NETGEAR R6260 mini_httpd SOAP buffer overflow vulnerability

NETGEAR R6260 is a router device. A security vulnerability exists in NETGEAR R6260 routers, which stems from the device's failure to properly validate the length of user-supplied data before copying it to a fixed-length buffer, which could be exploited by an attacker to execute code in the root...

Apache Storm code issue vulnerability

Apache Storm is a free and open source distributed real-time computing system. Apache Storm code issue vulnerability. An attacker could exploit the vulnerability to achieve remote code execution...

Google Android Elevation of Privilege Vulnerability (CNVD-2021-77618)

Android is a Linux-based open source operating system developed by Google Inc. and the Open Handheld Alliance OHA. an elevation of privilege vulnerability exists in the Framework component of Google Android. An attacker could exploit this vulnerability to gain elevated privileges on the system...

Mozilla Rust Buffer Overflow Vulnerability (CNVD-2021-85297)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. Mozilla Rust is vulnerable to a buffer overflow vulnerability that can be exploited by attackers to cause a buffer overflow or heap overflow, among other things...

Mozilla Rust Memory Corruption Vulnerability (CNVD-2021-85283)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. playXE/cgc for Mozilla Rust suffers from a memory corruption vulnerability that can be exploited by attackers to cause data contention...

OpenMage Magento LTS Input Validation Error Vulnerability (CNVD-2021-101205)

OpenMage Magento Lts Magento, an e-commerce system from the OpenMage organization, is vulnerable to an input validation error in versions prior to OpenMage Magento LTS 19.4.15 and 20.0.13, which can be exploited by attackers to upload arbitrary executable files to the server...

Six Apart Movable Type Cross-Site Scripting Vulnerability (CNVD-2022-22647)

Six Apart Movable Type MT is a blogging system from Six Apart, a US-based company. A cross-site scripting vulnerability exists in Six Apart Movable Type, which stems from the lack of proper validation of client-side data in the WEB application and can be exploited to inject arbitrary script or HT...

openssl buffer overflow vulnerability (CNVD-2021-71263)

OpenSSL is an open source general-purpose cryptographic library from the Openssl team capable of implementing the Secure Sockets Layer SSLv2/v3 and Secure Transport Layer TLSv1 protocols. The product supports a variety of encryption algorithms, including symmetric ciphers, hashing algorithms,...

GPAC Project on Advanced Content Integer Overflow Vulnerability (CNVD-2021-64077)

GPAC Project on Advanced Content is an open source cross-platform library that implements the MPEG-4 system standard and provides tools for media playback, vector graphics, and 3D rendering. an integer overflow vulnerability exists in the MPEG-4 decoding functionality in GPAC Project on Advanced...

lin-cms-flask has an unspecified vulnerability

lin-cms-flask is a content management system framework. lin-cms-flask version 0.1.1 contains a security vulnerability that can be exploited by remote attackers to brute force login via the "login" function in the component "app/api/cms/user.py"...

Apache ServiceComb Service-Center path traversal vulnerability

Apache ServiceComb Service-Center is a Restful-based service registry from the Apache Foundation that provides microservice discovery and microservice management. Apache ServiceComb Service-Center is vulnerable to a path traversal vulnerability in version 1.x.x. The vulnerability stems from A...

WordPress Quiz Maker plugin SQL Injection Vulnerability

WordPress is a set of blogging platform developed by Wordpress Foundation using PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.Quiz Maker plugin is an application plugin for WordPress. A SQL injection vulnerability exists in WordPress Quiz Maker...

Google Chrome Post-release Reuse Vulnerability (CNVD-2021-62185)

Chrome is a web browsing tool developed by Google, and a post-release reuse vulnerability exists in the Page Info UI in versions prior to Google Chrome 92.0.4515.131. A remote attacker could use this vulnerability to execute arbitrary code or cause a denial of service condition on the system...

ECTouch SQL Injection Vulnerability

ECTouch is an application. An open source mobile mall system to create an enterprise exclusive mobile mall. ECTouch suffers from a SQL injection vulnerability, which originates from the SQL injection vulnerability in ECTouch v2 generated through the integralmin parameter in index.php. An attacker...

Unspecified Vulnerability in Exiv2 (CNVD-2021-62175)

Exiv2 is a suite of C++ libraries and command line applications for managing image metadata. It provides the ability to read and write image metadata in a variety of formats including EXIF, IPTC and XMP. A security vulnerability exists in Exiv2 v0.27.1, which stems from a buffer overflow...

Nextcloud Trust Management Issues Vulnerability (CNVD-2021-42394)

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud, which stems from the vulnerability of the Nextcloud desktop client prior to 3.3.1 to incorrect certificate...

HTMLDOC resource management error vulnerability

HTMLDOC is an open source program that converts HTML and Markdown files to EPUB, Indexed HTML, PostScript, and PDF formats.A resource management error vulnerability exists in HTMLDOC, which stems from the pspdfexport function in ps-pdf.cxx when processing JPEG images A boundary error exists. A...

