131391 matches found
Online Fire Reporting System SQL Injection Vulnerability (CNVD-2022-55739)
Online Fire Reporting System is an online fire reporting system from Carlo Montero's personal developer. version v1.0 of Online Fire Reporting System is vulnerable to SQL injection, which originates from /ofrs/admin/?page=requests/ managerequest&id=Lack of validation of external input SQL...
ACEware Systems ACEweb Online Portal SQL Injection Vulnerability
ACEware Systems ACEweb Online Portal is a component of the Student Manager solution from ACEware Systems, Inc. A SQL injection vulnerability exists in ACEware Systems ACEweb Online Portal version 3.5.065, which stems from The conditional parameter in showchedule.awp lacks validation for external...
Tenda HG6 Command Injection Vulnerability
Tenda HG6 is an intelligent routing passive optical network terminal from Tenda, China.A command injection vulnerability exists in Tenda HG6, which stems from the failure of the pingAddr and traceAddr parameters to properly filter the construction of command special characters, commands, etc. An...
HUAWEI HarmonyOS Buffer Overflow Vulnerability (CNVD-2022-66178)
HUAWEI HarmonyOS is an operating system from Huawei, China HUAWEI. HUAWEI HarmonyOS 2.0 is vulnerable to a buffer overflow vulnerability that can be exploited by attackers to cause availability impairment...
Owl Labs Meeting Owl Information Disclosure Vulnerability
Owl Labs Meeting Owl is a video conferencing device from Owl Labs, Inc. Equipped with a series of cameras and microphones, it captures 360-degree video and audio and automatically focuses on the speaker, making meetings more dynamic and inclusive.Owl Labs Meeting Owl version 5.2.0.15 contains an...
InHand Networks InRouter302 OS Command Injection Vulnerability (CNVD-2022-59177)
InHand Networks InRouter Series is a series of routers from InHand Networks, Inc. InHand Networks InRouter302 version 3.5.4 has an operating system command injection vulnerability that can be exploited by attackers to execute arbitrary commands with the help of specially crafted network requests...
Totolink N200RE and N100RE Cross-Site Scripting Vulnerability
Totolink N200RE and Totolink N100RE are routers from Totolink.Totolink N200RE and N100RE are vulnerable to cross-site scripting, which can be exploited by attackers to execute arbitrary web scripts or HTML...
SourceCodester Car Rental Management System Arbitrary File Upload Vulnerability
Sourcecodester Car Rental Management System is a car rental management system from Sourcecodester, Inc. SourceCodester Car Rental Management System version 1.0 is vulnerable to an arbitrary file upload vulnerability, which originates from The vulnerability is caused by a lack of validation of...
JetBrains Ktor Native Security Feature Issue Vulnerability
JetBrains Ktor Native is an asynchronous framework for creating microservices, web applications, etc. JetBrains Ktor Native versions prior to 2.0.0 are vulnerable to a security feature that stems from the fact that random values used for random number generation are not implemented using...
Cisco RoomOS Software and Cisco TelePresence Collaboration Endpoint Software Redirection Vulnerability
Cisco RoomOS Software and Cisco TelePresence Collaboration Endpoint Software are both products of Cisco, a U.S. company.Cisco RoomOS Software is a set of automated management software for Cisco devices. Cisco TelePresence Collaboration Endpoint Software is a set of collaboration endpoint...
JetBrains IntelliJ IDEA Code Injection Vulnerability
JetBrains IntelliJ IDEA is a suite of integrated development environments for the Java language from Jetbrains, a Czech company.A code injection vulnerability exists in versions of JetBrains IntelliJ IDEA prior to 2022.1, which stems from the execution of native code via a link in Quick...
WordPress plugin Master Elements SQL injection vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress plugin Master Elements 8.0 and earlier versions are vulnerable to SQL injection, which stems from t...
FANUC ROBOGUIDE XML External Entity Injection Vulnerability
FANUC ROBOGUIDE is a robot simulation software from FANUC Japan. FANUC ROBOGUIDE v9.40083.00.05 and earlier versions exist XML external entity injection vulnerability, which originates from the lack of application restrictions on external entities. An attacker could exploit this vulnerability to...
Microsoft Windows Kerberos Elevation of Privilege Vulnerability
Microsoft Windows Kerberos is a software for authentication in network clusters from Microsoft Corporation USA.Kerberos also serves as a network authentication protocol and is designed to provide strong authentication services for client/server applications through a key system.Microsoft Windows...
Microsoft Dynamics 365 (on-premises) Remote Code Execution Vulnerability
Microsoft Dynamics is a suite of ERP business solutions for multinational companies from Microsoft Corporation USA. A remote code execution vulnerability exists in Microsoft Dynamics 365 on-premises, which includes financial management, production management, and business intelligence management...
Microsoft Visual Studio Elevation of Privilege Vulnerability (CNVD-2022-60135)
Microsoft Visual Studio is a family of development tool suites from Microsoft, and a largely complete development toolset that includes most of the tools needed throughout the software life cycle. An elevation of privilege vulnerability exists in Microsoft Visual Studio Code, which stems from...
