Unspecified Vulnerability in Oracle VM VirtualBox (CNVD-2021-81791)

Oracle VM VirtualBox is a virtual machine management software from Oracle. An unspecified vulnerability in the Core component of Oracle VM VirtualBox versions prior to 6.1.28 can be exploited by an attacker to compromise Oracle VM VirtualBox by logging on to the Oracle VM VirtualBox execution...

Gpac MP4Box memory leak vulnerability

Gpac MP4Box is a multimedia packager. It is mainly used to process ISOBMF files e.g. MP4, 3GP, but can also be used to import/export media from AVI, MPG, MKV, MPEG-2 TS and other container files.Gpac MP4Box suffers from a memory leak vulnerability that can be exploited by attackers to cause a...

PHPFusion Remote Code Execution Vulnerability

PHPFusion is a lightweight open source content management system. A remote code execution vulnerability exists in PHPFusion version 9.03.110. The vulnerability can be exploited to achieve remote code execution by inserting malicious php code or php files into a zip file and uploading it to the...

MP4Box Stack Buffer Overflow Vulnerability

MP4Box is a multimedia packager available in GPAC. A stack buffer overflow vulnerability exists in the nhmldmxsendsample function in src/filters/dmxnhml.c:1004 in MP4Box version 1.0.1. An attacker can exploit this vulnerability to cause a denial of service via the szXmlTo parameter...

Google Android Elevation of Privilege Vulnerability (CNVD-2021-80276)

Android is a Linux-based open source operating system developed by Google Inc. and the Open Handset Alliance OHA. an elevation of privilege vulnerability exists in the Framework component of Google Android. An attacker could exploit this vulnerability to execute arbitrary code in the context of a...

Siemens Solid Edge Post-release Reuse Vulnerability (CNVD-2021-75892)

Solid Edge is a 3D CAD, parametric feature and synchronous technology solid modeling software. versions prior to Siemens Solid Edge SE2021MP8 contain a post-release reuse vulnerability when parsing OBJ files. An attacker could exploit this vulnerability to execute code in the context of the curre...

Google Chrome Post-release Reuse Vulnerability (CNVD-2021-99288)

Chrome is a simple and efficient web browsing tool developed by Google. portals in versions prior to Google Chrome 94.0.4606.61 are vulnerable to post-release reuse. An attacker could exploit this vulnerability to be able to perform a sandbox escape via a crafted HTML page...

FAAD2 Heap Buffer Overflow Vulnerability (CNVD-2021-89951)

Freeware Advanced Audio Decoder 2 FAAD2 is an open source MPEG-4 and MPEG-2 AAC decoder licensed under the GPLv2 license. a heap buffer overflow vulnerability exists in the stszin function in mp4read.c in FAAD2 version 2.10.0 and earlier. An attacker could exploit this vulnerability to execute co...

fig2dev segmentation error vulnerability

fig2dev is used to convert .fig files to various graphics languages and formats. A segmentation error vulnerability exists in the gencgmstart function in gencgm.c in fig2dev version 3.2.7b. No detailed vulnerability details are currently available...

Nextcloud has an unspecified vulnerability (CNVD-2022-18419)

Nextcloud Text is an open source self-hosted file synchronization and sharing communication application platform from the German company Nextcloud. Nextcloud Text has a security vulnerability that could be exploited by attackers to enumerate folders in such shares...

Tcpreplay Buffer Overflow Vulnerability (CNVD-2021-93920)

Tcpreplay is a set of GPLv3 licensed utilities for UNIX operating systems to edit and replay network traffic captured by tools such as tcpdump and Ethereal/Wireshark. The dochecksum function in checksum.c in Tcpreplay version 4.3.2 is vulnerable to a buffer overflow vulnerability. An attacker can...

LedgerSMB Cross-Site Scripting Vulnerability

LedgerSMB is a free web-based double-entry bookkeeping system with quoting, ordering, invoicing, projects, time cards, inventory management, shipping, etc. A cross-site scripting vulnerability exists in LedgerSMB, which stems from the application's failure to adequately encode HTML for error...

