showdoc .properties file upload vulnerability (CNVD-2022-20508)

showdoc is an open source tool for IT teams to share documents online. showdoc versions prior to v2.10.4 are vulnerable to file uploads, which stem from the lack of effective detection of .properties file extensions in the application's file upload feature. An attacker could use this vulnerabilit...

Jenkins incapptic connect uploader Plugin has an unspecified vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project. jenkins Plugin is an application. jenkins incapptic connect uploader Plug...

Zenario CMS File Upload Vulnerability (CNVD-2022-21547)

Zenario CMS is an open source application from Zenario. A file upload vulnerability exists in Zenario CMS version 9.0.54156, which stems from the application's lack of validation of uploaded files. An attacker could exploit the vulnerability to upload malicious files to remotely execute arbitrary...

phpLiteAdmin Cross-Site Scripting Vulnerability (CNVD-2022-21815)

phpLiteAdmin is a web-based SQLite database management tool. phpLiteAdmin versions prior to 1.9.8.2 are vulnerable to cross-site scripting. The vulnerability stems from a newRows parameter in index.php that lacks a data validation filter for user-supplied data and output. An attacker could use th...

Quicklert for Digium SQL Injection Vulnerability

Quicklert is an easy-to-use messaging, alerting, and emergency response solution from Quicklert USA, Inc. Quicklert for Digium version 10.0.0 is vulnerable to SQL injection, which originates from the login.jsp page. The vulnerability stems from the application's lack of validation of externally...

Microweber Cross-Site Scripting Vulnerability (CNVD-2022-20688)

Microweber is a drag-and-drop website builder and CMS based on the PHP Laravel framework. Microweber suffers from a cross-site scripting vulnerability, which can be exploited by attackers to upload . azhtml file e.g. ahtml, bhtml, chtml, ddhtml, as long as it ends in html. After uploading,...

Linux kernel denial of service vulnerability (CNVD-2022-69201)

Linux kernel is the kernel used by the Linux Foundation's open source operating system, Linux. Linux kernel is vulnerable to a denial-of-service vulnerability caused by a "use before read" flaw in the sockgetsockopt function in net/core/sock.c. " flaw in the sockgetsockopt function in...

Adobe After Effects Buffer Overflow Vulnerability (CNVD-2022-22099)

Adobe After Effects is a suite of visual effects and motion graphics software from Adobe, Inc. A buffer overflow vulnerability exists in Adobe After Effects, which stems from a failure to properly validate data boundaries when performing operations on memory, and can be exploited by remote...

Authentication Error Vulnerability in Various Schneider Electric Products

The Schneider Electric APC Smart-UPS SMC Series, among others, is a product of Schneider Electric, a French company. The Schneider Electric APC Smart-UPS SMT Series is a line interactive power protection for servers, point-of-sale, routers, switches, hubs and other network equipment. The Schneide...

WordPress E2Pdf Plugin Cross-Site Scripting Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress E2Pdf Plugin versions prior to 1.16.45 that stems fro...

Elasticsearch Kibana Cross-Site Scripting Vulnerability (CNVD-2022-23464)

A cross-site scripting vulnerability exists in Elasticsearch Kibana, an open source, browser-based analysis and search Elasticsearch dashboard tool from Elasticsearch Netherlands, which stems from a lack of filtering and escaping of user data in the data preview pane. An attacker could exploit th...

MingSoft Mcms SQL Injection Vulnerability (CNVD-2022-18535)

MingSoft Mcms is China's MingFei MingSoft company's a complete open source J2ee system . A security vulnerability exists in MingSoft Mcms v5.2.4 that allows attackers to conduct SQL injection attacks via the search.do parameter in the file /mdiy/dict/listExcludeApp. No details of the vulnerabilit...

JetBrains TeamCity Security Bypass Vulnerability

JetBrains TeamCity is a distributed build management and continuous integration tool from JetBrains Czech Republic. A security vulnerability exists in JetBrains TeamCity, which stems from the product's failure to validate user identities. An unauthenticated attacker could use the vulnerability to...

Apache JSPWiki Cross-Site Scripting Vulnerability (CNVD-2022-17019)

JSPWiki is an open source JSP-based Wiki system from Apache, based on the file system, with permissions management and search capabilities.Apache JSPWiki versions prior to 2.11.2 have a cross-site scripting vulnerability in the user preferences screen. An attacker could use this vulnerability to...

Plesk Cross-Site Request Forgery Vulnerability (CNVD-2022-91163)

Plesk is a hosting control panel from the Swiss company Plesk. version 18.0.37 of Plesk is vulnerable to cross-site request forgery, which stems from the software's lack of validation of cross-site request forgery tokens. An attacker could exploit this vulnerability to insert data in the user and...

Jenkins HashiCorp Vault Plugin信息泄露漏洞

Jenkins is a Jenkins open source application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins HashiCorp Vault Plugin 3.8.0 and earlier versions are vulnerable to an information disclosure vulnerability that...

