Bento4 AP4_Dec3Atom::AP4_Dec3Atom function denial of service vulnerability

Bento4 is an open source C library for reading and writing MP4 files. version v1.6.0-639 of Bento4 suffers from a denial of service vulnerability, which stems from a boundary error in AP4Dec3Atom::AP4Dec3Atom in Ap4Dec3Atom.cpp when handling untrusted input. An attacker could exploit the...

Adobe Dimension Memory Misreference Vulnerability (CNVD-2022-78869)

Adobe Dimension is a set of 2D and 3D composite design tools from Adobe. 3.4.5 and earlier versions of Adobe Dimension are vulnerable to a memory mis-reference vulnerability that results from the program not properly handling malicious files. An attacker could exploit the vulnerability to execute...

Dell GeoDrive Information Disclosure Vulnerability

Dell GeoDrive is a free application from Dell, Inc. It provides access to Dell EMC ECS and Atmos storage from Microsoft Windows desktops and servers. An information disclosure vulnerability exists in Dell GeoDrive versions 2.1 and later, 2.2 and earlier. The vulnerability arises from insufficient...

Adobe ColdFusion input validation error vulnerability

Adobe ColdFusion is a rapid application development platform from Adobe, which includes an integrated development environment and scripting language. Adobe ColdFusion is vulnerable to an input validation error that could be exploited by an attacker to cause arbitrary file system reads...

Microsoft Client Server Run-time Subsystem (CSRSS) Privilege Elevation Vulnerability

Microsoft Client Server Run-time Subsystem is a client/server run-time subsystem from Microsoft Corporation of the United States, manifested as the csrss.exe process. It is a component of the Windows NT operating system family, appearing in Windows NT 3.1 and later systems, providing the user mod...

Microsoft Windows Graphics Component has an elevation of privilege vulnerability

Microsoft Graphics Component is a graphics driver component of Microsoft Corporation USA.An elevation of privilege vulnerability exists in Microsoft Windows Graphics Component. An attacker could exploit the vulnerability to elevate privileges...

Siemens LOGO! 8 BM buffer overflow vulnerability (CNVD-2022-89767)

Siemens LOGO! 8 BM is a programming software for industrial environments for the Windows platform from Siemens Germany. Siemens LOGO! 8 BM suffers from a buffer overflow vulnerability that stems from an inability to properly validate the structure of a TCP packet through a variety of methods. An...

Microsoft Windows Storage Elevation of Privilege Vulnerability

Microsoft Windows Storage is an elevation of privilege vulnerability in Microsoft Windows Storage, which results from the improper assignment of privileges to applications and can be exploited by attackers to cause an elevation of privilege...

SAP Enable Now Cross-Site Scripting Vulnerability

SAP Enable Now is a collaborative content creation, management and sharing platform from SAP. The platform is primarily used for e-learning and training in SAP and non-SAP systems. A cross-site scripting vulnerability exists in SAP Enable Now 10 version 1. The vulnerability stems from failure to...

SAP 3D Visual Enterprise Viewer .iff Buffer Overflow Vulnerability

SAP 3D Visual Enterprise Viewer is a 3D view viewer from SAP, Germany. The software supports the publishing of 2D and 3D scenes in all industry-standard desktop applications and supports separate installation as a stand-alone executable program and ActiveX space. A buffer overflow vulnerability...

WordPress Zephyr Project Manager Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Zephyr Project Manager version 3.2.55 previously had a cross-site scripting vulnerability that...

TOTOLINK NR1800X setOpModeCfg buffer overflow vulnerability

TOTOLINK NR1800X is an excellent 5G NR indoor Wi-Fi and SIP CPE from China Gion Electronics TOTOLINK.Designed to provide fast and convenient deployment of NR fixed data services for homes and offices.TOTOLINK NR1800X V9.1.0u.6279B20210910 version is vulnerable to a buffer overflow vulnerability,...

Multiple MediaTek chip cpu dvfs local privilege elevation vulnerabilities

MediaTek Inc. is the world's fourth largest fab semiconductor company and a market leader in mobile devices, smart home applications, wireless connectivity technologies and IoT products, with approximately 1.5 billion devices with MediaTek chips available worldwide each year. Several MediaTek chi...

Unspecified Vulnerability in Microsoft Windows Common Log File System Driver

The Microsoft Windows Common Log File System Driver is Microsoft's Common Log File System CLFS API that provides a high-performance, general-purpose log file subsystem that can be used by specialized client applications and shared by multiple clients to optimize logging and access. access. A...

Huawei HarmonyOS Buffer Overflow Vulnerability (CNVD-2022-64981)

Huawei HarmonyOS is an operating system from Huawei China. HarmonyOS version 2.0 contains a buffer overflow vulnerability that stems from the fact that the HWKEYMASTER module does not perform a legitimacy check on the key format, which can be exploited to cause out-of-bounds access...

