D-Link DIR-823G OS Command Injection Vulnerability (CNVD-2022-81490)

D-Link DIR-823G is a wireless router from D-Link, a Chinese company. A security vulnerability exists in D-Link DIR-823G firmware version 1.02B03, which stems from its HNAP API function allowing an attacker to implement arbitrary operating system command execution via a carefully crafted HNAP1...

XWiki Platform Authorization Issues Vulnerability

XWiki Platform is the French company XWiki's set of Wiki platform for creating Web collaboration applications. An authorization issue vulnerability exists in XWiki Platform versions prior to 13.10.8, 14.0 and later, and 14.4.3 and earlier, which stems from incorrect privilege management and can b...

Unspecified Vulnerability in Intelbras SG 2404 MR

The Intelbras SG 2404 MR is a switch with network management features from Intelbras, Brazil. A security vulnerability exists in Intelbras SG 2404 MR version 20180928-rel64938. An authenticated attacker can exploit the vulnerability to create an administrator account via a specially crafted user...

WordPress Popup Maker Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Google Android Resource Management Error Vulnerability in Android (CNVD-2022-78148)

Google Android is a Linux-based open source operating system from Google, a US-based company. An attacker could exploit this vulnerability to cause a local privilege escalation without additional execution privileges...

Foxit Reader Code Issue Vulnerability (CNVD-2023-07829)

Foxit Reader is a PDF document reader from Foxit China. Foxit Reader is vulnerable to a code issue that could be exploited by attackers to execute malicious DLL files...

IBM Robotic Process Automation Licensing Issue Vulnerability (CNVD-2022-77512)

IBM Robotic Process Automation is a robotic process automation product from International Business Machines IBM, Inc. It helps you automate more business and IT processes at scale with the ease and speed of traditional RPA. IBM Robotic Process Automation versions 21.0.1, 21.0.2, 21.0.3, 21.0.4, a...

WordPress soledad cross-site scripting vulnerability

WordPress is a set of blogging platforms developed by the WordPress Foundation using the PHP language. WordPress theme is a theme for WordPress. cross-site scripting vulnerability exists in versions prior to WordPress soledad 8.2.5, which stems from its failure to clear a certain parameter, an...

Cisco ATA 190 Series Protocol Packet Input Validation Error Vulnerability

The ATA 190, ATA 191, and ATA 192 is a Cisco ATA 190 series analog phone adapter. An input validation error vulnerability exists in the Cisco ATA 190 local deployment only, ATA 191 local deployment or multi-platform deployment, and ATA 192 multi-platform deployment only, which stems from a securi...

Cisco ATA 190 LLDP Packet Input Validation Error Vulnerability

The Cisco ATA 190 is an analog phone adapter from Cisco, U.S.A. An input validation error vulnerability exists in the Cisco ATA 190 Series, which stems from a lack of length validation in certain LLDP packet header fields. An unauthenticated, remote attacker could exploit the vulnerability to...

ISAMS Cross-Site Scripting Vulnerability

ISAMS is a 100% web-based MIS from ISAMS that can be accessed from anywhere, with multiple third-party integrations into the online learning platform. version 22.2.3.2 of ISAMS contains a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of...

WordPress Post SMTP Mailer/Email Log Server Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A server request forgery...

Online Banking System SQL Injection Vulnerability (CNVD-2022-68373)

Online Banking System is an online banking system developed using PHP and MySQL. v1.0 of Online Banking System contains a security vulnerability that originates in the searchterm parameter in the /net-banking/transactions.php location. injection issue in the searchterm parameter at...

Adobe InDesign product buffer overflow vulnerability

Adobe InDesign, a set of typesetting and editing applications from Adobe, has a buffer overflow vulnerability that originates from out-of-bounds reads and could lead to a memory leak. An attacker can remotely execute arbitrary code through this vulnerability...

Siemens Simcenter Femap and Parasolid Out-of-Bounds Writing Vulnerability (CNVD-2022-62984)

Parasolid is a 3D geometric modeling tool that supports a variety of techniques, including solid modeling, direct editing, and free-form/sheet modeling.Simcenter Femap is an advanced simulation application for creating, editing, and examining finite element models of complex products or...

Siemens Simcenter Femap and Parasolid Uninitialized Pointer Access Vulnerability (CNVD-2022-62987)

Parasolid is a 3D geometric modeling tool that supports a variety of techniques, including solid modeling, direct editing, and free-form/sheet modeling.Simcenter Femap is an advanced simulation application for creating, editing, and examining finite element models of complex products or...

