MeterSphere Denial of Service Vulnerability

MeterSphere is MeterSphere open source one-stop open source continuous testing platform. MeterSphere 2.9.1 and previous versions of a denial of service vulnerability , the vulnerability stems from the submission of a very long password during login , it will force the system to perform a long...

Google Chrome PDF component memory misreference vulnerability (CNVD-2023-46113)

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in the Google Chrome PDF component, which can be exploited by an attacker to execute arbitrary code on the system or cause an application to crash...

Google Chrome DevTools memory misreference vulnerability (CNVD-2023-43874)

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in versions prior to Google Chrome 113.0.5672.126, which stems from a confusion in the DevTools instruction responsible for freeing memory. An attacker could use this vulnerability to...

Google Chrome ANGLE out-of-bounds read vulnerability

Google Chrome is a web browser from Google, Inc. An out-of-bounds read vulnerability exists in versions of Google Chrome prior to 111.0.5563.110, which stems from a lack of proper validation of user-supplied data by ANGLE, where specially crafted data could trigger a read beyond the end of the...

Mozilla Firefox Code Problem Vulnerability (CNVD-2023-68213)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from a code issue vulnerability that stems from the fact that by displaying a prompt with a long description, a full-screen notification may be hidden, which can be exploited by...

Google Android Licensing Issue Vulnerability (CNVD-2023-08088)

Google Android is a Linux-based open-source operating system from the U.S. company Google. Google Android is vulnerable to authorization issues that can be exploited by remote attackers to cause authentication bypass...

F5 BIG-IP APM Virtual Server Open Redirect Vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. An open redirection vulnerability exists in the F5 BIG-IP APM virtual server, which can be exploited by an unauthenticated...

Siretta QUARTZ-GOLD OS Command Injection Vulnerability (CNVD-2023-17081)

Siretta QUARTZ-GOLD is a high-speed dual-port Gigabit Ethernet industrial router from Siretta.The Siretta QUARTZ-GOLD is vulnerable to an operating system command injection vulnerability that could be exploited by an attacker to cause arbitrary command execution by sending a crafted network reque...

Oracle VM VirtualBox has an unspecified vulnerability (CNVD-2023-05477)

A security vulnerability exists in Oracle VM VirtualBox, a virtual machine management software from Oracle Corporation. A low privilege attacker can compromise Oracle VM VirtualBox by logging into the infrastructure where Oracle VM VirtualBox is executing...

FFmpeg Denial of Service Vulnerability (CNVD-2023-64453)

FFmpeg is a complete solution for recording, converting and streaming audio and video from the FFmpeg team. A denial of service vulnerability exists in FFmpeg, which stems from a lack of return value checking in the decodemainheader function in the libavformat/nutdec.c file and triggers a null...

Zendo Project Management System Remote Command Execution Vulnerability

Zendo Project Management System is a homegrown open source project management software. A remote command execution vulnerability exists in Zendo Project Management System. The vulnerability is caused by not exiting the program properly during the authentication process, resulting in an...

Microsoft Office Remote Code Execution Vulnerability (CNVD-2023-18288)

Microsoft Office is a suite of office software based on the Windows operating system developed by Microsoft. A remote code execution vulnerability exists in Microsoft Office. An attacker could exploit this vulnerability to execute code on the target host...

SAP BusinessObjects Business Intelligence Platform Cross-Site Scripting Vulnerability (CNVD-2023-03049)

SAP BusinessObjects Business Intelligence Platform is a complete business analytics platform from SAP. The platform combines market-leading SAP data integration products, data management products, and business intelligence BI products to eliminate system integration challenges and deploy...

Microsoft 3D Builder Remote Code Execution Vulnerability (CNVD-2023-04319)

Microsoft 3D Builder is a tool for creating models and 3D printing from Microsoft USA. a security vulnerability exists in Microsoft 3D Builder. No details of the vulnerability are currently available...

IBM AIX Denial of Service Vulnerability (CNVD-2023-00804)

IBM AIX is an open standards-based UNIX operating system developed by International Business Machines IBM for the IBM Power architecture. IBM AIX suffers from a denial-of-service vulnerability that can be exploited by unauthorized local attackers to achieve a denial of service via the AIX SMB...

OpenImageIO Stack Buffer Overflow Vulnerability

OpenImageIO is an image read and write library that also provides several tools and applications. A stack buffer overflow vulnerability exists in the TGA file format parser in OpenImageIO v2.3.19.0. An attacker could exploit this vulnerability to cause out-of-bounds writes and arbitrary code...

Apache Traffic Server Cross-Site Scripting Vulnerability (CNVD-2023-03922)

Apache Traffic Server ATS is a set of scalable HTTP proxy and cache servers from the Apache Foundation. Apache Traffic Server suffers from a cross-site scripting vulnerability that can be exploited by attackers to cause cross-site scripting and cache poisoning attacks...

