Jenkins Deployment Dashboard Plugin信息泄露漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. stored in the global configuration file of the Jenkins controller, and an...

GLPI Information Disclosure Vulnerability (CNVD-2022-58232)

GLPI is an open source IT and asset management software. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridges and ink cartridges. An...

Google Android Buffer Overflow Vulnerability (CNVD-2022-53367)

Google Android is a Linux-based open source operating system from Google, Inc. A buffer overflow vulnerability exists in Google Android, which stems from the fact that the UE and EMM use NAS messages to communicate with each other. The vulnerability can be exploited to remotely crash the modem...

underscore-99xp denial of service vulnerability

underscore-99xp is an extension based on the underscore.js experience. underscore-99xp v1.7.2 contains a denial of service vulnerability that stems from a call to the deepValueSearch function that does not properly handle incoming error messages, which could be exploited by an attacker to cause a...

Google Android has an unspecified vulnerability (CNVD-2022-53374)

Google Android is a Linux-based open-source operating system from the U.S. company Google Google. Google Android has a security vulnerability. No detailed vulnerability details are available...

WordPress WP Simple Adsense Insertion plugin跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress WP Simple Adsense Insertion plugin prior to version 2.1 is vulnerable to cross-site request...

Online Fire Reporting System SQL Injection Vulnerability (CNVD-2022-55745)

Online Fire Reporting System is an online fire reporting system from Carlo Montero's personal developer. version v1.0 of Online Fire Reporting System is vulnerable to SQL injection, which originates from /ofrs/classes/Master.php?f= deleteinquiry lacks validation for external input SQL statements,...

Owl Labs Meeting Owl Trust Management Issue Vulnerability

Owl Labs Meeting Owl is a video conferencing device from Owl Labs, Inc. Owl Labs Meeting Owl version 5.2.0.15 is vulnerable to a trust management issue, which could be exploited by an attacker to activate network sharing mode using hard-coded hoothoot credentials via a certain c 150 value...

BigBlueButton Denial of Service Vulnerability

BigBlueButton is an open source web conferencing system from the BigBlueButton community.BigBlueButton suffers from a denial-of-service vulnerability. An attacker could use the vulnerability to cause a denial of service to the bbb-html5 service...

Publify arbitrary file upload vulnerability

Publify is a simple but full-featured web publishing software.An arbitrary file upload vulnerability exists in versions of Publify prior to 9.2.9, which stems from the application's lack of validation of uploaded files. An attacker could exploit this vulnerability to upload malicious files to...

Delta Electronics DIAEnergie SQL Injection Vulnerability (CNVD-2022-36028)

Delta Electronics DIAEnergie is an industrial energy management system for monitoring and analyzing energy consumption in real time, calculating energy consumption and load characteristics, optimizing equipment performance, improving production processes and maximizing energy efficiency. Delta...

JetBrains Rider Code Injection Vulnerability

JetBrains Rider is a cross-platform integrated development environment IDE from Czech company Jetbrains. versions prior to JetBrains Rider 2022.1 contain a code injection vulnerability that could be exploited by attackers to execute native code via a link in the ReSharper quick documentation...

MariaDB Binary_string::free_buffer() component memory misreference vulnerability

MariaDB is a free and open source database management system from the MariaDB Foundation and a forked version of MySQL with the Maria storage engine. A memory misreference vulnerability exists in Mariadb v10.9 and earlier versions, which originates in the /sql/sqlstring.h component...

Pillow Input Validation Error Vulnerability (CNVD-2022-28799)

Pillow is a Python based image processing library. An input validation error vulnerability exists in versions of Pillow prior to 9.0.1, which stems from the product's remove operation not validating user input data, and can be exploited by an attacker to delete files...

HPE OneView File Reading Vulnerability

A file read vulnerability exists in versions prior to HPE OneView 6.6, which stems from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker could exploit this vulnerability to cause local unauthorized file read access...

SWHKD has unspecified vulnerabilities (CNVD-2022-43218)

SWHKD is a display protocol-independent hotkey daemon made with Rust. A security vulnerability exists in SWHKD, which stems from the insecure use of the /tmp/swhkd.sock pathname. An attacker could exploit the vulnerability to obtain sensitive information or launch a denial-of-service attack...

Zoho ManageEngine ADAudit Plus Remote Code Execution Vulnerability

Zoho ManageEngine Adaudit Plus, from Zoho Corporation, is used to simplify auditing, prove compliance, and detect threats. remote code execution vulnerability exists in versions of Zoho ManageEngine ADAudit Plus prior to 7060, which can be exploited by unauthenticated attackers to remote code...