Huawei HarmonyOS Conditional Competition Vulnerability

Huawei HarmonyOS is an operating system from Huawei, a Chinese company that provides a microkernel-based, distributed operating system. A conditional contention vulnerability exists in Huawei HarmonyOS, which stems from improper handling of concurrent accesses when concurrent code needs to access...

EyouCms Cross-site Request Forgery Vulnerability (CNVD-2022-59207)

Zanzan Web Technology EyouCms Eyou CMS is a ThinkPHP-based open source content management system CMS from Zanzan Web Technology in China. version V1.5.8 of EyouCMS has a security vulnerability that stems from the existence of cross-site request forgery CSRF vulnerabilities through the backend,...

Apache Traffic Server Input Validation Error Vulnerability (CNVD-2023-03923)

Apache Traffic Server ATS is a set of scalable HTTP proxy and caching servers from the Apache Foundation. Apache Traffic Server is vulnerable to an input validation error, which could be exploited by attackers to smuggle requests...

Adobe Experience Manager Core Components跨站脚本漏洞

Adobe Experience Manager AEM is a content management solution from Adobe that can be used to build websites, mobile applications, and forms. A cross-site scripting vulnerability exists in Adobe Experience Manager Core Components 2.20.6 and prior versions, which originates when a victim accesses a...

Shopware Cross-Site Scripting Vulnerability (CNVD-2022-56128)

Shopware is a set of open source e-commerce software from the German company Shopware.Shopware suffers from a cross-site scripting vulnerability, which stems from a lack of data validation filtering of user-supplied data and output in the client module. An attacker could exploit the vulnerability...

Google Android elevation of privilege vulnerability (CNVD-2022-65642)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability. The vulnerability stems from incorrect programmatic calls to high-level native procedures. An attacker can exploit this vulnerability to cause an elevatio...

Mozilla Firefox Input Validation Error Vulnerability (CNVD-2023-06861)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from an input validation error vulnerability that originates from insufficient validation of URLs, which can be exploited by an attacker to trick a victim into clicking on a ver...

Foxit PDF Reader Resource Management Error Vulnerability (CNVD-2023-49834)

Foxit PDF Reader is China Foxit Foxit company a PDF reader. Foxit PDF Reader suffers from a Resource Management Error vulnerability that stems from a specific flaw in the handling of Doc objects, which can be exploited by an attacker to execute code in the context of the current process...

Multiple Adobe Products Uninitialized Pointer Access Vulnerabilities (CNVD-2022-87167)

Adobe Acrobat is a set of PDF file editing and conversion tools. Adobe Reader is a set of PDF document reading software. A number of Adobe products exist uninitialized pointer access vulnerability, the vulnerability arises from the existence of a post-release reuse error when processing PDF files...

Samsung KnoxSDK input validation error vulnerability

Samsung KnoxSDK is an open source Android platform-based security solution from Samsung Samsung in South Korea that can enhance security across the board through a combination of physical means and software systems, while being perfectly compatible with the Android and Google ecosystems, bringing...

WordPress Pagebar plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. versions of the WordPress Pagebar plugin prior to 2.65 have a cross-site scripting vulnerability that ste...

WordPress Ninja Forms Contact Form plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Jenkins RQM Plugin Information Disclosure Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. An attacker could exploit this vulnerability to allow a user with access to t...

Shopware Cross-Site Scripting Vulnerability (CNVD-2022-58390)

Shopware is a German Shopware company's open source e-commerce software. A cross-site scripting vulnerability exists in Shopware versions prior to 5.7.12, which stems from a lack of checksum filtering of user-supplied and output data during login authentication. An attacker can exploit this...

Mozilla Firefox Remote Code Execution Vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A remote code execution vulnerability exists in Mozilla Firefox due to a lack of restriction and filtering of extensions in the drag-and-drop image feature. The vulnerability can be exploited to execut...

PortlandLabs Concrete Cms Remote Code Execution Vulnerability

PortlandLabs Concrete Cms is a team-oriented open source content management system from PortlandLabs, Inc. A remote code execution vulnerability exists in PortlandLabs Concrete Cms, which stems from the ability to download zip files over HTTP and execute from those zip files, which could be...

Jfinal CMS SQL Injection Vulnerability (CNVD-2022-58382)

Jfinal CMS is a java development of powerful information consulting website , using a simple and powerful JFinal as the web framework , template engine with beetl, database with mysql, front-end bootstrap framework. Jfinal CMS version v5.1.0 has a SQL injection vulnerability that originates from...