WordPress Ibtana plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. cross-site scripting vulnerability exists in versions of WordPress Ibtana plugin prior to 1.1.4....

Taocms Cross-Site Scripting Vulnerability (CNVD-2022-11522)

Taocms is a micro Cms content management system in China. Taocms suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data in the WEB application, which can be exploited by attackers to execute client-side code...

ffjpeg buffer overflow vulnerability (CNVD-2022-19850)

ffjpeg is a JPEG encoder/decoder. ffjpeg suffers from a buffer overflow vulnerability that stems from a failure of the jfifdecode function in the product/src/jfif.c file to properly handle memory boundaries, which could be exploited by an attacker to cause a denial of service via a special jpeg...

StarWind SAN

StarWind SAN & NAS is a standalone hypervisor server or group of servers for StarWind.A command injection vulnerability exists in StarWind SAN & NAS, which can be exploited by attackers to remotely execute code...

Reolink RLC-410W Access Control Error Vulnerability (CNVD-2022-10735)

Reolink Rlc-410W is a Wifi security camera from Reolink China. cgiserver.cgi cgicheckability in Reolink RLC-410W v3.0.0.13620121102 is vulnerable to an access control error, which can be exploited by attackers to cause a denial of service...

Insyde InsydeH2O Buffer Overflow Vulnerability (CNVD-2022-10273)

Insyde InsydeH2O is a C source from Insyde Software Taiwan, China that implements the new technology "EFI/UEFI" specification, designed to replace the legacy BIOS Basic Input/Output System. Operating System H2O UEFI firmware has a buffer overflow vulnerability that can be exploited to write fixed...

Jerryscript ecma-get-put-value.c Denial of Service Vulnerability

JerryScript is JerryScript Jerryscript project a lightweight JavaScript engine . A denial of service vulnerability exists in Jerryscript version 3.0.0, which originates from an assertion in /jerry-core/ecma/operations/ecma-get-put-value.c, and can be exploited by an attacker to trigger a denial o...

Oracle MySQL Cluster Buffer Overflow Vulnerability (CNVD-2022-18213)

Oracle MySQL Cluster is the United States Oracle Oracle company developed a write scalable, real-time, ACID-compatible transactional database. A buffer overflow vulnerability exists in Oracle MySQL Cluster, which can be exploited by an attacker to execute code in the context of a service account...

Oracle Enterprise Session Border Controller has an unspecified vulnerability (CNVD-2022-17338)

Oracle Communications is a product of Oracle Corporation USA. provides integrated communications and cloud solutions for service providers and enterprises to accelerate their digital transformation.A security vulnerability exists in Oracle Enterprise Session Border Controller, which could be...

Sourcecodester Car Rental Management System跨站脚本漏洞

Sourcecodester Car Rental Management System is a car rental management system from Sourcecodester, Inc. A cross-site scripting vulnerability exists in Sourcecodester Car Rental Management System 1.0, which can be exploited by attackers to Cross-site scripting XSS attack via vehicalorcview paramet...

Jenkins Publish Over SSH Plugin Cross-Site Request Forgery Vulnerability

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Publish Over SSH Plugin in version 1.22 and earlier contains a cross-site request forgery vulnerability that stems...

soketi denial of service vulnerability

soketi is a C application ported to Node.js. soketi suffers from a denial of service vulnerability that stems from not properly handling incoming error messages, which can be exploited by attackers to cause a denial of service in the application...

Apache Pluto Cross-Site Scripting Vulnerability (CNVD-2022-04997)

A cross-site scripting vulnerability exists in the Apache Pluto Applicant MVCBean CDI portlet, which stems from the Apache Pluto Applicant MVCBean CDI runtime environment. portlet is vulnerable to cross-site scripting XSS attacks in the input fields of the JSP version of the portlet. No details o...

Huawei HarmonyOS Data Processing Error Vulnerability (CNVD-2022-17719)

Huawei HarmonyOS is an operating system from Huawei, a Chinese company that provides a microkernel-based distributed operating system. Huawei HarmonyOS has a security vulnerability that could be exploited by an attacker to cause an application to crash...

DayByDay CRM Information Disclosure Vulnerability (CNVD-2022-68548)

DayByDay CRM is an open source CRM Customer Relationship Management software, based on Laravel, that helps users keep track of clients, tasks, meetings and more. DayByDay CRM Information Disclosure Vulnerability, the vulnerability stems from the product's failure to add an effective restriction o...

OpenWrt Cross-Site Scripting Vulnerability (CNVD-2022-00601)

OpenWrt, a Linux operating system for embedded devices, is vulnerable to a cross-site scripting vulnerability in version 21.02.1, which stems from a lack of effective filtering and escaping of user-submitted parameters in the Port Forwards Add Name screen. No detailed vulnerability details are...

Video Sharing Website SQL Injection Vulnerability

Video Sharing Website is a video sharing website. video Sharing Website is vulnerable to SQL injection in v1.0, which stems from the application's lack of validation of externally entered SQL statements. An attacker could use this vulnerability to execute illegal SQL commands to steal sensitive...