Google Android Elevation of Privilege Vulnerability (CNVD-2022-61747)

Google Android is a Linux-based open source operating system from Google, Inc. An elevation of privilege vulnerability exists in Google Android, which is caused by AvatarPhotoController.java,. By sending a build request, an attacker can exploit this vulnerability to gain elevated privileges...

Adobe Acrobat Reader Resource Management Error Vulnerability (CNVD-2022-56977)

Adobe Acrobat Reader is a PDF viewer from Adobe, a U.S. company. The software is used to print, sign, and annotate PDFs. Adobe Acrobat Reader is vulnerable to a resource management error that stems from post-release reuse, resulting in a memory leak. No details of the vulnerability are currently...

F5 BIG-IP HTTP2 profile denial of service vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A denial of service vulnerability exists in the F5 BIG-IP HTTP2 profile, which stems from the fact that when configuring the...

yasm error function denial of service vulnerability

yasm is yasm open source a completely rewritten Netwide assembler. A denial of service vulnerability exists in yasm version 1.3.0, which stems from a post-release reuse of the error function in modules/preprocs/nasm/nasm-pp.c. An attacker could exploit this vulnerability to cause a denial of...

Apache CloudStack XML External Entity Injection Vulnerability

Apache CloudStack is a suite of Infrastructure as a Service IaaS cloud computing platforms from the Apache Foundation in the United States. The platform is primarily used to deploy and manage large networks of virtual machines. An XML external entity injection vulnerability exists in Apache...

Google Android Denial of Service Vulnerability (CNVD-2022-54348)

Google Android is a Linux-based open-source operating system from the US company Google. Google Android suffers from a denial-of-service vulnerability, which can be exploited by local attackers to perform a factory reset and cause a denial-of-service condition...

Siemens Mendix Access Control Error Vulnerability (CNVD-2022-51432)

Mendix is a high-productivity application platform that enables mobile and web applications to be built and continuously improved at scale. Siemens Mendix is vulnerable to an access control error that could be exploited by an attacker to set weak passwords...

AutomatedQuizEval path traversal vulnerability

AutomatedQuizEval, an automated quiz evaluation system from the personal developer Sravani Boinepelli, suffers from a path traversal vulnerability that stems from the failure of Flask's sendfile function to properly filter special elements in resource or file paths, which could be exploited by...

Dell BSAFE Crypto-C Micro Edition and Dell BSAFE Micro Edition Suite Input Validation Error Vulnerability

Dell BSAFE Micro Edition Suite is a development kit that provides encryption, certificate and transport layer security for c/c applications, devices, systems, etc. Dell BSAFE is a security software product that supports encryption algorithms, certificate chain validation and transport layer...

Jenkins Cross-Site Scripting Vulnerability (CNVD-2022-65924)

Jenkins is an application of the Jenkins open source. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins suffers from a cross-site scripting vulnerability that stems from the fact that the help icon does not...

74cmsSE SQL Injection Vulnerability (CNVD-2022-61440)

74cmsSE is a free open source professional recruitment system based on PHP MYSQL. 74cmsSE is vulnerable to SQL injection, which results from the lack of validation of external input SQL statements in the /freelance/resumelist keyword parameter. An attacker could use this vulnerability to execute...

Apache Sling Log Injection Vulnerability

Apache Sling is an open source Web framework for the Java platform from the Apache Foundation. Designed to create content-centric applications on JSR-170-compliant content repositories such as Apache Jackrabbit, a log injection vulnerability exists in Apache Sling Commons Log version 5.4.0 and...

WordPress Allow svg files plugin file upload vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress plugin is an application plugin. WordPress Allow svg files plugin...

FFmpeg get_siz() function denial of service vulnerability

FFmpeg is a complete solution for recording, converting and streaming audio and video from the Ffmpeg team. A denial of service vulnerability exists in the FFmpeg getsiz function, which can be exploited by attackers to cause a denial of service attack...

WordPress plugin Ninja Forms Contact Form cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress plugin Ninja Forms Contact Form 3.6.9 and earlier versions have a cross-site scripting...

YoudianCMS SQL Injection Vulnerability (CNVD-2022-59020)

YouDianCMS is a website CMS. A SQL injection vulnerability exists in YoudianCMS v9.5.0, which originates from the lack of validation of the MailSendID parameter at /App/Lib/Action/Admin/MailAction.class.php against external SQL input. This vulnerability can be exploited by attackers to execute...

ChurchCRM SQL Injection Vulnerability

ChurchCRM, a CRM system for churches, has a SQL injection vulnerability in ChurchCRM version 4.4.5, which originates from a security issue in the "PersonID" field of /churchcrm/WhyCameEditor.php. An attacker could use this vulnerability to perform sql injection and steal data...

HUAWEI HarmonyOS Buffer Overflow Vulnerability (CNVD-2022-66178)

HUAWEI HarmonyOS is an operating system from Huawei, China HUAWEI. HUAWEI HarmonyOS 2.0 is vulnerable to a buffer overflow vulnerability that can be exploited by attackers to cause availability impairment...