RaspAP Remote Code Execution Vulnerability (CNVD-2021-94941)

RaspAP is a software solution that can easily deploy Raspberry Pi as a wireless AP access point with a set of responsive WebUI to control WiFi, as easy to use as a home router. raspap-webgui in RaspAP version 2.6.6 is vulnerable to remote code execution. The vulnerability stems from insecure...

Google TensorFlow Dezero Error Vulnerability (CNVD-2021-64068)

Google TensorFlow is an end-to-end open source machine learning platform. tf.rawops.ResourceGather in versions prior to Google TensorFlow 2.6.0 is vulnerable to a dezero error. An attacker could exploit this vulnerability to cause a denial of service...

GPAC Project on Advanced Content Integer Overflow Vulnerability (CNVD-2021-64078)

GPAC Project on Advanced Content is an open source cross-platform library that implements the MPEG-4 system standard and provides tools for media playback, vector graphics, and 3D rendering. an integer overflow vulnerability exists in the MPEG-4 decoding functionality in GPAC Project on Advanced...

TYPO3 Cross-Site Scripting Vulnerability (CNVD-2022-17974)

TYPO3 is a free and open source content management system framework CMS/CMF from the TYPO3 Typo3 association in Switzerland.TYPO3 Femanager has a cross-site scripting vulnerability that can be exploited by attackers to XSS through a well-designed SVG document...

Google TensorFlow code issue vulnerability (CNVD-2021-64530)

A security vulnerability in Google TensorFlow, an end-to-end open source platform for machine learning from Google, can be exploited to cause undefined behavior by binding references to null pointers in the tf.rawops.Map and tf.rawops. OrderedMap operations to cause undefined behavior by binding ...

Google TensorFlow buffer overflow vulnerability (CNVD-2021-64533)

Google TensorFlow, an end-to-end open source platform for machine learning from Google, has a security vulnerability stemming from the program "tf.rawops. DatasetToTFRecord" implementations can trigger heap buffer overflow and segmentation errors. No detailed vulnerability details are available...

HCC Embedded InterNiche Technologies NicheStack Input Validation Error Vulnerability

InterNiche Technologies NicheStack is a small footprint, RFC-compliant embedded stack that is portable to commercial or proprietary non-MMU operating systems. InterNiche Technologies NicheStack suffers from an input validation error vulnerability that stems from a boundary condition in the ICMP...

Emerson GE Automation Proficy Machine Buffer Overflow Vulnerability

Emerson GE Automation Proficy Machine Edition is an application from emerson, Inc. An automation solution. A buffer error vulnerability exists in Emerson GE Automation Proficy Machine that originates from a buffer overflow in Emerson GE Automation Proficy Machine Edition v8.0. The vulnerability c...

CheckMK management web console cross-site scripting vulnerability

CheckMK management web console is an application. Based on Asciidoctor and automatically available on HTML docs.checkmk.com. CheckMK management web console suffers from a cross-site scripting vulnerability that could be exploited by attackers to open a backdoor on the device using HTML content...

deepmergefn has unspecified vulnerabilities

deepmergefn is an application. A deepmergefn mixes two data objects. deepmergefn suffers from a security vulnerability that stems from vulnerability to prototype contamination via the deepMerge function, which can be exploited by attackers to cause remote code execution...

Racket Access Control Error Vulnerability

Racket is an open source general-purpose programming language and an ecosystem for language-oriented programming.An access control error vulnerability exists in Racket versions prior to 8.2, which stems from the fact that code evaluated using the Racket sandbox may cause system modules to...

Siemens Jt2go and Siemens Teamcenter Visualization Remote Code Execution Vulnerability

Siemens Jt2go and Siemens Teamcenter Visualization are both products of Siemens AG, Germany. Siemens Jt2go is a JT file viewer. A remote code execution vulnerability exists in Siemens JT2Go versions prior to 13.2 and Teamcenter Visualization versions prior to 13.2, which stems from a failure of t...