Fortinet FortiEDR Trust Management Issue Vulnerability (CNVD-2022-47976)
Fortinet FortiEDR is a scratch-built endpoint security solution from Fortinet U.S.A. Fortinet FortiEDR is vulnerable to a trust management issue that stems from the use of hard-coded encrypted RSA keys, which can be exploited by local attackers to disable and offload collectors from endpoints in...
HPE OneView Information Disclosure Vulnerability
HPE OneView is a software from Hewlett Packard Enterprise HPE that facilitates automated device management for IT departments. HPE OneView versions prior to 6.6 contain an information disclosure vulnerability that stems from a configuration or other error in the operation of the network system or...
Joomla! information disclosure vulnerability (CNVD-2022-64097)
Joomla! is a set of forum components used in the Joomla! content management system. An information disclosure vulnerability exists in versions 3.0.0 through 3.10.6 and 4.0.0 through 4.1.0, which stems from an error caused by uploading a file name that is too long. The error displays a screen with...
WordPress Simple Tracking plugin cross-site scripting vulnerability
WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. WordPress plugin is an application plugin for WordPress. A cross-site scripting vulnerability exists in versions of WordPress Simple Tracking plugin prior to 1.7, which stems from the plugin's...
Calibre-Web suffers from a server-side cross-site request forgery vulnerability (CNVD-2022-29585)
Calibre-Web is a web application for browsing, reading and downloading eBooks from the Calibre database. Calibre-Web suffers from a server-side cross-site request forgery vulnerability, no detailed vulnerability details are available at this time...
WordPress Conversios.io plugin SQL injection vulnerability
WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress plugin is an application plugin for WordPress. SQL injection vulnerability exists in versions of WordPress...
IBM Jazz Reporting Service Cross-Site Scripting Vulnerability (CNVD-2022-28800)
IBM Jazz Reporting Service helps you quickly and easily integrate data from a variety of data sources across your tools and projects, and provides a set of ready-to-use reports for sharing information about your lifecycle management projects. A cross-site scripting vulnerability exists in IBM Jaz...
MingSoft Mcms SQL Injection Vulnerability (CNVD-2022-18535)
MingSoft Mcms is China's MingFei MingSoft company's a complete open source J2ee system . A security vulnerability exists in MingSoft Mcms v5.2.4 that allows attackers to conduct SQL injection attacks via the search.do parameter in the file /mdiy/dict/listExcludeApp. No details of the vulnerabilit...
WordPress WHMCS Bridge plugin cross-site scripting vulnerability
WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. cross-site scripting vulnerability exists in versions of WordPress WHMCS Bridge plugin prior to 6.4b, which ste...
Hayageek Jquery Upload File Cross-Site Scripting Vulnerability
Hayageek Jquery Upload File is a jQuery-based file upload plugin from Hayageek's personal developer. Hayageek Jquery Upload File v4.0.11 contains a cross-site scripting vulnerability that could be exploited by attackers to execute arbitrary web script or HTML via a specially crafted file with a...
Envoy Trust Management Issue Vulnerability (CNVD-2022-15535)
Envoy is an open source distributed proxy server. Envoy is vulnerable to a trust management issue, which stems from the fact that Envoy's tls allows certain certificate authentication settings to be reused after they have been changed from their default configuration. No detailed vulnerability...
Unspecified vulnerability in livehelperchat (CNVD-2022-13348)
livehelperchat is available through live helper chat and can be used to provide live support on the website for free. A security vulnerability exists in versions prior to livehelperchat 3.92v that stems from a user control key authorization bypass. No details of the vulnerability are provided at...
Cisco Email Security Appliance Resource Management Error Vulnerability (CNVD-2022-13368)
The Cisco Email Security Appliance ESA is an email security appliance from Cisco, U.S.A. A resource management error vulnerability exists in the Cisco Email Security Appliance DNS Verification, which could be exploited by an attacker to cause the appliance to be inaccessible from the management...
Atlassian Jira Service Management Server Licensing Issue Vulnerability
Atlassian Jira Service is a server-based version of Atlassian Australia's IT service desk and request tracking system, which is used to receive, track and manage requests from team clients. An authorization issue vulnerability exists in Atlassian Jira Service Management Server, which stems from...
Jenkins autonomiq Plugin跨站请求伪造漏洞
Jenkins is a Jenkins open source application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.A cross-site request forgery vulnerability exists in Jenkins autonomiq Plugin 1.15 and earlier versions, which stems from...
Jenkins dbCharts Plugin Access Control Error Vulnerability
Jenkins plug-ins are plug-ins that provide appropriate functionality for Jenkins. Jenkins dbCharts Plugin Access Control Error Vulnerability. An attacker can exploit this vulnerability to connect to a specified database using JDBC with specified credentials...
Microsoft SharePoint Server Security Feature Bypass Vulnerability
Microsoft SharePoint is an enterprise business collaboration platform from Microsoft Corporation USA. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and...
