Google Android Elevation of Privilege Vulnerability (CNVD-2021-77618)

Android is a Linux-based open source operating system developed by Google Inc. and the Open Handheld Alliance OHA. an elevation of privilege vulnerability exists in the Framework component of Google Android. An attacker could exploit this vulnerability to gain elevated privileges on the system...

Google Chrome Information Disclosure Vulnerability (CNVD-2021-99277)

Chrome is a simple and efficient web browsing tool developed by Google. An attacker could exploit this vulnerability to obtain sensitive information...

WordPress plugin uListing cross-site request forgery vulnerability

The WordPress plugin uListing is a directory and listing plugin based on Vue.js. The WordPress plugin uListing 2.0.5 and earlier versions are vulnerable to cross-site request forgery. An attacker could exploit the vulnerability to modify user roles...

Siemens Simcenter Femap Out-of-Bounds Reading Vulnerability

Siemens Simcenter Femap is a cutting-edge engineering simulation application from Siemens, Germany. An out-of-bounds read vulnerability exists in Siemens Simcenter Femap, which is used to create, edit, and import/reuse mesh-based finite element analysis models of complex products or systems. When...

Google TensorFlow buffer overflow vulnerability (CNVD-2021-64528)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A security vulnerability exists in Google TensorFlow, which stems from the fact that in affected versions, an attacker can cause undefined behavior by binding references to null pointers in...

Nexus Control Panel Elevation of Privilege Vulnerability

Swisslog Healthcare Nexus Panel is a medical device from Swisslog Healthcare.An elevation of privilege vulnerability exists in versions prior to Nexus Control Panel 7.2.5.7. An attacker could exploit this vulnerability to gain root access to the device, which would allow access to all device...

Foxit PDF Reader Remote Code Execution Vulnerability (CNVD-2021-59170)

Foxit PDF Reader is a PDF reader. Foxit PDF Reader handles Javascript with a security vulnerability that can be exploited by attackers to execute arbitrary code...

S-CMS Cross-Site Scripting Vulnerability (CNVD-2021-58258)

S-CMS 3.0 has a cross-site scripting vulnerability, which can be exploited by attackers via the "Copyright" text box under "Basic Settings" to execute arbitrary Web scripts or HTML. The vulnerability can be exploited to execute arbitrary Web scripts or HTML via the "Copyright" text box under "Bas...

Siemens Jt2go and Siemens Teamcenter Visualization Out-of-Bounds Writing Vulnerability

Siemens Jt2go and Siemens Teamcenter Visualization are both products of Siemens AG, Germany. Siemens Jt2go is a JT file viewer. An out-of-bounds write vulnerability exists in Siemens JT2Go versions prior to 13.2 and Teamcenter Visualization versions prior to 13.2. The vulnerability stems from a...

WordPress Currency Switcher plugin cross-site request forgery vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in WordPress Currency Switcher plugin 1.1.6 and prior...

WordPress Plugin Cross-Site Scripting Vulnerability (CNVD-2021-59601)

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Plugin is a WordPress open source application plugin. WordPress' VikRentCar has a cross-site scripting...

phpIPAM cross-site scripting vulnerability (CNVD-2021-45440)

phpIPAM is a PHP-based open source ip address management software. A reflected cross-site scripting vulnerability exists in phpIPAM version 1.4.3. The vulnerability can be exploited by an attacker to conduct a cross-site scripting attack via app/dashboard/widgets/ipcalc-result.php and...

Advantech WebAccess HMI Designer Buffer Overflow Vulnerability (CNVD-2021-60558)

Advantech WebAccess HMI Designer is a human-machine interface integrated development tool from Advantech of Taiwan, China. WebAccess HMI Designer 2.1.9.95 and earlier versions contain a security vulnerability that could be exploited by remote attackers to trigger a heap-based buffer overflow and...

WordPress Visitors plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Visitors is a plugin for WordPress. A cross-site scripting vulnerability exists in WordPress Visitors plugin version 0.3 and earlier,...

Google TensorFlow Denial of Service Vulnerability (CNVD-2021-36563)

Google TensorFlow is an end-to-end open source machine learning platform. A denial of service vulnerability exists in the tf.rawops.AddManySparseToTensorsMap implementation in TensorFlow versions prior to 2.5.0. An attacker could exploit this vulnerability to cause a CHECK-failure denial of servi...

Foxit Reader Code Execution Vulnerability (CNVD-2021-38092)

Foxit Reader old name: Foxit PDF Reader is a set of software used to read PDF format files, by Fujian Foxit Software developed by Foxit Reader is a set of free to use the software, the operating system is mainly based on Microsoft Windows, and as long as there is a Win32 implementation of the...

Skyworth Digital Technology RN510 Access Control Error Vulnerability

The RN510 is a dual-band wireless AC2100 access point from Skyworth Digital Technology. An access control error vulnerability exists in /cgi-bin/testversion.asp in the Skyworth Digital Technology RN510 version V.3.1.0.4. An attacker can exploit the vulnerability to obtain the SSID password and We...

