131391 matches found
WordPress AdRotate plugin cross-site scripting vulnerability (CNVD-2022-59803)
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plug-in. Cross-site scripting vulnerabilities exist in versions of WordPress AdRotate plugin prior to 5.8.23. The...
Google Android elevation of privilege vulnerability (CNVD-2022-32839)
Google Android is a Linux-based open source operating system from Google. Google Android has a security vulnerability that can be exploited by attackers to escalate privileges...
FANUC ROBOGUIDE path traversal vulnerability
FANUC ROBOGUIDE is a robot simulation software from FANUC, Japan.ROBOGUIDE v9.40083.00.05 and earlier versions have a path traversal vulnerability, which originates from an improper restriction of pathnames to restricted directories. An attacker can exploit this vulnerability using special elemen...
FANUC ROBOGUIDE access control error vulnerability
FANUC ROBOGUIDE is a robot simulation software from FANUC Japan.ROBOGUIDE v9.40083.00.05 and earlier versions have an access control error vulnerability that stems from not limiting or incorrectly restricting access to resources by unauthorized participants. An attacker could use this vulnerabili...
libsixel resource management error vulnerability (CNVD-2022-31765)
libsixel is a package that provides encoding/decoding implementations for DEC SIXEL graphics and other converter programs. A resource management error vulnerability exists in libsixel version 1.10.0, which stems from the presence of post-release reuse in libsixel/src/dither.c:379. An attacker cou...
WordPress WP Maintenance plugin跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WordPress plugin is an application plugin. WordPress...
pearweb authorization issue vulnerability
pearweb is a PHP extension and application repository. pearweb has a security vulnerability that stems from a weak password recovery mechanism in include/users/passwordmanage.php, and no details of the vulnerability are currently available...
SWHKD has unspecified vulnerabilities (CNVD-2022-36045)
SWHKD is a display protocol-independent hotkey daemon made in Rust. SWHKD has a security vulnerability that stems from keyboard events using an unintended user, which can be exploited by an attacker to cause information disclosure, but is usually a denial of functionality...
Owncloud ownCloud Access Control Error Vulnerability
Owncloud is a personal cloud storage solution from Owncloud, a U.S. company. versions prior to Owncloud 2.20 contain an access control error vulnerability that could be exploited by attackers to access the application's internal files...
Trend Micro Antivirus for Mac Elevation of Privilege Vulnerability (CNVD-2022-55061)
Trend Micro Antivirus for Mac is a Mac-based antivirus software from Trend Micro, Inc. An elevation of privilege vulnerability exists in Trend Micro Antivirus for Mac version 11.5, which could be exploited to create a specially crafted file as a symbol that could lead to elevation of privilege li...
KONGA elevation of privilege vulnerability
KONGA is a full-featured open source, multi-user GUI from Dutch individual developer Panagis Tselentis. version 0.14.9 of KONGA contains an elevation of privilege vulnerability that could be exploited by attackers to gain full administrative access...
IBM Spectrum Protect Plus和IBM Spectrum Copy Data Management拒绝服务漏洞
IBM Spectrum Protect Plus and IBM Spectrum Copy Data Management are both products of IBM Corporation, U.S.A. IBM Spectrum Protect Plus is a data protection platform. The platform provides enterprises with a single point of control and management and supports backup and recovery for virtual,...
Luocms SQL Injection Vulnerability (CNVD-2022-20130)
Luocms is an article management system. A SQL injection vulnerability exists in Luocms v2.0, which stems from a lack of validation of external input SQL statements in /admin/news/sortok.php. An attacker could use this vulnerability to execute illegal SQL commands to steal sensitive database data...
Mcafee WebAdvisor Access Control Error Vulnerability
McAfee WebAdvisor, an organization of Mcafee, Inc. that evaluates Web site security, also refers to the services it provides. attackers can use this vulnerability to obtain detailed information about McAfee WebAdvisor settings and user systems...
Gitea Authorization Error Vulnerability
Gitea is a project to set up a self-hosted Git service. Gitea suffers from an authorization error vulnerability that stems from PAM authentication when building and configuring Gitea, which skips checking authorization altogether and can be exploited by attackers to log into expired accounts and...
KDE Kcron permission permission and access control issues vulnerability
KDE KCron is a task scheduler. KDE Kcron is vulnerable to privilege permission and access control issues, which could be exploited by an attacker to run unauthorized commands...
Tongda2000 SQL Injection Vulnerability (CNVD-2022-71114)
Tongda2000 is a web-based intelligent office system from Tongda, China. a SQL injection vulnerability exists in Tongda2000 v11.10, which stems from the product's failure to effectively filter the special characters in the DELETESTR parameter of the delete.php file. An attacker could use this...
Cisco RCM for Cisco StarOS Software拒绝服务漏洞
Cisco RCM for Cisco StarOS Software is a denial-of-service vulnerability that could be exploited to cause the checkpoint manager process to restart upon receipt of malformed TCP data...