Vaadin flow has an unspecified vulnerability

Vaadin flow is an application. vaadin platform Java framework for building modern websites that look good, perform well and keep you and your users happy. vaadin: flow-server versions 3.0.0 through 5.0.3 have a security vulnerability that can be exploited by attackers to guess the security token ...

Atlassian Jira Server and Jira Data Center have unspecified vulnerabilities

Atlassian JIRA Server and Atlassian JIRA Data Center are both products of Atlassian Australia, Atlassian JIRA Server is a server version of a defect tracking management system. Atlassian JIRA Data Center is the data center version of Atlassian JIRA. Atlassian JIRA Server and Atlassian JIRA Data...

BaserCMS OS Command Injection Vulnerability

BaserCMS is an open source enterprise-level content management system cms. An OS command injection vulnerability exists in BaserCMS versions prior to 4.4.5. A remote attacker with administrator privileges can exploit this vulnerability to execute arbitrary OS commands...

Zen Cart Cross-Site Scripting Vulnerability (CNVD-2021-22861)

Zen Cart is open source, free mall system for building professional online stores. A reflective cross-site scripting vulnerability exists in Zen Cart 1.5.6d. An attacker can execute malicious script via the includes/templates/templatedefault/common/tplmainpage.php or...

Open Build Service Cross-Site Scripting Vulnerability

Open Build Service OBS is a general-purpose system for building and distributing packages from source code in an automated, consistent, and repeatable manner, organized by the Open Build Service. A cross-site scripting vulnerability exists in Open Build Service that stems from a lack of proper...

Huawei Manageone logic vulnerability

Huawei Manageone is a cloud data center management solution from Huawei of China. Huawei Manageone has a security vulnerability that could be exploited by attackers to cause service anomalies...

Unspecified Vulnerability in Rust (CNVD-2021-13698)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in Rust glsl-layout crate before 0.4.0, which stems from double deletion of maparray when panic occurs. No details of the vulnerability are provided at this time...

Unspecified vulnerability in Mozilla Rust flatbuffers crate

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in flatbuffers crate in versions of Mozilla Rust prior to 2020-04-11, no details of the vulnerability are provided at this time...

Symantec Endpoint Detection

Symantec Endpoint Detection And Response uses AI, IR automation and threat intelligence to detect, find, isolate and eliminate intrusions across all endpoints. symantec Endpoint Detection...

Microsoft Windows/Windows Server Elevation of Privilege Vulnerability (CNVD-2021-90796)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, an operating system for personal devices, and Microsoft Windows Server, a server operating system. An elevation of privilege vulnerability exists in the Common Log File System driver in Microsoft...

Microsoft .NET Core and ASP.NET Core Security Feature Bypass Vulnerability

Microsoft .NET Core and Microsoft ASP.NET Core are both products of Microsoft Corporation USA. NET Core is a free open source development platform. NET Core is a free open source development platform with multi-language support and cross-platform features.Microsoft ASP.NET Core is a framework of...

Nextcloud Desktop Client Cross-Site Scripting Vulnerability

Nextcloud is a suite of client-server software for creating file hosting services and using them.Nextcloud Desktop Client is the Nextcloud desktop client. A cross-site scripting vulnerability exists in Nextcloud Desktop Client 2.6.4. An attacker can exploit this vulnerability via an invalid serve...

WordPress Nexos theme cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.Nexos theme is a real estate website theme plugin used in it. A cross-site scripting vulnerability exists in WordPress Nexos...

Net-SNMP Resource Management Error Vulnerability

Net-SNMP is an open source Simple Network Management Protocol SNMP software. The software is used to monitor network devices, computer devices, UPS devices and so on. A resource management error vulnerability exists in the usmfreeusmStateReference of the snmplib/snmpusm.c file in versions of...

Redis Labs Redis Input Validation Error Vulnerability

Redis Labs Redis is the United States Redis Labs, Inc. of a set of open-source use of ANSI C written to support the network , can be based on the memory can also be a persistent log-type , key-value Key-Value storage database , and provides a variety of languages API. An input validation error...

Inductive Automation Ignition Access Control Error Vulnerability

Inductive Automation Ignition is a suite of integrated software platforms for SCADA systems from Inductive Automation, Inc. The platform supports SCADA data acquisition and monitoring systems, HMI human machine interface and more. An access control error vulnerability exists in Inductive Automati...

TYPO3 Backend User Interface and Install Tool Component Cross-Site Scripting Vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. A security vulnerability exists in the Backend User Interface and Install Tool components in TYPO3 versions 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1. An attacker could exploit the...

Red Hat Keycloak Information Disclosure Vulnerability (CNVD-2020-20715)

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. An information disclosure vulnerability exists in Red Hat keycloak versions prior to 9.0.1, which stems from the program's inability to send...

