Adobe Experience Manager Core Components跨站脚本漏洞

Adobe Experience Manager AEM is a content management solution from Adobe that can be used to build websites, mobile applications, and forms. A cross-site scripting vulnerability exists in Adobe Experience Manager Core Components 2.20.6 and prior versions, which originates when a victim accesses a...

Shopware Cross-Site Scripting Vulnerability (CNVD-2022-56128)

Shopware is a set of open source e-commerce software from the German company Shopware.Shopware suffers from a cross-site scripting vulnerability, which stems from a lack of data validation filtering of user-supplied data and output in the client module. An attacker could exploit the vulnerability...

Google Android elevation of privilege vulnerability (CNVD-2022-65642)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability. The vulnerability stems from incorrect programmatic calls to high-level native procedures. An attacker can exploit this vulnerability to cause an elevatio...

Mozilla Firefox Input Validation Error Vulnerability (CNVD-2023-06861)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from an input validation error vulnerability that originates from insufficient validation of URLs, which can be exploited by an attacker to trick a victim into clicking on a ver...

Foxit PDF Reader Resource Management Error Vulnerability (CNVD-2023-49834)

Foxit PDF Reader is China Foxit Foxit company a PDF reader. Foxit PDF Reader suffers from a Resource Management Error vulnerability that stems from a specific flaw in the handling of Doc objects, which can be exploited by an attacker to execute code in the context of the current process...

Samsung KnoxSDK input validation error vulnerability

Samsung KnoxSDK is an open source Android platform-based security solution from Samsung Samsung in South Korea that can enhance security across the board through a combination of physical means and software systems, while being perfectly compatible with the Android and Google ecosystems, bringing...

WordPress Pagebar plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. versions of the WordPress Pagebar plugin prior to 2.65 have a cross-site scripting vulnerability that ste...

WordPress Ninja Forms Contact Form plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Jenkins RQM Plugin Information Disclosure Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. An attacker could exploit this vulnerability to allow a user with access to t...

Shopware Cross-Site Scripting Vulnerability (CNVD-2022-58390)

Shopware is a German Shopware company's open source e-commerce software. A cross-site scripting vulnerability exists in Shopware versions prior to 5.7.12, which stems from a lack of checksum filtering of user-supplied and output data during login authentication. An attacker can exploit this...

Mozilla Firefox Remote Code Execution Vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A remote code execution vulnerability exists in Mozilla Firefox due to a lack of restriction and filtering of extensions in the drag-and-drop image feature. The vulnerability can be exploited to execut...

PortlandLabs Concrete Cms Remote Code Execution Vulnerability

PortlandLabs Concrete Cms is a team-oriented open source content management system from PortlandLabs, Inc. A remote code execution vulnerability exists in PortlandLabs Concrete Cms, which stems from the ability to download zip files over HTTP and execute from those zip files, which could be...

Jfinal CMS SQL Injection Vulnerability (CNVD-2022-58382)

Jfinal CMS is a java development of powerful information consulting website , using a simple and powerful JFinal as the web framework , template engine with beetl, database with mysql, front-end bootstrap framework. Jfinal CMS version v5.1.0 has a SQL injection vulnerability that originates from...

Secheron SEPCOS Control and Protection Relay Weak Password Vulnerability

Secheron SEPCOS Control and Protection Relay is a relay from Secheron. Control and protect your DC panels and contact lines from short circuits and other electrical faults, and benefit from enhanced communication capabilities.The Secheron SEPCOS Control and Protection Relay has a weak password...

aiohttp Denial of Service Vulnerability (CNVD-2022-74097)

aiohttp is an open source asynchronous HTTP client/server framework for asyncio and Python. aiohttp version v3.8.1 has a denial of service vulnerability that stems from failure to properly handle incoming error messages, which could be exploited by an attacker to cause a denial of service of the...

Google Android Information Disclosure Vulnerability (CNVD-2022-53375)

Google Android is a Linux-based open source operating system from Google, Inc. Google Android is vulnerable to an information disclosure vulnerability that could be exploited by attackers to cause local information disclosure without additional execution privileges...

WordPress plugin XML Sitemaps跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. cross-site scripting vulnerability exists in versions prior to WordPress plugin XML Sitemaps 4.1.3,...

WordPress amtyThumb plugin SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress amtyThumb plugin 4.2.0 and earlier versions are vulnerable to SQL injection, which stems fr...

Online Fire Reporting System SQL Injection Vulnerability (CNVD-2022-55742)

Online Fire Reporting System is an online fire reporting system from Carlo Montero's personal developer. version v1.0 of Online Fire Reporting System is vulnerable to SQL injection, which originates from /ofrs/admin/?page=teams/view team&id=Lack of validation of external input SQL statements, an...

