Siemens syngo Dynamics has an unspecified vulnerability (CNVD-2023-03928)

Siemens syngo Dynamics is a cardiovascular imaging and information solution from Siemens, a German company designed to be a centralized digital hub for complete cardiovascular services. Designed to be a centralized digital hub for complete cardiovascular services, Siemens syngo Dynamics suffers...

Online Diagnostic Lab Management System SQL Injection Vulnerability

Online Diagnostic Lab Management System is an online diagnostic lab management system. v1.0 of Online Diagnostic Lab Management System has a security vulnerability that originates from a SQL injection via the /clients/viewclient.php in the id parameter in /clients/viewclient.php contains SQL...

Siemens POWER METER SICAM Q100 Input Validation Error Vulnerability (CNVD-2022-75539)

The POWER METER SICAM Q100 is a multifunctional device used to detect, report and analyze measured values and events. Siemens POWER METER SICAM Q100 is vulnerable to an input validation error, which could be exploited by an attacker to crash the device followed by an automatic reboot or execute...

Corel CorelDRAW Graphics Suite buffer overflow vulnerability (CNVD-2023-29427)

Corel CorelDRAW Graphics Suite is a vector graphics creation tool from Corel. A buffer overflow vulnerability exists in Corel CorelDRAW Graphics Suite, which can be exploited by attackers to execute code in the context of the current process...

Bento4 AP4_BitReader::ReadCache function denial of service vulnerability

Bento4 is an open source C library for reading and writing MP4 files. Bento4 v1.6.0-639 contains a denial of service vulnerability that stems from a boundary error in the AP4BitReader::ReadCache function in mp42ts when handling untrusted input. An attacker could exploit the vulnerability to launc...

Unspecified vulnerability in Tenda TX3 (CNVD-2022-70576)

Tenda TX3 is a wireless router from Tenda, a Chinese company. A security vulnerability exists in Tenda TX3 USTX3V1.0brV16.03.13.11multiTDE01, which originates from the list parameter of /goform/SetVirtualServerCfg containing a stack overflow. No detailed vulnerability details are provided at this...

phpIPAM header injection vulnerability

phpIPAM is an open source PHP and MySQL-based IP address management application IPAM. phpIPAM version 1.5.0 is vulnerable to header injection, which stems from a lack of validation of input data in component/admin/subnets/ripe-query.php, and can be exploited by attackers to cause header injection...

Simple Cold Storage Management System SQL Injection Vulnerability (CNVD-2022-69149)

Simple Cold Storage Management System is a web-based application used as a cold storage business website to provide their customers or potential customers with an easy-to-access platform to learn about their company. A SQL injection vulnerability exists in Simple Cold Storage Management System...

Cisco IOS XE SD-WAN Software and SD-WAN Software Path Traversal Vulnerability

Cisco IOS XE SD-WAN Software and Cisco SD-WAN are both products of Cisco U.S.A. Cisco IOS XE SD-WAN Software is a software for network management software-defined networking applied to the Cisco IOS XE network operating system. The Cisco IOS XE SD-WAN and Cisco SD-WAN are vulnerable to a path...

Tenda TX3 has an unspecified vulnerability

Tenda TX3 is a wireless router from Tenda China.A security vulnerability exists in Tenda TX3 USTX3V1.0brV16.03.13.11 version, which stems from compareparentcontroltime being vulnerable to heap-based buffer overflow. No detailed vulnerability details are currently available...

Caryll OTFCC otfccdump+0x6adb1e buffer overflow vulnerability

Caryll OTFCC is Caryll open source a C library and utility programs. Used to parse and write OpenType font files. Caryll OTFCC suffers from a buffer overflow vulnerability that originates from a boundary error in /release-x64/otfccdump+0x6adb1e when handling untrusted input. An attacker could...

Nepxion Discovery Remote Code Execution Vulnerability

Nepxion Discovery is an enhanced middleware for service registration discovery for Spring Cloud. Nepxion Discovery 6.16.2 and earlier versions are vulnerable to a remote code execution vulnerability that stems from a lack of validation of input data in Discovery-commons and is susceptible to SpEL...

WordPress SEO Smart Links Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Linux kernel resource management error vulnerability (CNVD-2022-69191)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A resource management error vulnerability exists in Linux kernel 5.19.10 and earlier versions, which stems from a confusion in the instruction responsible for freeing memory in...

Adobe Experience Manager Cross-Site Scripting Vulnerability (CNVD-2022-66020)

Adobe Experience Manager AEM is a content management solution from Adobe that can be used to build websites, mobile applications and forms. The solution supports mobile content management, marketing and sales campaign management, and multi-site management, etc. Adobe Experience Manager is...