Siemens SCALANCE X-200RNA Switch Devices has an unspecified vulnerability

The SCALANCE X-204RNA Industrial Ethernet Access Point enables non-PRP endpoint devices to connect to a separate parallel network as needed.A security vulnerability exists in Siemens SCALANCE X-200RNA Switch Devices due to the web server of the affected device calculating session IDs and random...

Siemens SCALANCE X-200RNA Switch Devices Information Disclosure Vulnerability

The SCALANCE X-204RNA Industrial Ethernet Access Point enables non-PRP endpoint devices to connect to a separate parallel network as needed.An information disclosure vulnerability exists in Siemens SCALANCE X-200RNA Switch Devices, which could be exploited by an attacker to gain access to sensiti...

Discourse Cross-Site Scripting Vulnerability

Discourse is an open source community discussion platform. The platform includes features such as community, email and chat rooms. A cross-site scripting vulnerability exists in Discourse version 2.8.10 and earlier, 2.9.0.beta11 and earlier, which can be exploited by attackers to inject malicious...

Google Chrome Security Bypass Vulnerability (CNVD-2023-08259)

Google Chrome is a web browser from Google, Inc. A security bypass vulnerability exists in Google Chrome, which stems from insufficient untrusted input validation in CORS. An attacker could exploit this vulnerability to bypass security restrictions...

Botan has an unspecified vulnerability

Botan is a library of cryptographic algorithms written in C++. It supports a variety of algorithms such as AES, DES, SHA-1, RSA, DSA and Diffie-Hellman. A security vulnerability exists in Botan versions 1.11.34 and later up to 2.19.3, which stems from a certificate validation error and can be...

Insyde InsydeH2O Buffer Overflow Vulnerability

Insyde InsydeH2O is a C language source from Insyde Taiwan, China that implements the new technology "EFI/UEFI" specification, designed to replace the traditional BIOS Basic Input/Output System. Insyde A buffer overflow vulnerability exists in InsydeH2O 5.0 and later, 5.5 and earlier versions,...

WordPress Permalink Manager Lite has an unspecified vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WordPress plugin is an application plugin. WordPress...

WBCE CMS Cross-Site Scripting Vulnerability

WBCE CMS is an open source content management system CMS based on PHP and MySQL. A cross-site scripting vulnerability exists in WBCE CMS 1.5.4 and previous versions, which stems from the lack of effective filtering and escaping of user-supplied data in the Post Loop field of the Overview Page...

Tenda AC1200 authorization error vulnerability

Tenda AC1200 is a wireless router from Tenda, China. Tenda AC1200 Router Model W15Ev2 V15.11.0.101576 is vulnerable to an authorization error. An authenticated attacker can use this vulnerability to read the router's syslog.log file, which contains the MD5 password for the administrator user...

Democritus Project d8s-networking Code Execution Vulnerability

Democritus Project is a collection of simple, effective, modular, well-tested and well-documented features from Democritus. A backdoor vulnerability exists in Democritus Project d8s-networking version 0.1.0, which stems from the presence of a potential code execution package democritus-hashes...

Democritus Project d8s-xml Code Execution Vulnerability

Democritus Project is a collection of simple, effective, modular, well-tested and well-documented features from Democritus. A code execution vulnerability exists in Democritus Project d8s-xml version 0.1.0, which stems from the presence of a potential code execution package democritus-html insert...

Huawei HarmonyOS Fingerprint Module Logic Error Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a microkernel-based, fully distributed operating system. Huawei HarmonyOS version 2.0 contains a logic error vulnerability that stems from a business logic error in the fingerprint module. An attacker could exploit the...

SAMSUNG Mobile devices ProfileSharingAccount access control error vulnerability

SAMSUNG Mobile devices is a series of Samsung mobile devices, including cell phones, tablets, etc. SAMSUNG Mobile devices Android S12 before 13.0.6.15, Android R11 13.0.6.14 has an access control error vulnerability, which originates from the existence of access control in ProfileSharingAccount i...

Linux kernel resource management error vulnerability (CNVD-2022-69187)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A resource management error vulnerability exists in Linux kernel version 5.19.12 and earlier versions, which stems from the presence of a memory reuse after release issue that...

FFmpeg Buffer Overflow Vulnerability (CNVD-2022-70582)

FFmpeg is software developed by individual developers that performs recording, converting, and streaming functions for a wide range of audio and video formats. A buffer overflow vulnerability exists in FFmpeg where the size calculation in buildopengopkeypoints iterates over all entries in the loo...

