Nextcloud Trust Management Issues Vulnerability (CNVD-2021-42394)

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud, which stems from the vulnerability of the Nextcloud desktop client prior to 3.3.1 to incorrect certificate...

Unspecified vulnerability in php factory Telop01

php factory Telop01 is a simple PHP program from Japan's PHP Factory that displays subtitles, news tickers and headlines in flowing characters on the home page and any page. A security vulnerability exists in Telop01 1.0.1, which stems from insufficient sanitization of user-supplied data in the...

Vaadin flow has an unspecified vulnerability

Vaadin flow is an application. vaadin platform Java framework for building modern websites that look good, perform well and keep you and your users happy. vaadin: flow-server versions 3.0.0 through 5.0.3 have a security vulnerability that can be exploited by attackers to guess the security token ...

Qnap Systems QNAP HBS 3 Authorization Issues Vulnerability

Qnap Systems QNAP HBS 3 is an application from China Weilian Qnap Systems. A comprehensive data backup and disaster recovery solution. An authorization issue vulnerability exists in HBS 3 Hybrid Backup Sync that stems from a failure to perform adequate authorization checks. An attacker could use...

Github authelia input validation error vulnerability

Github authelia is an application from Github USA. An open source authentication and authorization server that provides 2-factor authentication and single sign-on SSO to applications through a web portal. Authelia version 4.27.4 and prior versions contain an input validation error vulnerability...

Rust Buffer Overflow Vulnerability (CNVD-2021-31914)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A buffer overflow vulnerability exists in the Rust standard library prior to version 1.2.0, which stems from the binary heap being in a failure to agree state when comparing generic elements of sift up or...

Atlassian Jira Server and Jira Data Center have unspecified vulnerabilities

Atlassian JIRA Server and Atlassian JIRA Data Center are both products of Atlassian Australia, Atlassian JIRA Server is a server version of a defect tracking management system. Atlassian JIRA Data Center is the data center version of Atlassian JIRA. Atlassian JIRA Server and Atlassian JIRA Data...

EIPStackGroup OpENer EtherNet/IP Denial of Service Vulnerability (CNVD-2021-53917)

Eipstackgroup Opener is a software used by the Eipstackgroup organization to provide EtherNet/IP stacking capabilities for IO adapter devices .A security vulnerability exists in EIPStackGroup OpENer Ethernet/IP that can be exploited by attackers to send specially crafted packets that could result...

Microsoft Word Code Execution Vulnerability

Microsoft Word is a word processing software in the Office suite of the U.S. company Microsoft Microsoft. A code execution vulnerability exists in Microsoft Word, which can be exploited by an attacker to execute arbitrary code on a system with the victim's privileges...

Froala Editor Cross-Site Scripting Vulnerability

Froala Editor is a Web-based WYSIWYG rich text editor . A cross-site scripting vulnerability exists in the hyperlink creation module in Froala Editor version 3.2.6. The vulnerability can be exploited to conduct cross-site scripting attacks via specially crafted base64 strings...

Aruba Instant Arbitrary File Modification Vulnerability (CNVD-2021-26048)

Aruba Instant is a cloud-hosted controller-less wireless access point. Aruba Instant suffers from an arbitrary file modification vulnerability that can be exploited by an attacker via the Web UI to overwrite arbitrary files with content under their control...

Linux kernel information disclosure vulnerability (CNVD-2021-28714)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a security vulnerability that stems from the bpf checker not handling mod32 target register truncation correctly. This leads to information disclosure...

Argo Code Issues Vulnerabilities

Argo is an open source container native workflow engine. A code issue vulnerability exists in Argo CD versions prior to 1.8.4, which stems from the incorrect handling of Token in the util/session/sessionmanager.go file, resulting in the Token remaining valid after the user is unavailable. No...

NVIDIA GeForce Experience Arbitrary File Deletion Vulnerability

NVIDIA GeForce Experience is graphics card driver update software that helps to check your computer's geforce drivers and update them to the latest version. An arbitrary file deletion vulnerability exists in GameStream rxdiag.dll in NVIDIA GeForce Experience versions prior to 3.21. The...

Unspecified Vulnerability in Rust (CNVD-2021-13698)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in Rust glsl-layout crate before 0.4.0, which stems from double deletion of maparray when panic occurs. No details of the vulnerability are provided at this time...

libvips Information Disclosure Vulnerability

libvips is a demand-driven multi-threaded image processing library. libvips versions prior to 8.8.2 are vulnerable to an information disclosure. The vulnerability stems from imvips2dz in /libvips/libvips/deprecated/imvips2dz.c in libvips having uninitialized variables. An attacker could use this...

Symantec Endpoint Detection

Symantec Endpoint Detection And Response uses AI, IR automation and threat intelligence to detect, find, isolate and eliminate intrusions across all endpoints. symantec Endpoint Detection...

