Simple E-Learning System SQL Injection Vulnerability (CNVD-2022-68282)

Simple E-Learning System is a simple e-learning system. version 1.0 of Simple E-Learning System is vulnerable to SQL injection, which stems from the presence of SQL injection in classCode. No detailed vulnerability details are available at this time...

Bytebase licensing issue vulnerability

Bytebase is Bytebase's open source web-based, zero-configuration, dependency-free database schema change and version control management tool for DevOps teams. projects", which can be exploited by an attacker to view "projects" created by "Admin"...

Aruba Networks ArubaOS and InstantOS Command Execution Vulnerabilities

ArubaOS is the network operating system for Aruba Mobility Controllers, Mobility Masters, and controller-managed Access Points APs.InstantOS is an Arch Linux-based distribution. A command execution vulnerability exists in Aruba Networks ArubaOS and InstantOS. The vulnerability stems from the...

Rocket.Chat Authorization Issues Vulnerability (CNVD-2022-69165)

Rocket.Chat is an open source team chat software. A security vulnerability exists in Rocket.Chat Mobile App versions prior to 4.14.1.22788, which stems from incorrect authentication and can be exploited by an attacker to bypass local authentication...

Ivanti Endpoint Manager Elevation of Privilege Vulnerability

Ivanti Endpoint Manager EPM is a suite of endpoint security managers from Ivanti, USA. An elevation of privilege vulnerability exists in Ivanti Endpoint Manager, which stems from the "LANDeskR Management Agent" service exposing a socket that, once connected, can be used to launch commands only fo...

Caryll OTFCC otfccdump+0x6e1fc8 buffer overflow vulnerability

Caryll OTFCC is Caryll open source a C library and utility programs. Used to parse and write OpenType font files. Caryll OTFCC suffers from a buffer overflow vulnerability that originates from a boundary error in /release-x64/otfccdump+0x6e1fc8 when handling untrusted input. An attacker could...

OTFCC Buffer Overflow Vulnerability (CNVD-2023-11996)

OTFCC is a C library and utility open sourced by Caryll. It is used to parse and write OpenType font files.OTFCC suffers from a buffer overflow vulnerability, which stems from the inclusion of a heap buffer overflow, and no detailed vulnerability details are currently available...

Google Android Information Disclosure Vulnerability (CNVD-2022-81245)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability that originates from the disclosure of installed packets due to a lack of permission checking in ActivityManager. An attacker can exploit this vulnerabilit...

F5 BIG-IP DNS TMUI Denial of Service Vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A denial-of-service vulnerability exists in the F5 BIG-IP DNS TMUI, which can be exploited by an authenticated attacker with ...

Pexip Infinity Input Validation Error Vulnerability (CNVD-2022-54740)

Pexip Infinity Pexip Video Conferencing Cloud Collaboration Platform is a video conferencing cloud collaboration platform from Pexip, a Norwegian company. Pexip Infinity is vulnerable to an input validation error that could be exploited by attackers to cause a denial of service...

SAP Business One Denial of Service Vulnerability

SAP Business One is a set of enterprise management software from SAP. The software includes functions such as financial management, operations management and human resource management. A denial-of-service vulnerability exists in SAP Business One version 10.0, which stems from improper input clean...

Samsung TelephonyUI Access Control Error Vulnerability (CNVD-2022-70745)

An access control error vulnerability exists in Samsung TelephonyUI, a Telephony service for Samsung mobile devices in South Korea that provides support for the Telephony Application Programming Interface TAPI. The vulnerability stems from a lack of proper permission checking in TelephonyUI, whic...

FFmpeg decode_slice_header() function denial of service vulnerability

FFmpeg is a complete solution for recording, converting and streaming audio and video from the Ffmpeg team. A denial of service vulnerability exists in the FFmpeg decodesliceheader function, which can be exploited by an attacker to cause a denial of service attack...

PESCMS cross-site scripting vulnerability

A cross-site scripting vulnerability exists in PESCMS version V2.3.3, a content publishing platform. The vulnerability stems from App/Team/GET/Report.php missing a data validation filter for user-supplied data and output. An attacker could exploit the vulnerability to execute JavaScript code on t...

Jenkins XebiaLabs XL Release Plugin Cross-Site Request Forgery Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.Jenkins XebiaLabs XL Release Plugin 22.0....

Jenkins Recipe Plugin Cross-Site Request Forgery Vulnerability

Jenkins and Jenkins Plugin are both open source products from Jenkins.Jenkins is an application. Jenkins is an open source automation server that provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.A cross-site request forgery...

GitLab Remote Code Execution Vulnerability

GitLab is an open source, end-to-end software development platform from the U.S. company GitLab, with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. GitLab has a remote code execution vulnerability, the vulnerability...