Adobe After Effects out-of-bounds write vulnerability (CNVD-2022-15926)
Adobe After Effects is a suite of visual effects and motion graphics software from Adobe. An out-of-bounds write vulnerability exists in Adobe After Effects 22.1.1 and prior and 18.4.3 and prior, which stems from the program not properly validating user input. An attacker could use this...
Jenkins Conjur Secrets Plugin授权问题漏洞
Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins Conjur Secrets Plugin 1.0.11 and earlier versions are vulnerable to an authorization issue that stems from not...
Foxit PDF Reader Buffer Overflow Vulnerability (CNVD-2023-49839)
Foxit PDF Reader is a Chinese Foxit Foxit company's a PDF reader. A security vulnerability exists in Foxit PDF Reader, which stems from carefully crafted data in JP2 images that can trigger the reading of data beyond the end of the allocated buffer. The vulnerability can be exploited by an attack...
Jenkins Chef Sinatra Plugin Cross-Site Request Forgery Vulnerability
The Jenkins Plugin is a plug-in that provides functionality for Jenkins. The Jenkins Chef Sinatra Plugin Cross-Site Request Forgery vulnerability allows an attacker to send an HTTP request from Jenkins to a URL that can be controlled using this vulnerability...
Google TensorFlow Input Validation Error Vulnerability (CNVD-2022-11511)
Google TensorFlow is an end-to-end open source platform for machine learning from Google USA. Google Tensorflow is vulnerable to an input validation error, which can be exploited by attackers to cause a denial of service...
WordPress MapPress Maps plugin cross-site scripting vulnerability
WordPress is the WordPress Wordpress Foundation's set of blogging platforms developed using the PHP language. A cross-site scripting vulnerability exists in versions of the WordPress MapPress Maps plugin prior to 2.73.4. The vulnerability stems from the fact that the MapPress Maps plugin does not...
Google Android Information Disclosure Vulnerability (CNVD-2022-13349)
Google Android is a Linux-based open source operating system from Google. A security vulnerability exists in Google Android, which can be exploited by an attacker to access screenshots in the clipboard via Edge Panel...
Oracle MySQL Cluster Input Validation Error Vulnerability (CNVD-2022-07925)
Oracle MySQL Cluster is a write-scalable, real-time, ACID-compatible transactional database developed by Oracle Corporation USA. Oracle MySQL Cluster is vulnerable to an input validation error, which can be exploited by attackers to execute arbitrary code...
Oracle MySQL Cluster Buffer Overflow Vulnerability (CNVD-2022-07918)
Oracle MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database developed by Oracle Corporation. Oracle MySQL Cluster is vulnerable to a buffer overflow vulnerability that could be exploited by an attacker to read the contents of memory or crash the application...
JerryScript has an unspecified vulnerability (CNVD-2022-07242)
JerryScript, a lightweight JavaScript engine from the JerryScript project, has a security vulnerability in JerryScript 3.0.0, which stems from /parser/js/js-scanner.cscannerscan statementend has an assertion contextp-stacktopuint8 == SCANSTACKTRYSTATEMENT || contextp-stacktopuint8 ==...
JerryScript ecma-helpers-string.c Denial of Service Vulnerability
JerryScript is a lightweight JavaScript engine from the JerryScript project.JerryScript has a denial-of-service vulnerability in version 3.0.0, which stems from a failed assertion in /base/ecma-helpers-string.c. An attacker could use this vulnerability to launch a denial of service...
Discourse Information Disclosure Vulnerability (CNVD-2022-05503)
Discourse is an open source community discussion platform that includes community, email and chat room features. The platform includes community, email, and chat room features.Discourse is vulnerable to an information disclosure. No detailed vulnerability details are available at this time...
Jenkins Bitbucket Branch Source Plugin Cross-Site Request Forgery Vulnerability
Jenkins is a Jenkins open source application . An open source automation server Jenkins provides hundreds of plug-ins to support building, deploying and automating any project . The Jenkins Bitbucket Branch Source Plugin suffers from a cross-site request forgery vulnerability that stems from a WE...
Garrett Metal Detectors Path Traversal Vulnerability
Garrett Metal Detectors is a walk-in metal detector from Garrett U.S.A. Garrett Metal Detectors is vulnerable to a path traversal vulnerability that could be exploited by remote attackers to submit special requests and execute arbitrary commands in the application context...
SIMATIC eaSie PCS 7 Skill Package (6DL5424- 0BX00-0AV8) Arbitrary File Download Vulnerability
SIMATIC eaSie is the digital assistant automation concept for Siemens Automation and Process Control Technology, "Totally Integrated Automation". SIMATIC eaSie PCS 7 Skill Package 6DL5424- 0BX00-0AV8 arbitrary file download vulnerability can be exploited by an attacker to read arbitrary files...