Bentley Systems Bentley View Buffer Overflow Vulnerability
Bentley Systems Bentley View is a free viewer from Bentley Systems, USA. A buffer overflow vulnerability exists in Bentley View that can be exploited by an attacker to disclose sensitive information about an affected Bentley View installation...
WordPress UpdraftPlus WordPress Backup plugin cross-site scripting vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. A cross-site scripting vulnerability exists in the WordPress UpdraftPlus Backup Plugin in versions prior to 1.16.69. The vulnerability stems from the failure to escape the updraftrestore parameter and c...
Emlog Cross-Site Scripting Vulnerability (CNVD-2022-11528)
Emlog is a PHP and MySQL-based CMS website builder from Emlog personal developers. Emlog suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data by the WEB application. An attacker could use this vulnerability to execute JavaScript code ...
Insyde InsydeH2O Buffer Overflow Vulnerability (CNVD-2022-10273)
Insyde InsydeH2O is a C source from Insyde Software Taiwan, China that implements the new technology "EFI/UEFI" specification, designed to replace the legacy BIOS Basic Input/Output System. Operating System H2O UEFI firmware has a buffer overflow vulnerability that can be exploited to write fixed...
Siemens Teamcenter Visualization and Solid Edge Out-of-Bounds Reading Vulnerability
Siemens Teamcenter Visualization is a software that provides team collaboration capabilities for designing 2D and 3D scenes. Siemens Solid Edge is a 3D CAD software from Siemens, a German company. Solid Edge has an out-of-bounds read vulnerability that can be exploited by attackers to execute cod...
Siemens Simcenter Femap File Parsing Vulnerability
Siemens Simcenter Femap is a cutting-edge engineering simulation application from Siemens, Germany. It is used to create, edit and import/reuse mesh-based finite element analysis models of complex products or systems. Siemens Simcenter Femap is vulnerable to file parsing, which can be exploited b...
Siemens Simcenter Femap类型混淆漏洞
Siemens Simcenter Femap is a cutting-edge engineering simulation application from Siemens, Germany. It is used to create, edit and import/reuse mesh-based finite element analysis models of complex products or systems. Siemens Simcenter Femap is vulnerable to type obfuscation, which could be...
Siemens SIMATIC PCS 7 and SIMATIC WinCC Information Disclosure Vulnerability
Siemens SIMATIC PCS 7 and SIMATIC WinCC are both products of Siemens, Germany.SIMATIC PCS 7 is a process control system.SIMATIC WinCC is an automated data acquisition and monitoring SCADA system. Siemens SIMATIC PCS 7 and SIMATIC WinCC have a security vulnerability that allows an authenticated...
Siemens Simcenter Femap内存破坏漏洞
Siemens Simcenter Femap is a cutting-edge engineering simulation application from Siemens, Germany. It is used to create, edit and import/reuse mesh-based finite element analysis models of complex products or systems. Siemens Simcenter Femap suffers from a memory corruption vulnerability that can...
Dell EMC Data Protection Central Server-Side Request Forgery Vulnerability
Dell Emc Data Protection Central is a management console from Dell USA Inc. It is used for data protection. A server-side request forgery vulnerability exists in Dell EMC Data Protection Central 19.5 and prior versions, which stems from the product's failure to properly validate user input and ca...
Oracle Solaris Input Validation Error Vulnerability
Oracle Solaris is a UNIX operating system from Oracle Corporation USA. Oracle Solaris is vulnerable to an input validation error, which can be exploited by attackers to cause an unauthorized capability to cause a partial denial of service partial DOS of Oracle Solaris...
JerryScript ecma-objects.c denial of service vulnerability
JerryScript, a lightweight JavaScript engine from the JerryScript project, has a denial-of-service vulnerability in version 3.0.0, which stems from a failed assertion in /jerry-core/ecma/operations/ecma-objects.c , an attacker could use this vulnerability to launch a denial of service...
F5 BIG-IP Resource Management Error Vulnerability (CNVD-2022-72757)
F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. F5 BIG-IP is vulnerable to resource management errors, which can be exploited by attackers to cause a denial of service...
JerryScript has unspecified vulnerabilities
JerryScript is a lightweight JavaScript engine from the JerryScript Jerryscript project. a security vulnerability exists in JerryScript, which stems from an issue found in JerryScript commit a6ab5e9. Use-After-Free in the lexercompareidentifiertostring in the js-lexer.c file. No details of the...
soketi denial of service vulnerability
soketi is a C application ported to Node.js. soketi suffers from a denial of service vulnerability that stems from not properly handling incoming error messages, which can be exploited by attackers to cause a denial of service in the application...
Fortinet FortiOS Buffer Overflow Vulnerability (CNVD-2022-08470)
Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. A security vulnerability exists i...
Siemens SICAM A8000 Access Control Error Vulnerability
The SICAM A8000 is used for automation applications in all areas of remote control and energy supply. An access control error vulnerability exists in the Siemens SICAM A8000, which can be exploited by an attacker to access certain previously created log files...