EGavilan Media User-Registration-and-Login-System-With-Admin-Panel SQL Injection Vulnerability

EGavilan Media User-Registration-and-Login-System-With-Admin-Panel is a user registration and login system with an administrative panel from EGavilan Media. EGavilan Media User-Registration -and-Login-System-With-Admin-Panel version 1.0 contains a SQL injection vulnerability, which stems from...

ChatBot Application with a Suggestion Feature SQL注入漏洞

ChatBot Application with a Suggestion Feature is a ChatBot application with a suggestion feature. chatBot Application with a Suggestion Feature version 1.0 is vulnerable to a SQL injection vulnerability that originates in /simple chatbot/admin/responses/viewresponse.php with an id parameter that...

Totolink A3600R Buffer Overflow Vulnerability

TotoLink A3600R is a 6-antenna 1200M wireless router from TotoLink, Taiwan, China.A buffer overflow vulnerability exists in version V4.1.2cu.5182B20201102 of the Totolink A3600R, which stems from a vulnerability in the fread function of infostat.cgi that contains stacker overflow, which can be...

Online Sports Complex Booking System SQL注入漏洞（CNVD-2022-58677）

Online Sports Complex Booking System is an online stadium booking system by Carlo Montero, a personal developer. version 1.0 of Online Sports Complex Booking System is vulnerable to SQL injection, which originates in scbs/classes/ Master.php?f=delete, the id parameter of the post request lacks...

Xtend Cross-Site Scripting Vulnerability

Xtend is a general-purpose high-level programming language for the Eclipse Foundation's Java Virtual Machine. Xtend Voice Logger version 1.0 has a security vulnerability that stems from a cross-site scripting vulnerability in the error page. An attacker can use the vulnerability to execute...

WordPress plugin LayerSlider跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. cross-site scripting vulnerability exists in versions prior to WordPress plugin LayerSlider 7.1.2. Th...

F5 BIG-IP multiple products have unspecified vulnerabilities

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing, etc. Several F5 BIG-IP products have security vulnerabilities that can be exploited by attackers to access certificate and key files from remote...

Cyclos 4 PRO Cross-Site Scripting Vulnerability (CNVD-2022-77956)

Cyclos 4 PRO is a web server. a cross-site scripting vulnerability exists in Cyclos 4 PRO version 4.14.7 and earlier, which stems from a failure to validate user input during error notification. A remote, unauthenticated attacker could execute javascript code via undefine enumeration constants...

Delta Electronics DIAEnergie ReadRegIND SQL Injection Vulnerability (CNVD-2022-36021)

Delta Electronics DIAEnergie is an industrial energy management system for monitoring and analyzing energy consumption in real time, calculating energy consumption and load characteristics, optimizing equipment performance, improving production processes and maximizing energy efficiency. Delta...

Attendance and Payroll System SQL注入漏洞（CNVD-2022-33143）

Attendance and Payroll System is a PHP/MySQLi source code attendance and payroll system by oretnom23 individual developers. version v1.0 of Attendance and Payroll System is vulnerable to SQL injection, which originates from the component adminovertime delete.php lacks validation of external input...

Amazon AWS VPN Client Information Disclosure Vulnerability

Amazon AWS VPN Client is a fully managed remote access VPN solution from Amazon.com. Amazon AWS VPN Client for Windows version 2.0.0 is vulnerable to an information disclosure vulnerability that could be exploited by an attacker to disclose a user's Net-NTLMv2 hash to an external server...

SAP Web Dispatcher和Internet Communication Manager拒绝服务漏洞

SAP Web dispatcher and SAP Internet Communication Manager SAP ICM are both products of SAP Germany. SAP Internet Communication Manager is a component of the SAP NetWeaver application server. SAP Web Dispatcher and SAP Internet Communication Manager suffer from a denial-of-service vulnerability th...

Microsoft Windows Kerberos Remote Code Execution Vulnerability

Microsoft Windows is a set of operating systems for use on personal devices from the American company Microsoft. A remote code execution vulnerability exists in Microsoft Windows Kerberos. The vulnerability stems from failure to properly process input data and can be exploited by an attacker to...

Microsoft Windows Graphics Component Remote Code Execution Vulnerability (CNVD-2022-74593)

A remote code execution vulnerability exists in Microsoft Windows Graphics Components, which originates when a network system or product fails to properly filter external input data during the construction of code segments. elements during the construction of code segments from external input dat...

