Microsoft Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability

An information disclosure vulnerability exists in Microsoft Windows Hyper-V Shared Virtual Hard Disks, a tool from Microsoft Corporation that provides hardware virtualization. The vulnerability stems from errors in the configuration of the network system or product during operation. An attacker...

Elide SQL Injection Vulnerability

Elide is a Java library. Elide is vulnerable to SQL injection, which can be exploited by attackers to execute arbitrary SQL statements...

Jenkins Continuous Integration with Toad Edge Plugin任意文件读取漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. An attacker with Item/Configure privileges can read arbitrary files on the...

Reolink Rlc-410W Denial of Service Vulnerability (CNVD-2022-37388)

Reolink Rlc-410W is a Wifi security camera from Reolink China.A denial of service vulnerability exists in Reolink RLC-410W, which can be exploited by attackers to cause a reboot via a compiled HTTP request...

Wordpress Plugin Paid Memberships Pro SQL Injection Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in Wordpress Plugin Paid Memberships Pro versions prior to 2.6....

WordPress Amelia Plugin Cross-Site Scripting Vulnerability

WordPress is a set of blogging platform developed by Wordpress Foundation using PHP language. WordPress plugin is an application plugin for WordPress. WordPress Amelia Plugin 1.0.46 and earlier versions are vulnerable to a cross-site scripting vulnerability that stems from the program's failure t...

Jenkins incapptic connect uploader Plugin has an unspecified vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project. jenkins Plugin is an application. jenkins incapptic connect uploader Plug...

WordPress MOLIE plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. WordPress MOLIE plugin has a cross-site scripting vulnerability that stems from not escaping the courseid parameter before...

Microweber Cross-Site Scripting Vulnerability (CNVD-2022-21818)

Microweber is a drag-and-drop online store management system from the Microweber community in the United States. The system includes modules for adding products, images, etc. A cross-site scripting vulnerability exists in Microweber 1.2.11 and earlier versions, which stems from a lack of filterin...

Shopware Information Disclosure Vulnerability (CNVD-2022-18524)

Shopware is a suite of open source e-commerce software from the German company Shopware.Shopware suffers from an information disclosure vulnerability that stems from not properly setting sensitive HTTP headers to be uncacheable. An attacker could exploit the vulnerability to cause the header to...

Authentication bypass vulnerability in several Schneider Electric products

The Schneider Electric APC Smart-UPS SMC Series, among others, is a product of Schneider Electric, a French company. Schneider Electric APC Smart-UPS SMT Series is a line interactive power protection for servers, point-of-sale, routers, switches, hubs and other network devices. Schneider Electric...

Microsoft Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CNVD-2022-78054)

Microsoft Windows Ancillary Function Driver for WinSock is an auxiliary function driver for Winsock from Microsoft. WinSock contains an elevation of privilege vulnerability that could be exploited by attackers to execute arbitrary code with elevated privileges...

Siemens RUGGEDCOM ROS has an unspecified vulnerability (CNVD-2022-17781)

Siemens RuggedCom ROS is an operating system used in the RuggedCom family of switches from Siemens, Germany. Siemens RUGGEDCOM ROS has a security vulnerability that could be exploited by an attacker to cause data corruption and possibly hard application failures...

Siemens RUGGEDCOM ROS Cross-Site Scripting Vulnerability

Siemens RuggedCom ROS is an operating system used in the RuggedCom family of switches from Siemens, Germany. Siemens RUGGEDCOM ROS is vulnerable to cross-site scripting, which can be exploited by attackers to retrieve sensitive information via cross-site scripting...

Elasticsearch Kibana Cross-Site Scripting Vulnerability (CNVD-2022-23464)

A cross-site scripting vulnerability exists in Elasticsearch Kibana, an open source, browser-based analysis and search Elasticsearch dashboard tool from Elasticsearch Netherlands, which stems from a lack of filtering and escaping of user data in the data preview pane. An attacker could exploit th...

Fortinet FortiAnalyzer Privilege Licensing and Access Control Issues Vulnerability

Fortinet FortiAnalyzer is a centralized network security reporting solution from Fortinet USA. The product is used to collect network log data and analyze, report, and archive security events, network traffic, and Web content in the logs through the reporting suite.Fortinet FortiAnalyzer is...

Fortinet FortiPortal Security Feature Issue Vulnerability

Fortinet FortiPortal is an advanced, feature-rich managed security analysis and management support tool for Fortinet's FortiGate, FortiWiFi, and FortiAP product lines, available as a virtual machine for use by MSPs. versions, a security feature issue vulnerability exists that stems from the use o...

Microweber logic flaw vulnerability

Microweber is an online store management system from the Microweber community in the United States that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. A logic flaw vulnerability exists in Microweber, which stems from an error in the business...