Mike Perham sidekiq cross-site scripting vulnerability

Mike Perham sidekiq is a Mike Perham open source application. Use threads to process many jobs simultaneously in the same process A cross-site scripting vulnerability exists in Mike Perham Sidekiq version 5.1.3 and earlier and 6.x series version 6.2.0 and earlier, which can be exploited by an...

Nvidia GPU Display Driver Elevation of Privilege Vulnerability

The Nvidia GPU Display Driver is a driver from Nvidia that is used for interactive support of the graphics card display module in the operating system. An elevation of privilege vulnerability exists in NVIDIA GPU Display Driver for Windows and Linux all versions, which stems from a user-mode clie...

Mozilla Rust rocket crate competitive conditions issue vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A contention condition issue vulnerability exists in rocket crate in versions of Mozilla Rust prior to 0.4.5, which stems from LocalRequest::clone creating multiple mutable references to the same object, which c...

Unspecified Vulnerability in Mozilla Rust (CNVD-2021-30438)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability in prost crate in Mozilla Rust versions prior to 0.6.1, which stems from stack consumption via crafted messages, can be exploited by an attacker to cause a denial of service or remote co...

GitLab Github Project Import Restriction Bypass Vulnerability

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. A Github project import restriction bypass vulnerability exists in GitLab versions prior to 13.1. A...

NVIDIA Linux GPU Display Driver Competitive Conditions Issue Vulnerability

NVIDIA Linux GPU Display Driver is a graphics processor GPU graphics card driver from NVIDIA dedicated to the Linux platform. A security vulnerability exists in the NVIDIA Linux GPU Display Driver. An attacker could exploit this vulnerability to cause a denial of service...

Apache SkyWalking SQL Injection Vulnerability

Apache SkyWalking is an application performance monitor from the Apache Software USA Foundation primarily for environments such as microservices, cloud-native and container-based. An SQL injection vulnerability exists in the H2/MySQL/TiDB storage implementation in Apache SkyWalking versions 6.0.0...

Citrix Systems Citrix ShareFile storage zones Controller path traversal vulnerability (CNVD-2020-41790)

Citrix Systems Citrix ShareFile is a file sharing solution from Citrix Systems. storage zones Controller is one of the storage zone controllers. A path traversal vulnerability exists in Citrix Systems Citrix ShareFile storage zones Controller. An attacker can exploit this vulnerability to access...

Triangle MicroWorks DNP3 Outstation Libraries Buffer Overflow Vulnerability

Triangle MicroWorks DNP3 Outstation Libraries is a software library from Triangle MicroWorks that adds support for industry standard communication protocols to devices. A buffer has been vulnerability exists in Triangle MicroWorks DNP3 Outstation Libraries versions 3.16.00 through 3.25.01, which...

Kiali Trust Management Issues Vulnerabilities

Kiali is an open source, visual management tool for the Istio microservices architecture. A trust management issue vulnerability exists in the default configuration file in versions of Kiali prior to 1.15.1. The vulnerability stems from the fact that the file comes with a hard-coded encryption ke...

Microsoft Internet Explorer Scripting Engine Remote Code Execution Vulnerability (CNVD-2020-19968)

Microsoft Internet Explorer IE is a Web browser that comes with the Windows operating system from the American company Microsoft. A remote code execution vulnerability exists in the way the scripting engine handles memory objects in Microsoft IE 11. An attacker could exploit this vulnerability to...

Google Android Remote Code Execution Vulnerability (CNVD-2020-04546)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. A remote code execution vulnerability exists in Google Android. An attacker can exploit the vulnerability to obtain URL administrator privileges...

Apache HTTP Server Local Elevation of Privilege Vulnerability

Apache HTTP Server is the United States Apache Apache Software Foundation of an open source web server . A local elevation of privilege vulnerability exists in Apache HTTP Server. An attacker could exploit the vulnerability to gain elevated privileges on an affected application...

LibTIFF tif_unix function null pointer reference vulnerability

LibTIFF is a library for reading and writing TIFF Tagged Image File Format files. The library contains some command line tools for working with TIFF files. A null pointer reference vulnerability exists in the LibTIFF tifunix function. An attacker could exploit this vulnerability to cause a denial...

Fortify Software Security Center (SSC) XXE Vulnerability

Micro Focus Fortify Software Security Center SSC is a software security management platform from Micro Focus UK. A XXE vulnerability exists in Fortify Software Security Center SSC that could allow a remote, unauthenticated user to read arbitrary files or conduct server-side request forgery SSRF...

GitStack Server User Add Vulnerability

GitStack is a Windows-based version control system. A security vulnerability exists in GitStack 2.3.10 and earlier versions, which stems from the program's failure to adequately filter user input. The vulnerability can be exploited to add a user to the server by sending the username and password...

3CX Phone System Directory Traversal Vulnerability

3CX Phone System is a unified communications solution that includes web conferencing, IP telephony, and cell phone clients.Management Console is one of the management console programs. A directory traversal vulnerability exists in Management Console in 3CX Phone System version 15.5.3554.1. An...