Microsoft Windows/Windows Server Elevation of Privilege Vulnerability (CNVD-2021-90796)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, an operating system for personal devices, and Microsoft Windows Server, a server operating system. An elevation of privilege vulnerability exists in the Common Log File System driver in Microsoft...

RaspAP Remote Code Execution Vulnerability

RaspAP is a software solution that makes it easy to deploy a Raspberry Pi as a wireless AP access point, with a responsive set of WebUIs to control WiFi, as easy to use as a home router. A remote code execution vulnerability exists in includes/webconsole.php in RaspAP 2.5, which can be exploited ...

Linux kernel denial of service vulnerability (CNVD-2020-52622)

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A security vulnerability exists in the 'vfsubdentryopen' function in the Linux kernel. The vulnerability stems from an implementation of aufs that does not properly...

Redis Labs Redis Input Validation Error Vulnerability

Redis Labs Redis is the United States Redis Labs, Inc. of a set of open-source use of ANSI C written to support the network , can be based on the memory can also be a persistent log-type , key-value Key-Value storage database , and provides a variety of languages API. An input validation error...

IBM Spectrum Protect Plus Command Injection Vulnerability (CNVD-2020-14213)

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A command injection vulnerability exists in...

Terracotta Quartz Scheduler Code Issue Vulnerability

Terracotta Quartz Scheduler is an open source job scheduling framework . A code issue vulnerability exists in Terracotta Quartz Scheduler. The vulnerability stems from an improperly designed or implemented code development process for a networked system or product. An attacker can exploit this...

WordPress wp-google-maps plugin input validation error vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. wp-google-maps plugin is a Google Maps plugin used in it. An input validation error vulnerability exists in the...

Microsoft .NET Framework Local Elevation of Privilege Vulnerability

Microsoft .NET Framework is a comprehensive and consistent programming model developed by Microsoft Corporation USA and a development platform for building Windows, Windows Store, Windows Phone, Windows Server and Microsoft Azure Windows Store, Windows Phone, Windows Server, and Microsoft Azure...

Quest KACE System Management Appliance Command Injection Vulnerability (CNVD-2018-10907)

The Quest KACE System Management Appliance provides comprehensive system management for all network-connected devices. A command injection vulnerability exists in the '/common/downloadagentinstaller.php' script in Quest KACE System Management Appliance 8.0.318. An anonymous user can exploit this...

OpenCV 'cv::PxMDecoder::readData' function buffer overflow vulnerability

OpenCV is an open source, cross-platform, lightweight computer vision library. A buffer overflow vulnerability exists in the 'cv::PxMDecoder::readData' function of the grfmtpxm.cpp file in OpenCV version 3.3.1, which stems from the program using incorrect size values. An attacker could exploit th...

Psi+ User Simulation Vulnerability

Psi is a cross-platform Jabber client of which Psi+ is a fork. Psi+ has a user emulation vulnerability. An attacker can use this vulnerability to emulate any user, leading to further attacks...

Kaseya Virtual System Administrator Elevation of Privilege Vulnerability

Kaseya Virtual System Administrator is a suite of IT system management platforms for simplifying and automating IT services. Kaseya Virtual System Administrator does not enforce user authentication and does not restrict target file paths, allowing remote attackers to exploit vulnerabilities to...

WordPress Navis DocumentCloud Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's suite of blogging platforms developed using the PHP language, which supports personal blogging sites on servers running PHP and MySQL.Navis DocumentCloud is one of the plug-ins that allows journalists to analyze, annotate, and publish documents. A...

F5 BIG-IP TMM Denial of Service Vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, and remote access policy management. A denial-of-service vulnerability exists in BIG-IP's TMM Traffic Management Microkernel module, which arises because specific...

IrfanView CADImage Plugin Buffer Overflow Vulnerability (CNVD-2025-16831)

IrfanView CADImage Plugin is a CAD plugin from IrfanView. IrfanView CADImage Plugin suffers from a buffer overflow vulnerability that stems from a lack of validation of user data when parsing DWG files, which can be exploited by an attacker to execute code in the context of the current process...

Ollama Unauthorized Access Vulnerability

Ollama is an open source Large Language Model LLM runtime environment and toolset designed to help developers easily deploy, manage, and use models e.g., DeepSeek, etc.. Ollama suffers from an unauthorized access vulnerability, which is due to the fact that Ollama is not set up with authenticatio...

IBM webMethods Integration Elevation of Privilege Vulnerability

IBM webMethods Integration is a hybrid enterprise iPaaS from International Business Machines IBM. An elevation of privilege vulnerability exists in IBM webMethods Integration version 10.15, which can be exploited by an authenticated attacker to create scheduler tasks that elevate their privileges...