TOTOLink A3100R Command Injection Vulnerability (CNVD-2022-17024)

Totolink A3100R is a series of wireless routers from Totolink China.A command injection vulnerability exists in Totolink A3100R V4.1.2cu.5050B20200504, which stems from the failure to properly filter special characters, commands, etc. in the QUERYSTRING parameter in the Main function. An attacker...

Google TensorFlow Input Validation Error Vulnerability (CNVD-2022-14990)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. Google Tensorflow suffers from an input validation error vulnerability that stems from a lack of validation of the input tensor shape, which could be exploited to launch a denial-of-service attack...

WordPress MapPress Maps plugin cross-site scripting vulnerability

WordPress is the WordPress Wordpress Foundation's set of blogging platforms developed using the PHP language. A cross-site scripting vulnerability exists in versions of the WordPress MapPress Maps plugin prior to 2.73.4. The vulnerability stems from the fact that the MapPress Maps plugin does not...

Schneider Electric Multiple Product Information Breach Vulnerability

Schneider Electric Modicon Quantum is a large programmable logic controller PLC for process applications, high availability and safety solutions. Schneider Electric Modicon M340 is a medium-range PLC programmable logic controller for industrial processes and infrastructure. An information...

Huawei EMUI Security Bypass Vulnerability

Huawei Emui is an Android-based mobile operating system developed by Huawei, a Chinese company. A security bypass vulnerability exists in HUAWEI EMUI/Magic UI, which stems from a security protection bypass vulnerability in the modem. An attacker could exploit the vulnerability to cause a memory...

WordPress Domain Check plugin cross-site scripting vulnerability

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. a cross-site scripting vulnerability exists in the Wordpress Domain Check Plugin, which stems from the product's failure to properly handle domain parameter data when outputting to a page. An...

WordPress Perfect Survey plugin cross-site scripting vulnerability

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. WordPress Perfect Survey plugin in version 1.5.2 and prior versions suffers from a cross-site scripting vulnerability that stems from not validating and escaping the X-Forwarded-For header value,...

Google Tensorflow has an unspecified vulnerability (CNVD-2022-09894)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A security vulnerability exists in Google TensorFlow, which stems from the er optimizer in TensorFlow that can cause a denial of service by modifying the SavedModel so that issimplifiableshape will...

Navidrome SQL Injection Vulnerability

Navidrome is a web-based open source music collection server and streamer. Used to freely listen to music collections from any browser or mobile device, a SQL injection vulnerability exists in versions of Navidrome prior to 0.47.5, which stems from a lack of validation of externally entered SQL...

mruby Denial of Service Vulnerability (CNVD-2022-08157)

mruby is a lightweight implementation of the Ruby language that runs Ruby code using interpreted mode and executes it in a virtual machine. A denial of service vulnerability exists in Mruby prior to version 3.2, which stems from a null pointer dereference in mruby that can be exploited by an...

Buffer Overflow Vulnerability in Multiple Huawei Products (CNVD-2022-17397)

The Huawei CloudEngine 12800 is a 12800 series data center switch, and the Huawei Cloudengine 5800 is a 5800 series data center switch. Buffer overflow vulnerability exists in several Huawei products. The vulnerability stems from insufficient validation of certain parameters in messages, which ca...

Expat nextScaffoldPart buffer overflow vulnerability

Expat is a fast streaming XML parser written in C. A buffer overflow vulnerability exists in versions of Expat prior to 2.4.3, which stems from a boundary error in xmlparse.c in nextScaffoldPart when processing untrusted input. A remote attacker could exploit this vulnerability to execute arbitra...

Unspecified vulnerability in snipe-it (CNVD-2022-10714)

Snipe-IT is an open source IT asset/license management system. A security vulnerability exists in snipe-it that stems from faulty access control. No details of the vulnerability are provided at this time...

ENC DataVault Encryption Issues Vulnerabilities

Enc Security Enc DataVault is a solution from the Dutch company Enc Security. Turn any Usb drive into a secure removable disk for important files. ENC DataVault suffers from an encryption issue vulnerability that stems from ENC DataVault 7.1.1W using an incorrect encryption algorithm, which can b...

Mozilla Rust libpulse-binding crate memory corruption vulnerability

Rust libpulse-binding crate is a repository containing sys FFI and binding libraries crates for connecting to PulseAudio PA from the Rust programming language.Mozilla Rust libpulse-binding crate memory corruption vulnerability, which stems from a security flaw in A security vulnerability exists i...

Mozilla Rust actix-web crate memory corruption vulnerability

Rust actix-web crate is a Rust web framework. a security vulnerability exists in versions of Rust actix-web crate prior to 0.7.15, which stems from the fact that it can unreasonably prolong the life cycle of a string, which can be exploited by an attacker to cause memory corruption...

