerability

WBCE CMS is an open source content management system CMS based on PHP and MySQL. A cross-site scripting vulnerability exists in WBCE CMS 1.5.4 and previous versions, which stems from the lack of effective filtering and escaping of user-supplied data in the Post Loop field of the Overview Page...

Tenda AC1200 authorization error vulnerability

Tenda AC1200 is a wireless router from Tenda, China. Tenda AC1200 Router Model W15Ev2 V15.11.0.101576 is vulnerable to an authorization error. An authenticated attacker can use this vulnerability to read the router's syslog.log file, which contains the MD5 password for the administrator user...

Aruba Networks ArubaOS Input Validation Error Vulnerability

Aruba Networks ArubaOS, an operating system for Aruba Mobility-Defined Networks including mobile controllers and mobile access switches from Aruba Networks, is vulnerable to an input validation error. The vulnerability can be exploited to interrupt the normal operation of the affected access poin...

OpenCATS Cross-Site Scripting Vulnerability (CNVD-2022-70590)

OpenCats is an open source recruitment process management system. A security vulnerability exists in OpenCats version v0.9.6, which originates from an attacker being able to implement reflective cross-site scripting using its indexFile component. Currently there is no detailed vulnerability detai...

Cross-site Request Forgery Vulnerability in Import Files Function of Multiple Siemens Products

Siemens Desigo PX is a building automation control system from Siemens, a German company. A cross-site request forgery vulnerability exists in several Siemens products, stemming from a lack of validation of anti-CSRF tokens or other source checks in the Import Files feature of the "Operation" Web...

SAP 3D Visual Enterprise Viewer .iff Buffer Overflow Vulnerability

SAP 3D Visual Enterprise Viewer is a 3D view viewer from SAP, Germany. The software supports the publishing of 2D and 3D scenes in all industry-standard desktop applications and supports separate installation as a stand-alone executable program and ActiveX space. A buffer overflow vulnerability...

Huawei HarmonyOS Fingerprint Module Logic Error Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a microkernel-based, fully distributed operating system. Huawei HarmonyOS version 2.0 contains a logic error vulnerability that stems from a business logic error in the fingerprint module. An attacker could exploit the...

Johnson Controls Metasys ADX Server Licensing Issue Vulnerability

Johnson Controls Metasys ADX Server is a data server from Johnson Controls, Inc. An authorization issue vulnerability exists in Johnson Controls Metasys ADX Server version 12.0, which stems from improper access controls in the application and could be exploited by an attacker to cause an AD user ...

ZoneMinder Cross-Site Scripting Vulnerability (CNVD-2022-68293)

ZoneMinder is an open source video surveillance software system. The system supports IP, USB and analog cameras, etc. ZoneMinder has a cross-site scripting vulnerability, which stems from a lack of input validation and can be exploited by attackers to execute code...

Linux kernel hid-roccat.c resource management error vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A resource management error vulnerability exists in Linux kernel version 5.19.12 and prior versions, which stems from a contention condition in roccatreportevent in...

Bifrost Licensing Issue Vulnerability

Bifrost is a middleware package that synchronizes MySQL MariaDB binary log data to other types of databases.Bifrost 1.8.6-release and earlier versions are vulnerable to authorization issues, which stem from its vulnerability to authentication bypass when using HTTP basic authentication, which can...

FFmpeg Buffer Overflow Vulnerability (CNVD-2022-70582)

FFmpeg is software developed by individual developers that performs recording, converting, and streaming functions for a wide range of audio and video formats. A buffer overflow vulnerability exists in FFmpeg where the size calculation in buildopengopkeypoints iterates over all entries in the loo...

Caryll OTFCC otfccdump+0x4fbbb6 denial of service vulnerability

Caryll OTFCC is Caryll open source a C library and utility programs. Used to parse and write OpenType font files. A denial of service vulnerability exists in Caryll OTFCC, which originates from a segmentation conflict at /release-x64/otfccdump+0x4fbbb6. An attacker can exploit the vulnerability t...