GPAC Denial of Service Vulnerability (CNVD-2022-59871)

GPAC is a multimedia framework. GPAC MP4Box version 1.1.0 suffers from a denial of service vulnerability that originates in the gfhintertrackfinalize function. An attacker could exploit this vulnerability to cause a denial of service via a specially crafted file in the MP4Box command...

WordPress New User Approve plugin跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress New User Approve plugin versions prior to 2.4 are vulnerable to cross-site request forgery, which...

BigBlueButton Cross-Site Scripting Vulnerability (CNVD-2022-62183)

BigBlueButton is BigBlueButton community of a set of open source Web conferencing system . A cross-site scripting vulnerability exists in BigBlueButton v2.4.7 and earlier versions, which stems from a lack of checksum filtering of user-supplied and output data in the chat feature. An attacker can...

74cmsSE SQL Injection Vulnerability

74cmsSE is a free open source professional recruitment system based on PHP MYSQL. 74cmsSE is vulnerable to SQL injection, which results from a lack of validation of externally entered SQL statements in the /home/resume/index keyword parameter. An attacker could use this vulnerability to execute...

Jenkins Jianliao Notification Plugin License Issue Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. An attacker with overall/read permissions could exploit this vulnerability to...

fast-string-search denial-of-service vulnerability

fast-string-search is a search function that can search for strings using N-API and boyer-moore-magiclen. fast-string-search suffers from a denial-of-service vulnerability that stems from incorrect computation of non-string input, which can be exploited by an attacker to cause fast-string- search...

Haraj Cross-Site Scripting Vulnerability

A security vulnerability exists in Haraj v3.7, a buying and selling platform from Haraj Saudi Arabia, due to a cross-site scripting issue in the comments section of advertisements. An attacker could exploit the vulnerability to execute arbitrary Web script or HTML via a crafted POST request...

Samsung mobile SemIWCMonitor Information Disclosure Vulnerability (CNVD-2022-67281)

Samsung mobile is a cell phone from Samsung South Korea. samsung mobile SemIWCMonitor is vulnerable to an information disclosure vulnerability that stems from a configuration error in the network system or product during operation. An attacker could exploit this vulnerability to obtain MAC addres...

WordPress FiboSearch plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress FiboSearch plugin version prior to 1.17.0 has a cross-site scripting vulnerability that ste...

WordPress WP Fundraising Donation and Crowdfunding Platform SQL Injection Vulnerability

WordPress and others are products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. crow and others are open source products. crow is a C micro framework for running Web services. WordPress WP...

Online Fire Reporting System SQL Injection Vulnerability (CNVD-2022-55744)

Online Fire Reporting System is an online fire reporting system from Carlo Montero's personal developer. version v1.0 of Online Fire Reporting System is vulnerable to SQL injection, which originates from /ofrs/admin/requests/take action.php?id=Lack of validation of external input SQL statements...

Online Fire Reporting System SQL Injection Vulnerability (CNVD-2022-55746)

Online Fire Reporting System is an online fire reporting system from Carlo Montero's personal developer. version v1.0 of Online Fire Reporting System is vulnerable to SQL injection, which originates from /ofrs/classes/Master.php?f= deleterequest lacks validation for external input SQL statements,...

libjpeg Denial of Service Vulnerability (CNVD-2022-66501)

libjpeg is a C language library for processing JPEG format image data. It includes JPEG decoding, JPEG encoding and other JPEG functions. A denial of service vulnerability exists in libjpeg version 1.63, which stems from a null pointer dereference in Component::SubXOf in Component .hpp. An attack...

Owl Labs Meeting Owl Trust Management Issue Vulnerability (CNVD-2022-64973)

Owl Labs Meeting Owl is a video conferencing device from Owl Labs, Inc. Featuring an array of cameras and microphones that capture 360-degree video and audio and automatically focus on the speaker to make meetings more dynamic and inclusive, Owl Labs Meeting Owl version 5.2.0.15 is vulnerable to ...

InHand Networks InRouter302 OS Command Injection Vulnerability (CNVD-2022-59175)

InHand Networks InRouter Series is a series of routers from InHand Networks, Inc. InHand Networks InRouter302 version 3.5.37 contains an operating system command injection vulnerability that could be exploited by an attacker to cause remote code execution with the help of a specially crafted...

Fidelis Network Deception has an unspecified vulnerability (CNVD-2022-59167)

Fidelis Network Deception is a security product from Fidelis USA, Inc. It is used to detect threats and prevent data loss, with features such as detecting malicious behavior, identifying traffic anomalies, and automatically responding to advanced threats.A security vulnerability exists in version...