Microsoft Internet Explorer Scripting Engine Remote Code Execution Vulnerability (CNVD-2020-19962)

Microsoft Internet Explorer IE is a Web browser that comes with the Windows operating system from the American company Microsoft. A remote code execution vulnerability exists in the way the scripting engine handles memory objects in Microsoft IE 11. An attacker could exploit this vulnerability to...

Remote Code Execution Vulnerability in Multiple Microsoft Products (CNVD-2020-19966)

Microsoft ChakraCore and others are products of Microsoft Corporation.ChakraCore is the core of an open-source Chakra JavaScript scripting engine used in the Edge browser, or as a standalone JavaScript engine.Microsoft Edge is a web browser that comes with Windows 10 and later.Microsoft Internet...

IBM Spectrum Protect Plus Command Injection Vulnerability (CNVD-2020-14213)

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A command injection vulnerability exists in...

Vanilla cross-site scripting vulnerability (CNVD-2020-04666)

Vanilla is an open source multi-language, fully extensible forum program. A cross-site scripting vulnerability exists in Vanilla version 2.6.3 in index.php?p = / dashboard / settings / branding. The vulnerability stems from a lack of proper validation of client-side data in the web application. A...

fig2dev buffer overflow vulnerability (CNVD-2021-79776)

fig2dev is a tool for printing and exporting .fig format files. A buffer error vulnerability exists in the 'readtextobject' function of the read.c file in fig2dev version 3.2.7b. The vulnerability stems from a networked system or product that does not properly validate data boundaries when...

phpMyAdmin SQL Injection Vulnerability (CNVD-2019-45016)

phpMyAdmin is a free, web-based MySQL database management tool from the phpMyAdmin team. The tool is capable of creating and deleting databases, creating, deleting, and modifying database tables, executing SQL script commands, and more. A SQL injection vulnerability exists in versions of phpMyAdm...

SchedMD Slurm SQL Injection Vulnerability (CNVD-2019-22782)

SchedMD Slurm is SchedMD's open source and highly scalable cluster management and job scheduling system for large and small Linux clusters. A SQL injection vulnerability exists in SchedMD Slurm versions 17.11.x, 18.08.0 through 18.08.7 and 19.05.0. The vulnerability stems from a lack of validatio...

LIVE555 Memory Leak Vulnerability

LIVE555 is a set of open source C++ libraries for multimedia streaming. LIVE555 suffers from a memory leak vulnerability. The vulnerability stems from because when multiple instances of a single field username, realm, nonce, uri, or response exist, only the last instance can be freed. An attacker...

Freeware Advanced Audio Decoder 2 Buffer Overflow Vulnerability (CNVD-2019-05832)

Freeware Advanced Audio Decoder 2 FAAD2 is an open source MPEG-4 and MPEG-2 AAC decoder licensed under the GPLv2 license. A stack buffer overflow vulnerability exists in the third instance of the calculategain function in libfaad/sbrhfadj.c in Freeware Advanced Audio Decoder 2 FAAD2 2.8.8, which...

Ansible Information Disclosure Vulnerability (CNVD-2018-25747)

Ansible is a computer system configuration manager from Ansible, Inc. that can be used to publish, manage and orchestrate computer systems. An information disclosure vulnerability exists in Ansible, which can be exploited by an attacker to obtain sensitive data in vvv+ mode...

Apache Tomcat JK (mod_jk) Connector Directory Traversal Vulnerability

Apache Tomcat JK modjk Connector is a U.S. Apache Apache Software Foundation Apache for Apache or IIS to provide a connection to the backend Tomcat module , which supports clustering and load balancing and so on. A directory traversal vulnerability exists in Apache Tomcat JK modjk Connector...

Red Hat OpenShift Container Platform Denial of Service Vulnerability

Red Hat OpenShift Container Platform is an application platform from Red Hat that enables organizations to develop, deploy and manage existing container-based applications across physical, virtual and public cloud infrastructures. A denial of service vulnerability exists in Red Hat OpenShift...

Atlassian Universal Plugin Manager Cross-Site Scripting Vulnerability

Atlassian Universal Plugin Manager is a set of tools from Atlassian Australia for managing add-ons in Atlassian applications. A cross-site scripting vulnerability exists in the NotificationRepresentationFactoryImpl class in Atlassian Universal Plugin Manager versions prior to 2.22.9. A remote...

Micro Focus Secure Messaging Gateway Web Administration Component Operating System Command Injection Vulnerability

Micro Focus Secure Messaging Gateway SMG is a suite of outbound and inbound protection software for enterprise networks and messaging systems from the UK-based Micro Focus. The product includes features such as virus protection, anti-spam, anti-DDos attacks, and image analysis.Web administration ...

Apache HTTP Server Denial of Service Vulnerability (CNVD-2018-06536)

Apache HTTP Server is the United States Apache Apache Software Foundation, an open source web server. The server is fast, reliable and can be expanded through a simple API. There is a security vulnerability in Apache HTTP Server. An attacker can exploit this vulnerability by sending a specially...