NETGEAR WAC104 Authentication Bypass Vulnerability

NETGEAR WAC104 is a wireless access point AP from Netgear, Inc. The NETGEAR WAC104 authentication bypass vulnerability can be exploited by an unauthenticated attacker to bypass the AP by placing...

Shopware Information Disclosure Vulnerability (CNVD-2021-45747)

Shopware is an open source e-commerce platform. An information disclosure vulnerability exists in versions of Shopware prior to 6.3.5.1. An attacker can exploit this vulnerability to obtain sensitive information via the Store-API...

WordPress WP-CLI Trust Management Issue Vulnerability

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language.WP-CLI is the command line interface for WordPress. WordPress WP-CLI has a trust management issue vulnerability that can be exploited by remote attackers to be able to intercept communications...

Mozilla Firefox has an unspecified vulnerability (CNVD-2021-54701)

Mozilla Firefox is an open source Web browser from the Mozilla Foundation in the U.S. A security vulnerability exists in Mozilla Firefox, which stems from a malicious Web site that generates HTTP authentication dialogs that could trick the built-in password manager into suggesting a password for...

Huawei eCNS280_TD and ESE620X vESS licensing issue vulnerability

Huawei eCNS280TD is a core network device for the wireless broadband trunking system of Huawei China. Huawei ESE620X vESS is a virtual enterprise service controller of Huawei China. Huawei eCNS280TD and ESE620X vESS are vulnerable to an authorization issue that vulnerability stems from file acces...

Microsoft Windows/Windows Server Elevation of Privilege Vulnerability (CNVD-2021-66099)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, an operating system for personal devices, and Microsoft Windows Server, a server operating system. An elevation of privilege vulnerability exists in the "Container Manager Service" of Microsoft...

Michael Stepankin OpenID-Connect-Java-Spring-Server Server-Side Request Forgery Vulnerability

Michael Stepankin OpenID-Connect-Java-Spring-Server is a GlobalMichael Stepankin open source application system provides OpenID Connect identity provider and generic OAuth 2.0 authorization server Michael Stepankin OpenID-Connect-Java-Spring-Server suffers from a server-side request forgery...

B2evolution Cross-Site Scripting Vulnerability (CNVD-2021-100271)

B2evolution is a PHP and MySQL-based community content management system. B2evolution cross-site scripting vulnerability can be exploited by attackers to execute malicious JavaScript code via the plugin name input field in the plugin module...

Owasp Json-sanitizer Input Validation Error Vulnerability

Owasp Json-sanitizer is the Owasp Foundation of a Java-based Json can be based on the text content similar to the Json code library to generate data in Json format . An input validation error vulnerability exists in OWASP JSON -sanitizer prior to version 1.2.2, which stems from the fact that a...

ProcessMaker SQL Injection Vulnerability

ProcessMaker is a software suite for workflow management that can be used to automate workflows, create documents, assign roles and users to processes, and more. download page /sysworkflow/en/neoclassic/reportTables/ in ProcessMaker 3.4.11 A SQL injection vulnerability exists in the sort paramete...

Microsoft Windows/Windows Server Information Disclosure Vulnerability (CNVD-2021-63308)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation USA, Microsoft Windows is an operating system for personal devices, and Microsoft Windows Server is a server operating system. Microsoft Windows/Windows Server Delivery Optimization is vulnerable to...

libproxy buffer overflow vulnerability (CNVD-2020-58045)

libproxy is a library for individual developers that provides automatic configuration of proxies. A buffer overflow vulnerability exists in libproxy version 0.4.15, which stems from the fact that urls .cpp is susceptible to buffer overflows, as evidenced by a large PAC file with no content length...

Microsoft Windows/Windows Server Information Disclosure Vulnerability (CNVD-2021-63309)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, an operating system for personal devices, and Microsoft Windows Server, a server operating system. Microsoft Windows/Windows Server is vulnerable to an information disclosure vulnerability that originates...