Firmware Analysis and Comparison Tool跨站脚本漏洞

Firmware Analysis and Comparison Tool FACT, a firmware analysis and comparison tool, is vulnerable to a cross-site scripting vulnerability in Firmware Analysis and Comparison Tool v3.2. The vulnerability stems from a lack of data validation filtering of user-supplied data and output in the user...

WordPress CleanTalk plugin cross-site scripting vulnerability (CNVD-2022-67605)

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress plugin is a WordPress application plugin. WordPress CleanTalk plugin 5.173 and earlier versions have a cross-sit...

Jenkins Continuous Integration with Toad Edge Plugin任意文件读取漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. An attacker with Item/Configure privileges can read arbitrary files on the...

WordPress Narnoo Distributor plugin path traversal vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress plugin is a WordPress open source application plugin . A path traversal vulnerability exists in WordPress Narnoo...

TOTOLINK N600R Command Injection Vulnerability (CNVD-2022-53561)

TotoLink N600R is a wireless router from TotoLink, a Taiwan-based company. TotoLink N600R is vulnerable to command injection, which can be exploited by attackers via the pingCheck function...

WordPress miniOrange's Google Authenticator plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the Wordpress Foundation using the PHP language. WordPress plugin is a WordPress application plugin. WordPress miniOrange's Google Authenticator plugin version 5.5 or earlier is vulnerable to a cross-site request forgery vulnerability that stems from...

Jenkins incapptic connect uploader Plugin has an unspecified vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project. jenkins Plugin is an application. jenkins incapptic connect uploader Plug...

WordPress Sync QCloud COS plugin cross-site scripting vulnerability

WordPress is a set of blogging platform developed by Wordpress Foundation using PHP language. WordPress plugin is a WordPress application plugin. WordPress Sync QCloud COS plugin version prior to 2.0.1 contains a cross-site scripting vulnerability that stems from the plugin's failure to escape so...

IBM Spectrum Copy Data Management Cross-Site Scripting Vulnerability (CNVD-2022-84077)

IBM Spectrum Copy Data Management is an implementation of International Business Machines Corporation IBM to modernize, simplify, and automate data center copy management processes.A cross-site scripting vulnerability exists in IBM Spectrum Copy Data Management versions 2.2.0.0 inclusive through...

Shopware Cross-Site Scripting Vulnerability (CNVD-2022-18526)

Shopware is a set of open source e-commerce software from the German company Shopware.Shopware suffers from a cross-site scripting vulnerability that stems from the program's lack of data validation filtering of user-supplied and output data. An attacker could exploit this vulnerability to inject...

Siemens RUGGEDCOM ROS Cross-Site Scripting Vulnerability

Siemens RuggedCom ROS is an operating system used in the RuggedCom family of switches from Siemens, Germany. Siemens RUGGEDCOM ROS is vulnerable to cross-site scripting, which can be exploited by attackers to retrieve sensitive information via cross-site scripting...

Espruino Buffer Overflow Vulnerability (CNVD-2022-20168)

Espruino is a JavaScript interpreter. It is designed for devices with only 128kB flash and 8kB RAM. espruino 2v11 has a security vulnerability that stems from src/jsvar.c containing a stack buffer overflow. No details of the vulnerability are currently available...

Zulip Cross-Site Scripting Vulnerability (CNVD-2022-17016)

Zulip is a powerful open source group chat application from the Zulip team. Used to combine the immediacy of real-time chat with the productivity benefits of threaded conversations, Zulip suffers from a cross-site scripting vulnerability that stems from the WEB application's lack of proper...

Jenkins GitLab Authentication Plugin User Redirection Vulnerability

Jenkins is a Jenkins open source application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.A user redirection vulnerability exists in Jenkins GitLab Authentication Plugin 1.13 and earlier versions, which stems fr...

Fortinet FortiPortal Security Feature Issue Vulnerability

Fortinet FortiPortal is an advanced, feature-rich managed security analysis and management support tool for Fortinet's FortiGate, FortiWiFi, and FortiAP product lines, available as a virtual machine for use by MSPs. versions, a security feature issue vulnerability exists that stems from the use o...

JetBrains YouTrack Server-Side Template Injection Vulnerability (CNVD-2022-17758)

JetBrains YouTrack is a browser-based bug tracking and project management software from JetBrains Czech Republic. JetBrains YouTrack is vulnerable to server-side template injection, which can be exploited by attackers to perform SSTI server-side template injection attacks...

Oracle MySQL Cluster Input Validation Error Vulnerability (CNVD-2022-17690)

Oracle MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database developed by Oracle Corporation. Oracle MySQL Cluster is vulnerable to an input validation error, which can be exploited by attackers to execute arbitrary code...