Mozilla Firefox Resource Management Error Vulnerability (CNVD-2023-06859)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from a memory misreference vulnerability that stems from concurrent use of the URL parser for non-UTF-8 data not being thread-safe. An attacker could exploit the vulnerability t...

Huawei EMUI and Magic UI out-of-bounds write vulnerability (CNVD-2023-01059)

Huawei EMUI is a mobile operating system based on Android development.Huawei Magic UI is a smart device operating system. Huawei EMUI and Magic UI have an out-of-bounds write vulnerability that can be exploited by an attacker to cause a crash and reboot...

Google TensorFlow Denial of Service Vulnerability (CNVD-2023-15783)

Google TensorFlow is an end-to-end open source platform for machine learning from Google. Google TensorFlow has a denial-of-service vulnerability that could be exploited by attackers to trigger a denial-of-service attack...

Adobe InDesign out-of-bounds read vulnerability (CNVD-2022-79418)

Adobe InDesign, a set of typesetting and editing applications from Adobe, has an out-of-bounds read vulnerability that could be exploited by attackers to cause a sensitive memory leak...

Microsoft Azure Site Recovery Remote Code Execution Vulnerability (CNVD-2022-84112)

Microsoft Azure Site Recovery is a site recovery DRaaS from Microsoft Corporation for cloud and hybrid cloud architectures. The vulnerability stems from the failure of a network system or product to properly filter special elements of code segments during the construction of external input data. ...

TP-LINK TL-R473G Remote Code Execution Vulnerability

The TP-LINK TL-R473G is a Gigabit Enterprise VPN Router from China P&L TP-LINK. A security vulnerability exists in TP-LINK TL-R473G version 2.0.1 Build 220529 Rel.65574n. An attacker exploits the vulnerability to execute remote code via specially crafted packets...

Apple macOS Monterey buffer overflow vulnerability (CNVD-2022-71989)

Apple macOS Monterey is the 18th major release of Apple's macOS for the Macintosh desktop operating system. A buffer overflow vulnerability exists in Apple macOS Monterey versions prior to 12.5, which stems from allowing local users to access potentially sensitive information. Install the update...

IBM Engineering Lifecycle Optimization Cross-Site Scripting Vulnerability (CNVD-2022-55503)

IBM Engineering Lifecycle Optimization ELO is an extension of the Engineering Lifecycle Management ELM portfolio from IBM America. They make it easier to collect and analyze data across the development environment to make better decisions. Automate reporting to ensure that the entire organization...

WordPress Pricing Deals for WooCommerce plugin SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Pricing Deals for WooCommerce plugin 2.0.2.02 and earlier versions are vulnerable to SQL...

WordPress WP-Paginate plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin User Login Log cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

IBM CICS TX Advanced Cross-Site Scripting Vulnerability

IBM CICS TX Advanced is a comprehensive, single transaction runtime package from IBM USA. It can provide a cloud-native deployment model for standalone applications. A cross-site scripting vulnerability exists in all versions of IBM CICS TX Advanced, which stems from the program's lack of data...

Google Android out-of-bounds write vulnerability (CNVD-2022-61752)

Google Android is a Linux-based open source operating system from Google, Inc. An out-of-bounds write vulnerability exists in Google Android due to a missing boundary check in readattrvalue of gattdb.cc. An attacker could exploit this vulnerability to execute arbitrary on the system...

Multiple MediaTek Chips Autoboot Access Control Error Vulnerability

MediaTek Inc. is the world's fourth largest fab-based semiconductor company and a leader in the markets of mobile terminals, smart home applications, wireless connectivity and Internet of Things IoT products, with approximately 1.5 billion units of end products with built-in MediaTek chips hittin...

Bluetooth buffer overflow vulnerability in multiple MediaTek chips (CNVD-2022-66253)

MediaTek Inc. is the world's fourth largest fab-based semiconductor company and a leader in the markets of mobile terminals, smart home applications, wireless connectivity and Internet of Things IoT products, with approximately 1.5 billion units of end products with built-in MediaTek chips hittin...

Google Android Framework Information Disclosure Vulnerability (CNVD-2022-56134)

Google Android is a Linux-based open source operating system from Google, Inc. The Google Android Framework is vulnerable to information leakage, which stems from a lack of protection for sensitive information and can be exploited by attackers to obtain sensitive information...

Zoo Management System Cross-Site Scripting Vulnerability

PHPGURUKUL Zoo Management System is a zoo management system by Phpgurukul team. A cross-site scripting vulnerability exists in Zoo Management System v1.0, which stems from a lack of checksum filtering of user-supplied data and output in the Add Category feature. The vulnerability can be exploited...

Jenkins Elasticsearch Query Plugin信息泄露漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.An information disclosure vulnerability...