GPAC Code Issue Vulnerability (CNVD-2022-03661)

GPAC is an open source multimedia framework. GPAC is vulnerable to a code issue that could be exploited by attackers to cause segmentation errors and application crashes...

iText command injection vulnerability

iText is an open source library for creating and manipulating PDF files in Java. It is written by Bruno Lowagie, Paulo Soares and others. iText in the version before 7.1.17 there is a command injection vulnerability, the vulnerability stems from the user input construct to execute the command...

Fiberhome FiberHome ONU GPON OS Command Injection Vulnerability

Fiberhome FiberHome ONU GPON is a router from Fiberhome, China.FiberHome ONU GPON AN5506-04-F RP2617 is vulnerable to an operating system command injection vulnerability, which originates from FiberHome ONU GPON AN5506-04-F RP2617 is affected by an operating system command injection vulnerability...

Bentley View DGN File Parsing Stack Buffer Overflow Vulnerability

Bentley View, a free viewer from Bentley Systems, Inc. A stack buffer overflow vulnerability exists in Bentley View DGN file parsing, which stems from a lack of proper validation of the length of user-supplied data before it is copied to the heap buffer in DGN file parsing. An attacker could...

Fortinet FortiWeb Command Injection Vulnerability (CNVD-2021-99770)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content.Fortinet FortiWeb A command injection...

IBM QRadar SIEM Code Issue Vulnerability (CNVD-2021-95253)

IBM QRadar SIEM is a U.S.-based solution from IBM that leverages security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user activity, etc. IBM QRadar...

S3Scanner Path Traversal Vulnerability

S3Scanner is an open source tool for finding open S3 storage buckets and dumping their contents by Dan Salmon, an individual developer in the United States. S3Scanner prior to version 2.0.2 suffers from a path traversal vulnerability that stems from a failure of a networked system or product to...

Redash input validation error vulnerability

Redash is a data integration and analysis solution from the Israeli company Redash. Redash 10.0.0 and earlier versions are vulnerable to an input validation error, which stems from the program's implementation of the Google sign-in feature that does not properly use the "state" parameter to pass...

Microsoft Windows Update Assistant权限提升漏洞

Microsoft Windows Update Assistant, a system update tool from Microsoft Corporation, contains an elevation of privilege vulnerability that stems from a lack of filtering and restriction on privilege handling, which could be exploited by an attacker to The vulnerability is caused by a lack of...

Binatone Motorola-branded Camera Licensing Issue Vulnerability

The Binatone Motorola-branded Camera is a Binatone licensed Motorola-branded product camera from Binatone, Inc. The Binatone Motorola-branded Camera is vulnerable to licensing issues, which could be exploited by an attacker to gain physical access to the device through the interface or unauthoriz...

WordPress Plugin SQL Injection Vulnerability (CNVD-2021-101472)

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the server in PHP and MySQL to set up a personal blog site. WordPress Plugin is a WordPress open source application plug-ins. wordpress Plugin Header Footer Code Manager in the...

Google TensorFlow has an unspecified vulnerability (CNVD-2021-92553)

Google TensorFlow is an end-to-end open source platform for machine learning from Google. Google TensorFlow has a security vulnerability that stems from an implementation of SplitV that can trigger a segment error, and no details of the vulnerability are currently available...

Sourcecodester Online Event Booking and Reservation System SQL Injection Vulnerability

Sourcecodester Online Event Booking and Reservation System is developed using PHP, MySQL database, HTML, CSS, Javascript, Bootstrap and AdminLTE. The system can be accessed by three types of users, namely system administrators, students, and instructors. sourcecodester Online Event Booking and...

Sourcecodester Engineers Online Portal Access Control Error Vulnerability

Sourcecodester Engineers Online Portal is an open source online portal. niamunozmonitoringsystem/admin/uploads of Sourcecodester Engineers Online Portal in PHP is vulnerable to An access control error vulnerability can be exploited to bypass access control and access all files uploaded to the web...

Atlassian Jira Access Control Error Vulnerability (CNVD-2022-05447)

Atlassian Jira is a defect tracking management system from Atlassian Australia. Atlassian Jira is vulnerable due to an access control error in the product's /secure/admin/ConfigureBatching!default.jspa file, which fails to properly handle user permissions. An attacker could use an unauthorized us...

Nessus Local Elevation of Privilege Vulnerability (CNVD-2022-03134)

Nessus is a system vulnerability scanning and analysis software. 8.15.2 and earlier versions of Nessus contain a local elevation of privilege vulnerability. An attacker could exploit this vulnerability to run specific executable files on the Nessus Agent host...

aaptjs remote code execution vulnerability (CNVD-2021-84830)

aaptjs is a node wrapper for aapt. aaptjs version 1.3.1 has a remote code execution vulnerability in the packageCmd function. An attacker can exploit this vulnerability to execute arbitrary code via the filePath parameter...