Tenda G1 and G3 Buffer Overflow Vulnerability (CNVD-2022-16179)

The Tenda G1 and G3 are routers from the Chinese company Tenda. A buffer overflow vulnerability exists in the Tenda G1 and G3, which can be exploited by an attacker to cause a denial of service via the manualTime parameter...

WordPress Futurio Extra plugin SQL injection vulnerability

WordPress is a blogging platform developed by the Wordpress Foundation using the PHP language. A SQL injection vulnerability exists in versions of the WordPress Futurio Extra plugin prior to 1.6.3, which stems from a lack of filtering and escaping of SQL data submitted by users. A highly privileg...

librenms Cross-Site Scripting Vulnerability (CNVD-2022-12754)

Librenms is a PHP and MySQL based open source network monitoring system from the Librenms community. The system features custom alerts, auto-discovery of network environments and automatic updates.Librenms suffers from a cross-site scripting vulnerability that stems from a lack of data validation...

Apache Pulsar Input Validation Error Vulnerability

Apache Pulsar is the United States Apache Apache Foundation for cloud environments, set of messages, storage, lightweight functional computing as one of the distributed message flow platform. The software supports multi-tenant, persistent storage, multi-machine room cross-region data replication,...

WordPress Perfect Survey plugin cross-site scripting vulnerability

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. WordPress Perfect Survey plugin in version 1.5.2 and prior versions suffers from a cross-site scripting vulnerability that stems from not validating and escaping the X-Forwarded-For header value,...

Insyde InsydeH2O has an unspecified vulnerability (CNVD-2022-10288)

Insyde InsydeH2O is a C source from Insyde Software Taiwan, China that implements the new technology "EFI/UEFI" specification, designed to replace the legacy BIOS Basic Input/Output System.A security vulnerability exists in Insyde InsydeH2O. The vulnerability stems from the System Management...

Reolink RLC-410W cgiserver.cgi denial of service vulnerability

Reolink Rlc-410W is a Wifi security camera from Reolink China.A denial of service vulnerability exists in Reolink RLC-410W in version v3.0.0.13620121102, which stems from the JSON parsing function of cgiserver.cgi not doing the correct handling of incoming error messages. An attacker could use th...

libsixel Denial of Service Vulnerability

libsixel is a package that provides an encoding/decoding implementation for DEC SIXEL graphics and other converter programs. libsixel has a denial of service vulnerability in v1.10.3 and earlier, which stems from a NULL pointer dereference in libsixel's stbimage.h component, and can be exploited ...

Navidrome SQL Injection Vulnerability

Navidrome is a web-based open source music collection server and streamer. Used to freely listen to music collections from any browser or mobile device, a SQL injection vulnerability exists in versions of Navidrome prior to 0.47.5, which stems from a lack of validation of externally entered SQL...

phpMyAdmin Authorization Issues Vulnerability

phpMyAdmin is a free, web-based MySQL database management tool from the Phpmyadmin team. The tool is capable of creating and deleting databases, creating, deleting, and modifying database tables, executing SQL script commands, and more. A security vulnerability exists in phpMyAdmin, which stems...

F5 BIG-IP Resource Management Error Vulnerability (CNVD-2022-70619)

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. F5 BIG-IP has a resource management error vulnerability that can be exploited by an unauthenticated attacker to cause a...

F5 BIG-IP code issue vulnerability (CNVD-2022-70627)

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. F5 BIG-IP is vulnerable to a code issue that could be exploited by an attacker to cause a denial of service on the BIG-IP...

Latte Cross-Site Scripting Vulnerability

Latte is a template engine for Nette Foundation's Php. Latte in version 2.8.0 contains a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied data and output. An attacker could exploit this vulnerability to execute JavaScript code on the client...

livehelperchat Information Disclosure Vulnerability

livehelperchat is available through live helper chat and can be used to provide live support on the website for free. An information disclosure vulnerability exists in livehelperchat that stems from the inclusion of sensitive information when generating error messages. An attacker may exploit thi...

Huawei Emui and Magic UI configuration flaw vulnerability

Huawei Emui is an Android-based mobile operating system. magic Ui is an Android-based mobile operating system. Huawei Emui and Magic UI are vulnerable to a configuration flaw that could be exploited by attackers to elevate MEID IMEI privileges...

Gerapy OS Command Injection Vulnerability

Gerapy is a distributed crawler management framework based on Scrapy, Scrapyd, Django and Vue.js. An operating system command injection vulnerability exists in versions prior to Gerapy 0.9.8, which stems from the software's lack of effective filtering and escaping of system commands, resulting in...