FacturaScripts Cross-Site Scripting Vulnerability (CNVD-2022-76230)

FacturaScripts is an ERP software. cross-site scripting vulnerability exists in versions prior to FacturaScripts 2022.07, which can be exploited by attackers to execute arbitrary javascript code, steal user cookies, execute HTTP requests, obtain "same-origin " page content, etc...

WordPress AdRotate plugin cross-site scripting vulnerability (CNVD-2022-59803)

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plug-in. Cross-site scripting vulnerabilities exist in versions of WordPress AdRotate plugin prior to 5.8.23. The...

Google Android elevation of privilege vulnerability (CNVD-2022-32839)

Google Android is a Linux-based open source operating system from Google. Google Android has a security vulnerability that can be exploited by attackers to escalate privileges...

FANUC ROBOGUIDE path traversal vulnerability

FANUC ROBOGUIDE is a robot simulation software from FANUC, Japan.ROBOGUIDE v9.40083.00.05 and earlier versions have a path traversal vulnerability, which originates from an improper restriction of pathnames to restricted directories. An attacker can exploit this vulnerability using special elemen...

FANUC ROBOGUIDE access control error vulnerability

FANUC ROBOGUIDE is a robot simulation software from FANUC Japan.ROBOGUIDE v9.40083.00.05 and earlier versions have an access control error vulnerability that stems from not limiting or incorrectly restricting access to resources by unauthorized participants. An attacker could use this vulnerabili...

libsixel resource management error vulnerability (CNVD-2022-31765)

libsixel is a package that provides encoding/decoding implementations for DEC SIXEL graphics and other converter programs. A resource management error vulnerability exists in libsixel version 1.10.0, which stems from the presence of post-release reuse in libsixel/src/dither.c:379. An attacker cou...

WordPress WP Maintenance plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WordPress plugin is an application plugin. WordPress...

pearweb authorization issue vulnerability

pearweb is a PHP extension and application repository. pearweb has a security vulnerability that stems from a weak password recovery mechanism in include/users/passwordmanage.php, and no details of the vulnerability are currently available...

SWHKD has unspecified vulnerabilities (CNVD-2022-36045)

SWHKD is a display protocol-independent hotkey daemon made in Rust. SWHKD has a security vulnerability that stems from keyboard events using an unintended user, which can be exploited by an attacker to cause information disclosure, but is usually a denial of functionality...

Owncloud ownCloud Access Control Error Vulnerability

Owncloud is a personal cloud storage solution from Owncloud, a U.S. company. versions prior to Owncloud 2.20 contain an access control error vulnerability that could be exploited by attackers to access the application's internal files...

Trend Micro Antivirus for Mac Elevation of Privilege Vulnerability (CNVD-2022-55061)

Trend Micro Antivirus for Mac is a Mac-based antivirus software from Trend Micro, Inc. An elevation of privilege vulnerability exists in Trend Micro Antivirus for Mac version 11.5, which could be exploited to create a specially crafted file as a symbol that could lead to elevation of privilege li...

IBM Spectrum Protect Plus和IBM Spectrum Copy Data Management拒绝服务漏洞

IBM Spectrum Protect Plus and IBM Spectrum Copy Data Management are both products of IBM Corporation, U.S.A. IBM Spectrum Protect Plus is a data protection platform. The platform provides enterprises with a single point of control and management and supports backup and recovery for virtual,...

Luocms SQL Injection Vulnerability (CNVD-2022-20130)

Luocms is an article management system. A SQL injection vulnerability exists in Luocms v2.0, which stems from a lack of validation of external input SQL statements in /admin/news/sortok.php. An attacker could use this vulnerability to execute illegal SQL commands to steal sensitive database data...

Mcafee WebAdvisor Access Control Error Vulnerability

McAfee WebAdvisor, an organization of Mcafee, Inc. that evaluates Web site security, also refers to the services it provides. attackers can use this vulnerability to obtain detailed information about McAfee WebAdvisor settings and user systems...

Gitea Authorization Error Vulnerability

Gitea is a project to set up a self-hosted Git service. Gitea suffers from an authorization error vulnerability that stems from PAM authentication when building and configuring Gitea, which skips checking authorization altogether and can be exploited by attackers to log into expired accounts and...

KDE Kcron permission permission and access control issues vulnerability

KDE KCron is a task scheduler. KDE Kcron is vulnerable to privilege permission and access control issues, which could be exploited by an attacker to run unauthorized commands...

Cisco RCM for Cisco StarOS Software拒绝服务漏洞

Cisco RCM for Cisco StarOS Software is a denial-of-service vulnerability that could be exploited to cause the checkpoint manager process to restart upon receipt of malformed TCP data...