Microsoft Remote Procedure Call Runtime Remote Code Execution Vulnerability

Microsoft Remote Procedure Call Runtime is a technology used to create distributed client/server programs from Microsoft Corporation USA. The vulnerability can be exploited to execute arbitrary code on the system...

Microsoft Windows DNS Server Remote Code Execution Vulnerability (CNVD-2022-84114)

Microsoft Windows is an operating system for personal devices from Microsoft Corporation USA.A remote code execution vulnerability exists in Microsoft Windows DNS Server, which can be exploited by attackers to execute arbitrary code on the system...

Social Codia SMS Cross-Site Scripting Vulnerability

Social Codia SMS is an inventory management system from Social Codia India. v1.0 of Social Codia SMS is vulnerable to a cross-site scripting vulnerability that could be exploited by attackers to execute arbitrary Web script or HTML by injecting a specially crafted payload into the post title text...

AeroCMS Cross-Site Scripting Vulnerability

AeroCMS is a content management system from AeroCMS, Inc. A cross-site scripting vulnerability exists in AeroCMS v0.0.1, which can be exploited by attackers to execute arbitrary Web script or HTML by injecting a specially crafted payload into the post title text field...

Code injection vulnerability in Joomla!

Joomla! is a set of forum components used in the Joomla! content management system. A code injection vulnerability exists in versions 4.0.0 to 4.1.0 of Joomla!, which stems from an HTTP request parameter input validation error. No detailed vulnerability details are available at this time...

WordPress CleanTalk plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress plugin is a WordPress application plugin. WordPress CleanTalk plugin 5.173 and earlier versions have a cross-sit...

NexusPHP SQL Injection Vulnerability (CNVD-2022-65365)

NexusPHP is a free and open source complete solution for building PT websites. NexusPHP version 1.5 is vulnerable to SQL injection, which can be exploited by remote attackers to execute arbitrary SQL commands via the id parameter...

Jenkins Pipeline Phoenix AutoTest Plugin 文件上传漏洞

Jenkins Pipeline is a set of plug-ins that support the implementation and integration of continuous delivery pipelines into Jenkins.The Jenkins Pipeline Phoenix AutoTest Plugin 1.3 and earlier versions are vulnerable to a path traversal vulnerability that could be exploited by an attacker with...

Wordpress Plugin All-in-one Floating Contact Form Cross-Site Scripting Vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. wordpress Plugin All-in-one Floating Contact Form...

Moodle Access Control Error Vulnerability (CNVD-2022-54955)

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment. an access control error vulnerability exists in Moodle, which stems from improper access restrictions. A remote attacker could use the...

GPAC has an unspecified vulnerability (CNVD-2022-22300)

GPAC is an open-source multimedia framework. there is a security vulnerability in MP4Box before GPAC version 2.1.0-DEV, and no detailed vulnerability details are available...

Open-xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2022-28454)

Open-xchange OX App Suite is a set of Web-based cloud desktop environments from Open-Xchange Open-xchange USA. The environment allows users to manage email, tasks, files, etc. more intuitively. A cross-site scripting vulnerability exists in Open-xchange OX App Suite version 7.10.5 and prior...

Apache CloudStack Security Feature Issue Vulnerability

Apache CloudStack is an Infrastructure-as-a-Service IaaS cloud computing platform from the Apache Foundation. The platform is primarily used to deploy and manage large networks of virtual machines.A security feature issue vulnerability exists in versions of Apache CloudStack prior to 4.16.1.0,...

Jenkins Vmware vRealize CodeStream Plugin信息泄露漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.Jenkins Vmware vRealize CodeStream Plugin...

ARRIS TR3300 Command Injection Vulnerability (CNVD-2022-68529)

The ARRIS TR3300 is an 802.11ac Wi-Fi router from ARRIS, Inc. A command injection vulnerability exists in the ARRIS TR3300, which stems from the failure of the wanipstat, wanmaskstat, wangwstat, and wandns1stat parameters in the ip function to properly filter the construct command special...

Huawei Emui and Magic UI PMS module privilege control vulnerability

Huawei Emui is a mobile operating system developed on Android. magic Ui is a mobile operating system developed on Android. Huawei Emui and Magic UI PMS modules have a privilege control vulnerability that could be exploited by attackers to obtain sensitive system information...

Mcafee McAfee Total Protection Competitive Conditions Vulnerability

McAfee McAfee Total Protection MTP is a suite of antivirus software from Mcafee, Inc. McAfee Total Protection for Windows 16.0.43 previously contained a competitive condition vulnerability that could be exploited by a local attacker to gain elevated privileges and execute arbitrary files Delete...