Netgear Access Control Error Vulnerability
Netgear RAX35 is a router from Netgear, Inc. A hardware device that connects two or more networks and acts as a gateway between networks.An access control error vulnerability exists in firmware versions prior to Netgear RAX35, RAX38 and RAX40 routers v1.0.4.102, which stems from a network system ...
Google Android Input Validation Error Vulnerability (CNVD-2022-02626)
Google Android is a Linux-based open source operating system from Google, Inc. Google Android is vulnerable to an input validation error that could be exploited by attackers to escalate local privileges without additional execution privileges...
Delicious Brains Advanced Custom Fields Licensing Issue Vulnerability
Delicious Brains Advanced Custom Fields is an advanced custom fields add-on from Delicious Brains Canada.An authorization issue vulnerability exists in Delicious Brains Advanced Custom Fields, which stems from a lack of authorization related to the movement of field groups. The vulnerability stem...
Linux kernel has unspecified vulnerabilities (CNVD-2022-21492)
Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. Linux kernel has a security vulnerability that can be exploited by local users to gain unauthorized access to certain data...
Open-xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2021-90762)
Open-xchange OX App Suite is a web-based cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. A cross-site scripting vulnerability exists in Open-xchange OX App Suite, which can be exploited...
Solidus Cross-Site Request Forgery Vulnerability
Solidus is an open source e-commerce system. A cross-site request forgery vulnerability exists in Solidus Solidusauthdevise, which stems from a lack of CSRF authentication in the product. An attacker could send an unintended request to the server through this vulnerability...
WordPress Insert Pages plugin cross-site scripting vulnerability
WordPress is a set of blogging platforms developed by the WordPress Foundation using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WordPress Insert Pages plugin has a cross-site scripting vulnerability in versions prior to 3.7.0, whi...
Siemens SIMATIC RTLS Locating Manager Log Information Disclosure Vulnerability
SIMATIC RTLS Locating Manager is used to configure, operate, and maintain SIMATIC RTLS units, a real-time wireless location system that provides location solutions.A log information disclosure vulnerability exists in Siemens SIMATIC RTLS Locating Manager, which stems from the fact that applicatio...
Microsoft Exchange Server Remote Code Execution Vulnerability (CNVD-2021-90307)
Microsoft Exchange Server is a set of email service programs from Microsoft Corporation USA. Microsoft Exchange Server is a remote code execution vulnerability that can be exploited by attackers to remotely execute arbitrary code on the server by sending specially crafted malicious data to the...
Sourcecodester Online Event Booking and Reservation System HTML Injection Vulnerability
Sourcecodester Online Event Booking and Reservation System is developed using PHP, MySQL database, HTML, CSS, Javascript, Bootstrap and AdminLTE. The system can be accessed by three types of users, namely system administrators, students and teachers. Sourcecodester Online Event Booking and...
D-Link DIR-823G Command Injection Vulnerability (CNVD-2021-85891)
The D-Link DIR-823G is an AC1200M dual-band gigabit wireless router.A command injection vulnerability exists in the HNAP1 protocol of the D-Link DIR-823G version 1.0.2B05. The vulnerability can be exploited to execute arbitrary web scripts via shell meta characters in the PrivateLogin field of th...
libxls null pointer dereference vulnerability
libxls is a C library that can read Excel xls files. libxls version 1.6.2 contains a null pointer dereference vulnerability in the xlsgetWorkSheet function in xls.c. An attacker could exploit the vulnerability to cause a denial of service via a specially crafted XLS file...
Foxit PDF Reader Data Forgery Problem Vulnerability
Foxit PDF Reader is China Foxit Foxit company a PDF reader. A data forgery vulnerability exists in the Foxit PDF Reader product that stems from a lack of proper validation of hidden and incremental data in digitally signed PDF files. A remote attacker can exploit this vulnerability to display...
Google Android Elevation of Privilege Vulnerability (CNVD-2021-77618)
Android is a Linux-based open source operating system developed by Google Inc. and the Open Handheld Alliance OHA. an elevation of privilege vulnerability exists in the Framework component of Google Android. An attacker could exploit this vulnerability to gain elevated privileges on the system...
Google Chrome Information Disclosure Vulnerability (CNVD-2021-99277)
Chrome is a simple and efficient web browsing tool developed by Google. An attacker could exploit this vulnerability to obtain sensitive information...
WordPress plugin uListing cross-site request forgery vulnerability
The WordPress plugin uListing is a directory and listing plugin based on Vue.js. The WordPress plugin uListing 2.0.5 and earlier versions are vulnerable to cross-site request forgery. An attacker could exploit the vulnerability to modify user roles...
Siemens Simcenter Femap Out-of-Bounds Reading Vulnerability
Siemens Simcenter Femap is a cutting-edge engineering simulation application from Siemens, Germany. An out-of-bounds read vulnerability exists in Siemens Simcenter Femap, which is used to create, edit, and import/reuse mesh-based finite element analysis models of complex products or systems. When...