Gogs server request forgery vulnerability

Gogs Go Git Service is a Go-based self-service Git hosting service from the GOGS team that supports creating and migrating public/private repositories, adding and removing repository collaborators, etc. A server-side request forgery vulnerability exists in versions prior to Gogs 0.12.8, for which...

Halibut Denial of Service Vulnerability

Halibut is a secure, RPC-based open source communication framework. Halibut version 1.2 contains a denial-of-service vulnerability that stems from a mix-up in the cleanupindex directive in index.c, which is responsible for freeing memory. An attacker could exploit this vulnerability to cause a...

OpenRazer buffer overflow vulnerability

OpenRazer is an open source driver and userspace daemon used to control Razer lighting and other functions on GNU/Linux. Used to control Razer lighting and other features on GNU/Linux, a buffer overflow vulnerability exists in OpenRazer version 3.3.0 and earlier, which stems from a boundary error...

Avast Premium Security DLL劫持漏洞

Avast Premium Security is an application from the Czech company Avast. Avast Premium Security suffers from a DLL hijacking vulnerability that originates when the instup.exe and wscproxy.exe processes attempt to load a DLL by failing to specify the absolute path to the DLL. An attacker could use...

Unspecified Vulnerability in Siemens Desigo PXC and DXR Devices (CNVD-2022-37374)

Desigo DXR2 controllers are programmable automation stations to support the standard control needs of end HVAC equipment and TRA Total Room Automation applications. the Desigo PXC3 series of automation stations can be used in buildings where functionality and flexibility are more demanding. Use...

WordPress HubSpot plugin server-side request forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The WordPress plugin is an application plugin. versions of the WordPress HubSpot plugin prior to 8.8.15 are vulnerable to server-side request...

F5 BIG-IP has an unspecified vulnerability (CNVD-2022-74719)

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A security vulnerability exists in F5 BIG-IP that could be exploited to modify and delete Dashboards created by other BIG-IP...

WordPress Import WP plugin file upload vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Import WP plugin is vulnerable to a file upload vulnerability, which stems from the plugin'...

Delta Electronics DIAEnergie SQL Injection Vulnerability (CNVD-2022-36028)

Delta Electronics DIAEnergie is an industrial energy management system for monitoring and analyzing energy consumption in real time, calculating energy consumption and load characteristics, optimizing equipment performance, improving production processes and maximizing energy efficiency. Delta...

Fortinet FortiEDR Trust Management Issue Vulnerability (CNVD-2022-47976)

Fortinet FortiEDR is a scratch-built endpoint security solution from Fortinet U.S.A. Fortinet FortiEDR is vulnerable to a trust management issue that stems from the use of hard-coded encrypted RSA keys, which can be exploited by local attackers to disable and offload collectors from endpoints in...

HPE OneView Authentication Bypass Vulnerability

HPE OneView is a software from Hewlett Packard Enterprise HPE that facilitates automated device management for IT departments. versions prior to HPE OneView 6.6 contain an authentication bypass vulnerability that stems from insufficient program authentication strength and can be exploited by an...

Rumble Mail Server Code Execution Vulnerability

Rumble Mail Server is a mail server suite for SMTP ESMTPSA, HTTP, POP3 and IMAP4v1 by Daniel Gruno, a personal developer.A code execution vulnerability exists in Rumble Mail Server version 0.51.3135, which stems from an unquoted service path in The service path is not referenced in RumbleService,...

Hoosk has an unspecified vulnerability

Hoosk is a lightweight user-centric content management system CMS with a built-in Codelgniter for creating responsive websites. The system has a built-in Codelgniter for creating responsive websites. An unspecified vulnerability in /install/index.php in Hoosk version 1.8.0 stems from the program'...

fenom code injection vulnerability

fenom is a lightweight and fast PHP template engine. fenom 2.12.1 and earlier versions are vulnerable to code injection, which stems from a failure to properly filter the construct command special characters, commands, etc. in the getTemplateCode function of fenom/src/Fenom/Template.php, which ca...

WordPress miniOrange's Google Authenticator plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the Wordpress Foundation using the PHP language. WordPress plugin is a WordPress application plugin. WordPress miniOrange's Google Authenticator plugin version 5.5 or earlier is vulnerable to a cross-site request forgery vulnerability that stems from...

Istio Privilege Permission and Access Control Issue Vulnerability (CNVD-2022-21806)

Istio is an open platform for connecting, managing, and securing microservices. versions 1.12.0 and 1.12.1 of Istio are vulnerable to privilege permission and access control issues that could be exploited by attackers to escalate privileges to create additional resources they may not have access ...

ARRIS TR3300 Command Injection Vulnerability (CNVD-2022-68524)

ARRIS TR3300 is an 802.11ac Wi-Fi router from ARRIS U.S.A. A command injection vulnerability exists in ARRIS TR3300 v1.0.13, which stems from the failure of the wpsenroleepin parameter in the wps function to properly filter the construct command special characters, commands, etc. An attacker coul...