NetBox Cross-Site Scripting Vulnerability (CNVD-2024-37586)

NetBox is a Django, PostgreSql based tool for IP Address Management IPAM and Data Center Infrastructure Management DCIM from the NetBox community. A cross-site scripting vulnerability exists in NetBox v4.0.3, which stems from the lack of effective filtering and escaping of user-supplied data in t...

Foxit PDF Reader AcroForm Code Execution Vulnerability

Foxit PDF Reader is a PDF document reader and printer with fast startup speed and rich features. A code execution vulnerability exists in Foxit PDF Reader AcroForm, which can be exploited by a remote attacker to submit a special file request and trick the user into parsing it, which can crash the...

IBM PowerSC Explains Conflict Vulnerabilities

IBM PowerSC is an International Business Machines IBM security and compliance solution for IBM Power Systems servers. IBM PowerSC suffers from an interpretation conflict vulnerability that stems from not using a secure HTTP method, which could be exploited by an attacker to perform unauthorized...

GTKWave Integer Overflow Vulnerability

GTKWave is a full-featured, GTK+-based waveform viewer from GTKWave. An integer overflow vulnerability exists in GTKWave version 3.3.115, which can be exploited by an attacker to cause memory corruption via specially crafted .fst files...

ZZCMS File Upload Vulnerability (CNVD-2024-06241)

ZZCMS is a content management system CMS by the ZZCMS team in China. A file upload vulnerability exists in ZZCMS version 2023, which stems from the lack of valid validation of uploaded files in /Ebak5.1/upload/index.php. An attacker can exploit this vulnerability to gain server privileges and...

Apache Superset Elevation of Privilege Vulnerability

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset suffers from an elevation of privilege vulnerability that can be exploited by an attacker to gain write access to all gauges in a dashboard via the Add Gauge function of Create...

Apache Storm Information Disclosure Vulnerability (CNVD-2023-9666324)

Apache Storm is the United States Apache Apache Foundation of a set of open source distributed real-time computing system developed using Clojure concurrent programming language. Apache Storm suffers from an information disclosure vulnerability that stems from a temporary directory shared among a...

Siemens SIMATIC PCS neo has a loose cross domain policy vulnerability with untrusted domains

SIMATIC PCS neo is a distributed control system DCS. Siemens SIMATIC PCS neo suffers from a loose cross-domain policy vulnerability with an untrusted domain, which can be exploited by an attacker to trick a legitimate user into triggering unwanted behavior...

HCL Technologies Compass Weak Password Vulnerability

HCL Technologies Compass is a low-code change management software from HCL Technologies, USA. Manages the full range of testing activities and integration with developer tools. HCL Technologies Compass suffers from a weak password vulnerability that stems from susceptibility to insecure password...

Binary vulnerability in Linux kernel (CNVD-2023-87918)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a binary vulnerability that can be exploited by attackers to cause a system crash or local elevation of privilege...

F5 BIG-IP Next SPK Hardcoded Credentials Vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, and remote access policy management. A hard-coded credential vulnerability exists in F5 BIG-IP Next SPK, which can be exploited by an attacker with the ability to...

Google Chrome Security Bypass Vulnerability (CNVD-2023-75499)

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome prior to version 117.0.5938.62, which stems from an improper implementation of the Intents module. An attacker can exploit the vulnerability to bypass security restrictions...

Google Chrome Data Forgery Problem Vulnerability (CNVD-2023-65156)

Google Chrome is a web browser from Google, an American company. A data forgery issue vulnerability exists in Google Chrome prior to version 116.0.5845.96, which stems from insufficient data validation of Systems Extensions, and can be exploited by a remote attacker to bypass file restrictions vi...

Microsoft Exchange Server Remote Code Execution Vulnerability (CNVD-2023-64865)

Microsoft Exchange Server is the United States Microsoft Microsoft company's set of e-mail service program. It provides e-mail access, storage, forwarding, voice mail, e-mail filtering and screening. A remote code execution vulnerability exists in Microsoft Exchange Server, which can be exploited...

ScienceLogic SL1 SQL Injection Vulnerability (CNVD-2023-66416)

ScienceLogic SL1 is an application from ScienceLogic, Inc. Connect your real estate together to automate multidirectional data flow and workflow. A SQL injection vulnerability exists in ScienceLogic SL1 11.1.2 and earlier versions, which stems from a lack of validation of externally entered SQL...

IBM Sterling Connect:Direct Encryption Issue Vulnerability

IBM Sterling Connect:Direct is a file-based, peer-to-peer file transfer solution from International Business Machines IBM. IBM Sterling Connect:Direct suffers from an encryption issue vulnerability that stems from the use of weak encryption algorithms, which could be exploited by an attacker to...