Horner Automation Cscape EnvisionRV Input Validation Error Vulnerability

Horner Automation Cscape EnvisionRV is a programming software for industrial control system development from Horner Automation, U.S. An input validation error vulnerability exists in Horner Automation Cscape EnvisionRV, which could be exploited by an attacker to execute arbitrary code in the...

Microsoft Web Media Extensions Remote Code Execution Vulnerability (CNVD-2021-101708)

The Web Media Extensions package extends Microsoft Edge and Windows 10 to support open source formats commonly found on the Web.A remote code execution vulnerability exists in Microsoft Web Media Extensions. An attacker could exploit this vulnerability to execute code on the target host...

Dell Networking OS10 Authentication Bypass Vulnerability

Dell Networking OS10 is a Linux-based network switch operating system from Dell DELL U.S.A. Dell Networking OS10 is vulnerable to an authentication bypass vulnerability that could be exploited by attackers to gain access to the affected system and perform operations...

Apache JSPWiki Cross-Site Scripting Vulnerability (CNVD-2021-92465)

Apache JSPWiki is an open source WikiWiki engine built on Java, Servlet, and JSP from the Apache Foundation.A security vulnerability exists in Apache JSPWiki, which stems from a well-designed plugin link call that could trigger an XSS vulnerability in Apache JSPWiki related to Denounce...

Open-xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2021-90764)

Open-xchange OX App Suite is a Web cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. A cross-site scripting vulnerability exists in Open-xchange OX App Suite, which can be exploited by...

Microsoft Windows Update Assistant权限提升漏洞

Microsoft Windows Update Assistant, a system update tool from Microsoft Corporation, contains an elevation of privilege vulnerability that stems from a lack of filtering and restriction on privilege handling, which could be exploited by an attacker to The vulnerability is caused by a lack of...

Lantronix PremierWave 2050 OS Command Injection Vulnerability

The Lantronix PremierWave 2050 is an embedded enterprise Wi-Fi module from Lantronix, Inc. The Lantronix PremierWave 2050 is vulnerable to an operating system command injection vulnerability that could be exploited by attackers to cause arbitrary command execution...

Jenkins code issue vulnerability (CNVD-2021-93373)

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.A code issue vulnerability exists in Jenkins Plugin that stems from the Performance plugin version 3.20 and earlier not...

Nim code issue vulnerability

Nim is a statically typed programming language from the Nim community. nim has a code issue vulnerability that can be exploited by attackers to bypass checks and launch SSRF attacks using null bytes...

Incorrect Input Validation Vulnerability in Multiple Siemens Products

Capital VSTAR is a complete solution. the Nucleus NET module integrates a range of standards-compliant networking and communications protocols, drivers and utilities to provide full-featured networking support in any embedded device. the Nucleus RTOS is a microkernel-based real-time operating...

Siemens Nucleus ReadyStart Input Validation Incorrect Vulnerability

Siemens Nucleus ReadyStart is a bundled solution from Siemens Germany. It is used to accelerate the fast start-up of complete systems and provides a rich board-level support package Bsp. A security vulnerability exists in Siemens Nucleus ReadyStart, which stems from the total length of the UDP...

Bootstrap-Table has an unspecified vulnerability

Bootstrap-Table is an open source extension table from the individual developers of China Wenzhixin that integrates with some of the most widely used Css frameworks. bootstrap-table has a security vulnerability that stems from improper design or implementation during the development of code for a...

Sourcecodester Online Event Booking and Reservation System HTML Injection Vulnerability

Sourcecodester Online Event Booking and Reservation System is developed using PHP, MySQL database, HTML, CSS, Javascript, Bootstrap and AdminLTE. The system can be accessed by three types of users, namely system administrators, students and teachers. Sourcecodester Online Event Booking and...

Apache Traffic Server Improper Input Validation Vulnerability

Apache Traffic Server, referred to as ATS or TS, is a high-performance, modular HTTP proxy and caching server. an improper input validation vulnerability exists in header parsing in Apache Traffic Server versions 8.0.0 - 8.1.2, 9.0.0 - 9.1.0. An attacker could exploit this vulnerability to smuggl...

Huawei Emui and Magic UI authentication error vulnerability

Huawei Emui is a mobile operating system developed on Android. magic Ui is a mobile operating system developed on Android. Huawei Emui and Magic UI have a security vulnerability that could be exploited by attackers to compromise service confidentiality...

aaptjs remote code execution vulnerability (CNVD-2021-84831)

aaptjs is a node wrapper for aapt. aaptjs version 1.3.1 has a remote code execution vulnerability in the crunch function. An attacker can exploit this vulnerability to execute arbitrary code via the filePath parameter...