Google TensorFlow AvgPoolOp Denial of Service Vulnerability

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A denial-of-service vulnerability exists in Google TensorFlow, which stems from the AvgPoolOp function accepting a parameter ksize , which must be positive but is not checked. An attacker could exploit...

Helm Resource Management Error Vulnerability

Helm is a Kubernetes package manager. Helm version 3.9.3 and earlier are vulnerable to a resource management error that stems from a fuzz test provided by CNCF that identifies input to a function in the strvals package that could cause an out-of-memory panic. No detailed vulnerability details are...

Mapbox buffer overflow vulnerability

Mapbox is a location data platform for mobile and Web applications from Mapbox, Inc. A buffer overflow vulnerability exists in versions prior to Mapbox gl-native 10.6.1, which stems from excessive image height and width values when creating new images, and can be exploited to cause Mapbox process...

Apache JSPWiki Cross-Site Scripting Vulnerability (CNVD-2022-83597)

Apache JSPWiki is an open source WikiWiki engine built on Java, Servlet and JSP from the Apache Foundation USA.A security vulnerability exists in versions prior to Apache JSPWiki 2.11.3, which stems from a carefully crafted request on AJAXPreview.jsp that could trigger an XSS vulnerability.This...

TOTOLINK A3600R has unspecified vulnerabilities

TOTOLINK A3600R is a 6 antenna 1200M wireless router from TOTOLINK China.A security vulnerability exists in TOTOLINK A3600R Firmware V4.1.2cu.5182B20201102 version, which originates from the inclusion of the root password in /etc/shadow.sample. contains the root password. An attacker could exploi...

Google Android Code Execution Vulnerability (CNVD-2022-65638)

Google Android is a Linux-based open source operating system from Google. A code execution vulnerability exists in Google Android. The vulnerability arises from a failure of a networked system or product to properly filter specific elements of externally entered data during the construction of a...

Microweber Cross-Site Scripting Vulnerability (CNVD-2022-54325)

Microweber is an online store management system that provides drag-and-drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, etc. A cross-site scripting vulnerability exists in versions of Microweber prior to 1.2.21, which...

Moodle Input Validation Error Vulnerability (CNVD-2022-54916)

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment.Moodle suffers from an input validation error vulnerability that stems from insufficient cleanup of SCORM tracking details, which can b...

Oracle Virtualization Input Validation Error Vulnerability (CNVD-2023-08447)

Oracle Virtualization is a virtualization solution from Oracle Corporation. It is used to unify and manage the entire hardware and software architecture from the application to the disk. Oracle Virtualization has a security vulnerability that could be exploited by an attacker to cause Oracle VM...

Jenkins XPath Configuration Viewer Plugin授权问题漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.Jenkins XPath Configuration Viewer Plugin...

Atlassian Jira Server and Data Center Server-side Request Forgery Vulnerability

Atlassian Jira Server & Data Center is the data center version of JIRA from Atlassian Australia. The software is widely used in work areas such as defect tracking, customer service, requirements gathering, process approval, task tracking, project tracking and agile management.Atlassian Jira Serve...

WordPress ARMember plugin has an unspecified vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress ARMember plugin versions prior to 3.4.8 have a security vulnerability that stems from the plugin's...

DCMTK Memory Leak Vulnerability

DCMTK is DCMTK open source a collection of libraries and applications that implement most of the DICOM standards. Software for inspecting, building and converting DICOM image files, processing offline media, sending and receiving images over a network connection, as well as demo image storage and...

GLPI SQL Injection Vulnerability (CNVD-2022-58234)

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, telephones, and even toner...

validate-data denial-of-service vulnerability (CNVD-2022-66399)

validate-data is a NodeJs backend library by Anoop P R Individual Developer. It is used to validate data according to the provided rules. A denial of service vulnerability exists in validate-data version v0.1.1, which stems from not properly handling incoming error messages and can be exploited b...

74cms Cross-Site Scripting Vulnerability (CNVD-2022-58894)

74cms is a PHP and MySQL-based online recruitment system from China Xunyi Technology Co. 74cmsSE version v3.5.1 contains a cross-site scripting vulnerability, which originates from the lack of user-supplied data and output data validation filtering in /index/notice/show. An attacker could exploit...