Net-SNMP Resource Management Error Vulnerability

Net-SNMP is an open source Simple Network Management Protocol SNMP software. The software is used to monitor network devices, computer devices, UPS devices and so on. A resource management error vulnerability exists in the usmfreeusmStateReference of the snmplib/snmpusm.c file in versions of...

NVIDIA Linux GPU Display Driver Competitive Conditions Issue Vulnerability

NVIDIA Linux GPU Display Driver is a graphics processor GPU graphics card driver from NVIDIA dedicated to the Linux platform. A security vulnerability exists in the NVIDIA Linux GPU Display Driver. An attacker could exploit this vulnerability to cause a denial of service...

SolarWinds MSP PME (Patch Management Engine) Cache Service Code Execution Vulnerability

SolarWinds Advanced Monitoring Agent is a set of monitoring agent software from SolarWinds, Inc. The software is mainly used for remote monitoring and management of servers, etc. SolarWinds MSP PME Cache Service is one of the patch management engine cache service. A security vulnerability exists ...

Unspecified Vulnerability in Saml2 Authentication services for ASP.NET

Saml2 Authentication services for ASP.NET is a SAML Security Assertion Markup Language authentication service for ASP.NET. A security vulnerability exists in the method of token authentication in Saml2 Authentication services for ASP.NET versions 1.0.2 and 2.0.0 through 2.6.0. An attacker could...

Microsoft Internet Explorer Scripting Engine Remote Code Execution Vulnerability (CNVD-2020-19962)

Microsoft Internet Explorer IE is a Web browser that comes with the Windows operating system from the American company Microsoft. A remote code execution vulnerability exists in the way the scripting engine handles memory objects in Microsoft IE 11. An attacker could exploit this vulnerability to...

openfortivpn Certificate Validation Mishandling Vulnerability

openfortivpn is a client program for PPP Point-to-Point Protocol + SSL Transport Layer Security Protocol VPN tunneling service. A security vulnerability exists in openfortivpn version 1.11.0 using OpenSSL versions prior to 1.0.2, which stems from a failure to take into account the '' character wh...

Unspecified Vulnerability in Teclib GLPI

Teclib GLPI is an open source IT asset management suite from the French company Teclib. The suite includes features such as device status management, asset inventory storage, management processes and work log management. A security vulnerability exists in Teclib GLPI 9.4.3 and earlier versions,...

WordPress Cross-Site Scripting Vulnerability (CNVD-2019-31831)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress has a cross-site scripting vulnerability that can be exploited by attackers to execute client-side...

SquirrelMail Cross-Site Scripting Vulnerability (CNVD-2019-20986)

SquirrelMail is a set of PHP language development , cross-platform Webmail mail system . A cross-site scripting vulnerability exists in SquirrelMail versions 1.4.22 and later and version 1.5.x before 1.5.2. The vulnerability stems from a lack of proper validation of client data by the web...

CloudBees Jenkins Token Macro Plugin XML External Entity Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Token Macro Plugin is used in one of the...

libpng buffer overflow vulnerability (CNVD-2019-13088)

libpng is a PNG reference library that can create, read and write PNG graphics files. A buffer overflow vulnerability exists in the 'contrib/pngminus/pnm2png.c:gettoken' function in libpng, which originates when a networked system or product performs an operation in memory without properly...

KDE KAuth Input Validation Error Vulnerability

KDE KAuth is a cross-platform authentication API from the KDE community. A security vulnerability exists in versions of KDE KAuth prior to 5.55. An attacker can exploit the vulnerability to bypass restrictions...

LIVE555 Memory Leak Vulnerability

LIVE555 is a set of open source C++ libraries for multimedia streaming. LIVE555 suffers from a memory leak vulnerability. The vulnerability stems from because when multiple instances of a single field username, realm, nonce, uri, or response exist, only the last instance can be freed. An attacker...