Apache Tika Denial of Service Vulnerability (CNVD-2022-51053)

Apache Tika is a collection of content extraction tools from the Apache Foundation that integrates POI an open source library that uses Java programs to provide read and write functionality for Microsoft Office format documents, Pdfbox a pure Java library for reading and creating PDF documents an...

DCMTK Denial of Service Vulnerability

DCMTK is a collection of libraries and applications that implement most DICOM standards. Software for inspecting, building and converting DICOM image files, handling offline media, sending and receiving images over a network connection, and demo image storage and worklist servers. a denial of...

Hikvision Hybrid SAN/Cluster Storage Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability exists in Hikvision Hybrid SAN/Cluster Storage, a series of affordable and reliable hybrid SAN storage area network products from Hikvision, China. vulnerability stems from insufficient input validation in the web module. An attacker could exploit the...

WordPress Flower Delivery by Florist One跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Flower Delivery by Florist One versions prior to 3.5.10 have a cross-site scripting...

Zulip logic error vulnerability

Zulip is a powerful open source group chat application from the Zulip team. Used to combine the immediacy of real-time chat with the productivity benefits of threaded conversations. A logic error vulnerability exists in Zulip versions 2.1.0 through 5.2, which originates when the server incorrectl...

74cmsSE SQL Injection Vulnerability (CNVD-2022-61440)

74cmsSE is a free open source professional recruitment system based on PHP MYSQL. 74cmsSE is vulnerable to SQL injection, which results from the lack of validation of external input SQL statements in the /freelance/resumelist keyword parameter. An attacker could use this vulnerability to execute...

Google Android Elevation of Privilege Vulnerability (CNVD-2022-52270)

Google Android is a Linux-based open-source operating system from the U.S. company Google. Google Android has an elevation of privilege vulnerability that could be exploited by attackers to cause a local privilege escalation that requires the user to execute the privilege...

Mautic Cross-Site Scripting Vulnerability

Mautic is a marketing automation software. The software monitors and manages websites, sends emails and manages customer resources. A cross-site scripting vulnerability exists in Mautic versions prior to 4.3.0, which can be exploited by an attacker to execute JavaScript code on the client side...

Tenda AC18 Remote Code Execution Vulnerability (CNVD-2023-15693)

A remote code execution vulnerability exists in Tenda AC18 V15.03.05.19 and V15.03.05.05, which stems from the failure of the Mac parameter of ip/goform/WriteFacMac to properly filter the special elements of the constructed code segment. An attacker could exploit the vulnerability to cause...

GPAC MP4Box Denial of Service Vulnerability

GPAC is a multimedia framework. A denial of service vulnerability exists in GPAC MP4Box version 1.1.0, which originates from a stack buffer overflow at src/utils/error.c:1769 that can be exploited by an attacker to cause a denial of service...

Microsoft SharePoint Server Remote Code Execution Vulnerability (CNVD-2022-59591)

Microsoft SharePoint Server is a remote code execution vulnerability in Microsoft SharePoint Server, an enterprise business collaboration platform from Microsoft Corporation. An attacker could use this vulnerability to execute arbitrary code on the system...

WordPress Mobile browser color select plugin cross-site request forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

Online Fire Reporting System SQL Injection Vulnerability (CNVD-2022-55739)

Online Fire Reporting System is an online fire reporting system from Carlo Montero's personal developer. version v1.0 of Online Fire Reporting System is vulnerable to SQL injection, which originates from /ofrs/admin/?page=requests/ managerequest&id=Lack of validation of external input SQL...

ACEware Systems ACEweb Online Portal SQL Injection Vulnerability

ACEware Systems ACEweb Online Portal is a component of the Student Manager solution from ACEware Systems, Inc. A SQL injection vulnerability exists in ACEware Systems ACEweb Online Portal version 3.5.065, which stems from The conditional parameter in showchedule.awp lacks validation for external...

Tenda HG6 Command Injection Vulnerability

Tenda HG6 is an intelligent routing passive optical network terminal from Tenda, China.A command injection vulnerability exists in Tenda HG6, which stems from the failure of the pingAddr and traceAddr parameters to properly filter the construction of command special characters, commands, etc. An...

HUAWEI HarmonyOS Buffer Overflow Vulnerability (CNVD-2022-66178)

HUAWEI HarmonyOS is an operating system from Huawei, China HUAWEI. HUAWEI HarmonyOS 2.0 is vulnerable to a buffer overflow vulnerability that can be exploited by attackers to cause availability impairment...

Owl Labs Meeting Owl Information Disclosure Vulnerability

Owl Labs Meeting Owl is a video conferencing device from Owl Labs, Inc. Equipped with a series of cameras and microphones, it captures 360-degree video and audio and automatically focuses on the speaker, making meetings more dynamic and inclusive.Owl Labs Meeting Owl version 5.2.0.15 contains an...