Jenkins vRealize Orchestrator Plugin授权问题漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project. jenkins Plugin is an application. jenkins vRealize Orchestrator Plugin 3.0...

Mitsubishi Electric MELSEC-Q Series Denial of Service Vulnerability

The Mitsubishi Electric MELSEC-Q Series is a programmable logic controller of the Mitsubishi Electric MELSEC-Q Series from Mitsubishi Electric, Japan.A denial of service vulnerability exists in the Mitsubishi Electric MELSEC-Q Series, which is caused by incorrect resource locking failure to relea...

WordPress Filr plugin authorization issue vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An authorization issue...

Siemens EN100 Ethernet module内存损坏漏洞

Siemens EN100 Ethernet Module is an Ethernet module product from Siemens, Germany. Siemens EN100 Ethernet module is vulnerable to a memory corruption vulnerability that can be exploited by attackers to crash affected applications, resulting in a denial-of-service condition...

Swftools null pointer dereference vulnerability (CNVD-2022-62212)

Swftools is a set of utilities for working with Adobe Flash files SWF files. A null pointer dereference vulnerability exists in Swftools 2020-12-22 and prior versions, which stems from the presence of a NULL pointer dereference in the function swfGetBits located in rfxswf.c. An attacker could...

Wedding Management System SQL Injection Vulnerability (CNVD-2022-54283)

Wedding Management System is a wedding planning management system by John Paul Lim Gabule, a personal developer. v1.0 of Wedding Management System is vulnerable to SQL injection, which originates from the lack of validation of external The vulnerability is caused by a lack of validation of extern...

Elitecms SQL Injection Vulnerability

Elitecms is a web content management from elitecms India. elitecms version 1.01 is vulnerable to SQL injection, which originates from admin/editsidebar.php?page=2 & sidebar The page sidebar parameter lacks validation for external input SQL statements, and an attacker could exploit the vulnerabili...

ACEware Systems ACEweb Online Portal SQL Injection Vulnerability

ACEware Systems ACEweb Online Portal is a component of the Student Manager solution from ACEware Systems, Inc. A SQL injection vulnerability exists in ACEware Systems ACEweb Online Portal version 3.5.065, which stems from The conditional parameter in showchedule.awp lacks validation for external...

Owl Labs Meeting Owl Trust Management Issue Vulnerability

Owl Labs Meeting Owl is a video conferencing device from Owl Labs, Inc. Owl Labs Meeting Owl version 5.2.0.15 is vulnerable to a trust management issue, which could be exploited by an attacker to activate network sharing mode using hard-coded hoothoot credentials via a certain c 150 value...

MariaDB Server Denial of Service Vulnerability

MariaDB is a database management system from the Mariadb Foundation and a branch version of MySQL that uses the Maria storage engine. a denial of service vulnerability exists in versions of MariaDB Server prior to 10.7, which originates in extra/mariabackup/dscompress.cc, and can be exploited to...

Fidelis Network Deception has an unspecified vulnerability (CNVD-2022-59167)

Fidelis Network Deception is a security product from Fidelis USA, Inc. It is used to detect threats and prevent data loss, with features such as detecting malicious behavior, identifying traffic anomalies, and automatically responding to advanced threats.A security vulnerability exists in version...

InHand Networks InRouter302 Input Validation Error Vulnerability (CNVD-2022-59186)

InHand Networks InRouter Series is a series of routers from InHand Networks, Inc. InHand Networks InRouter302 version V3.5.4 is vulnerable to an input validation error that originates in the libnvram.so nvramimport function userdefineinit function in the userdefinetimeoutnvram variable has...

Online Sports Complex Booking System SQL注入漏洞（CNVD-2022-58670）

Online Sports Complex Booking System is an online stadium booking system by Carlo Montero, a personal developer. page=user/manageuser&id= lacks validation of external input SQL statements, which can be exploited to execute illegal SQL commands to steal sensitive database data...