Symantec Messaging Gateway Remote Code Execution Vulnerability (CNVD-2017-28446)

Symantec Messaging Gateway is a suite of anti-spam, anti-virus, advanced content filtering and data leakage protection technologies from Symantec. A remote code execution vulnerability exists in Symantec Messaging Gateway versions prior to 10.6.3-267. A remote attacker could exploit this...

Potrace de-zero error vulnerability

potrace is a set of bitmap image processing tools developed by software developer Peter Selinger. The tool offers the ability to add smoothing effects, free scaling of images, and more. A divide-by-zero error vulnerability exists in potrace bitmap.h. A remote attacker can exploit this vulnerabili...

Multiple SQL Injection Vulnerabilities in mccart.xls Bitrix Module

Multiple SQL injection vulnerabilities exist in the mccart.xls Bitrix module. Multiple SQL injection vulnerabilities exist in the Bitrix module due to the "xlsprofile" HTTP GET parameter passed to the "/bitrix/admin/mcartxlsimport.php" script; the "/bitrix/admin/mcartxlsimport.php" script; the...

OpenStack Object Storage Information Disclosure Vulnerability

OpenStack is a cloud platform management program developed by the National Aeronautics and Space Administration in collaboration with Rackspace in the U.S. OpenStack Object Storage a.k.a. Swift is one of these programs used to storage project for storing permanent static data. A security...

Jetty Information Disclosure Vulnerability

Jetty is an open source servlet container , it is based on Java web content , such as JSP and servlet to provide a runtime environment . Jetty has an information disclosure vulnerability that allows attackers to obtain sensitive information...

TOTOLINK A702R Buffer Overflow Vulnerability

The TOTOLINK A702R is a router device manufactured by China's Gion Electronics TOTOLINK. The TOTOLINK A702R suffers from a buffer overflow vulnerability that originates from improper handling of the submit-url parameter in the /boafrm/formWlSiteSurvey file in the HTTP POST request handling...

Apache Hive Authorization Issues Vulnerability

Apache Hive is a set of data warehouse software based on Hadoop Distributed Systems Infrastructure from the Apache Apache Foundation in the United States. The software provides a data integration approach and a high-level query language to support large-scale data analysis on Hadoop. An...

WAVLINK AC3000 internet.cgi set_add_routing function's gateway parameter command injection vulnerability

WAVLINK AC3000 is a wireless router from China Ruiyin WAVLINK. A command injection vulnerability exists in the WAVLINK AC3000 M33A8.V5030.210505 version, which originates from the failure of the gateway parameter of the internet.cgi setaddrouting function to correctly filter the construct command...

Siemens Tecnomatix Plant Simulation Out-of-Bounds Write Vulnerability (CNVD-2024-45993)

Siemens Tecnomatix Plant Simulation is an industrial control device from Siemens, Germany. Using the function of discrete event simulation for production volume analysis and optimization, and thus improve the manufacturing system performance. Siemens Tecnomatix Plant Simulation suffers from an...

Google Chrome Code Execution Vulnerability (CNVD-2024-48377)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a code execution vulnerability that is caused by type confusion in V8. An attacker can exploit the vulnerability to execute arbitrary code on the system...

Siemens SIMATIC RFID Readers Improper Access Control Vulnerability

SIMATIC RF600 Readers are used for contactless identification of a variety of objects such as shipping containers, pallets, production goods, or often for recording bulk goods.SIMATIC RF1100 is an RFID-based solution for simple and versatile electronic authorization management.SIMATIC RF360R read...

NetIQ Advanced Authentication Command Execution Vulnerability

NetIQ Advanced Authentication is an application from NetIQ UK. It provides a more secure way to protect your sensitive information by moving away from usernames and passwords. A command execution vulnerability exists in NetIQ Advanced Authentication versions prior to 6.3.5.1, which can be exploit...

Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability (CNVD-2024-37703)

Cisco Identity Services Engine is an environment-aware platform from the U.S. company Cisco Cisco. Cisco Identity Services Engine has a cross-site request forgery vulnerability that can be exploited by a remote attacker to construct a malicious URI, induce a request, and can perform malicious...

Bolt CMS Cross-Site Scripting Vulnerability (CNVD-2024-35158)

Bolt CMS is Bolt CMS open source PHP-based open source content management system . A cross-site scripting vulnerability exists in Bolt CMS version 3.7.1, which stems from the parameter textarea in the file /bolt/editcontent/showcases that causes cross-site scripting. No details of the vulnerabili...

Apache StreamPipes Security Feature Issue Vulnerability

Apache StreamPipes is a self-service industrial IoT toolkit from the Apache USA Foundation that enables non-technical users to connect, analyze and explore IIoT data streams. Apache StreamPipes suffers from a security signature issue vulnerability that stems from the presence of a cryptographical...

Mozilla Firefox Spoofing Vulnerability (CNVD-2024-29137)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A spoofing vulnerability exists in versions of Mozilla Firefox prior to 127, which can be exploited by an attacker to spoof the location URL bar...