OTFCC has an unspecified vulnerability (CNVD-2023-11793)

OTFCC is a C library and utility open sourced by Caryll. It is used to parse and write OpenType font files. OTFCC has a security vulnerability that stems from a segmentation violation located at its /multiarch/memmove-vec-unaligned-erms.S. No detailed vulnerability details are currently available...

yasm find_cc function denial of service vulnerability

yasm is yasm open source a completely rewritten Netwide assembler. A denial of service vulnerability exists in yasm version 1.3.0, which stems from the presence of a NULL pointer dereference in the findcc function in modules/preprocs/nasm/nasm-pp.c. An attacker could exploit this vulnerability to...

yasm expand_mmacro function denial of service vulnerability

yasm is yasm open source a completely rewritten Netwide assembler. A denial of service vulnerability exists in yasm version 1.3.0, which stems from the presence of a NULL pointer dereference in the expandmmacro function in modules/preprocs/nasm/nasm-pp.c. An attacker could exploit this...

Microweber Cross-Site Scripting Vulnerability (CNVD-2022-54325)

Microweber is an online store management system that provides drag-and-drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, etc. A cross-site scripting vulnerability exists in versions of Microweber prior to 1.2.21, which...

Oracle Solaris Denial of Service Vulnerability (CNVD-2022-54629)

Oracle Solaris is a set of UNIX operating systems from Oracle. A denial of service vulnerability exists in the Filesystem component of Oracle Solaris 11. An attacker could exploit this vulnerability to corrupt Oracle Solaris, which could result in unauthorized updates, insertions, or deletions of...

Tenda M3 formSetAccessCodeInfo function stack overflow vulnerability

Tenda M3 is an access controller from Tenda, China. Tenda M3 V1.0.0.12 is vulnerable to a stack overflow vulnerability, which stems from the formSetAccessCodeInfo function info parameter not checking the length of the input data. An attacker could exploit this vulnerability to cause a denial of...

Hospital Management System SQL Injection Vulnerability (CNVD-2022-74094)

Hospital Management System HMS is a computer system that helps manage health care-related information and helps health care providers do their jobs efficiently. hospital Management System v1.0 is vulnerable to an SQ injection vulnerability that originates in the doctorlogin.php page. A SQL...

Jenkins Deployment Dashboard Plugin信息泄露漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. stored in the global configuration file of the Jenkins controller, and an...

GLPI Information Disclosure Vulnerability (CNVD-2022-58232)

GLPI is an open source IT and asset management software. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridges and ink cartridges. An...

Google Android Buffer Overflow Vulnerability (CNVD-2022-53367)

Google Android is a Linux-based open source operating system from Google, Inc. A buffer overflow vulnerability exists in Google Android, which stems from the fact that the UE and EMM use NAS messages to communicate with each other. The vulnerability can be exploited to remotely crash the modem...

underscore-99xp denial of service vulnerability

underscore-99xp is an extension based on the underscore.js experience. underscore-99xp v1.7.2 contains a denial of service vulnerability that stems from a call to the deepValueSearch function that does not properly handle incoming error messages, which could be exploited by an attacker to cause a...

Google Android has an unspecified vulnerability (CNVD-2022-53374)

Google Android is a Linux-based open-source operating system from the U.S. company Google Google. Google Android has a security vulnerability. No detailed vulnerability details are available...

Jenkins CRX Content Package Deployer Plugin Cross-Site Scripting Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. Jenkins Plugin is an application that provides hundreds of plug-ins to support building, deploying, and automating any project. a cross-site scripting vulnerability exists in Jenkins CRX Content Package...

Contec SolarView Compact Remote Code Execution Vulnerability

Contec SolarView Compact is an application from Contec Japan, Inc. Contec SolarView Compact v6.0 contains a remote code execution vulnerability that stems from a failure of SolarImage.php to properly filter special elements of the construction snippet. An attacker could exploit this vulnerability...

Cisco Identity Services Engine授权问题漏洞

Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The platform oversees networks by collecting real-time information from networks, users, and devices to develop and implement appropriate policies.The Cisco Identity Services Engine is...

WordPress WP SVG Icons plugin remote code execution vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress WP SVG Icons plugin version 3.2.3 and prior versions contain a remote code execution...

WordPress WP Simple Adsense Insertion plugin跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress WP Simple Adsense Insertion plugin prior to version 2.1 is vulnerable to cross-site request...

Online Fire Reporting System SQL Injection Vulnerability (CNVD-2022-55745)

Online Fire Reporting System is an online fire reporting system from Carlo Montero's personal developer. version v1.0 of Online Fire Reporting System is vulnerable to SQL injection, which originates from /ofrs/classes/Master.php?f= deleteinquiry lacks validation for external input SQL statements,...