Secheron SEPCOS Control and Protection Relay Weak Password Vulnerability

Secheron SEPCOS Control and Protection Relay is a relay from Secheron. Control and protect your DC panels and contact lines from short circuits and other electrical faults, and benefit from enhanced communication capabilities.The Secheron SEPCOS Control and Protection Relay has a weak password...

aiohttp Denial of Service Vulnerability (CNVD-2022-74097)

aiohttp is an open source asynchronous HTTP client/server framework for asyncio and Python. aiohttp version v3.8.1 has a denial of service vulnerability that stems from failure to properly handle incoming error messages, which could be exploited by an attacker to cause a denial of service of the...

Google Android Information Disclosure Vulnerability (CNVD-2022-53375)

Google Android is a Linux-based open source operating system from Google, Inc. Google Android is vulnerable to an information disclosure vulnerability that could be exploited by attackers to cause local information disclosure without additional execution privileges...

WordPress plugin XML Sitemaps跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. cross-site scripting vulnerability exists in versions prior to WordPress plugin XML Sitemaps 4.1.3,...

Google kCTF Access Control Error Vulnerability

Google kCTF is a Kubernetes-based CTF competition infrastructure from Google Google. kCTF v1.6.0 prior to the release of Google kCTF has an access control error vulnerability, which stems from the existence of improper access control in the kctf cluster, which can be exploited by attackers to...

WordPress amtyThumb plugin SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress amtyThumb plugin 4.2.0 and earlier versions are vulnerable to SQL injection, which stems fr...

Online Fire Reporting System SQL Injection Vulnerability (CNVD-2022-55742)

Online Fire Reporting System is an online fire reporting system from Carlo Montero's personal developer. version v1.0 of Online Fire Reporting System is vulnerable to SQL injection, which originates from /ofrs/admin/?page=teams/view team&id=Lack of validation of external input SQL statements, an...

EGavilan Media User-Registration-and-Login-System-With-Admin-Panel SQL Injection Vulnerability

EGavilan Media User-Registration-and-Login-System-With-Admin-Panel is a user registration and login system with an administrative panel from EGavilan Media. EGavilan Media User-Registration -and-Login-System-With-Admin-Panel version 1.0 contains a SQL injection vulnerability, which stems from...

Multi Store Inventory Management System授权问题漏洞

Multi Store Inventory Management System is a multi-store inventory management system. version 1.0 of Multi Store Inventory Management System is vulnerable to an authorization issue. An attacker can exploit this vulnerability to perform an account takeover via a specially crafted POST request...

ChatBot Application with a Suggestion Feature SQL注入漏洞

ChatBot Application with a Suggestion Feature is a ChatBot application with a suggestion feature. chatBot Application with a Suggestion Feature version 1.0 is vulnerable to a SQL injection vulnerability that originates in /simple chatbot/admin/responses/viewresponse.php with an id parameter that...

Totolink A3600R Buffer Overflow Vulnerability

TotoLink A3600R is a 6-antenna 1200M wireless router from TotoLink, Taiwan, China.A buffer overflow vulnerability exists in version V4.1.2cu.5182B20201102 of the Totolink A3600R, which stems from a vulnerability in the fread function of infostat.cgi that contains stacker overflow, which can be...

Online Sports Complex Booking System SQL注入漏洞（CNVD-2022-58677）

Online Sports Complex Booking System is an online stadium booking system by Carlo Montero, a personal developer. version 1.0 of Online Sports Complex Booking System is vulnerable to SQL injection, which originates in scbs/classes/ Master.php?f=delete, the id parameter of the post request lacks...

Xtend Cross-Site Scripting Vulnerability

Xtend is a general-purpose high-level programming language for the Eclipse Foundation's Java Virtual Machine. Xtend Voice Logger version 1.0 has a security vulnerability that stems from a cross-site scripting vulnerability in the error page. An attacker can use the vulnerability to execute...

Unspecified Vulnerability in Siemens Desigo PXC and DXR Devices (CNVD-2022-37375)

Desigo DXR2 controllers are programmable automation stations to support the standard control needs of end HVAC equipment and TRA Total Room Automation applications. the Desigo PXC3 series of automation stations can be used in buildings where functionality and flexibility are more demanding. Use...

Unspecified vulnerability in Siemens SICAM P850 and SICAM P855 Devices (CNVD-2022-36397)

The SICAM P850 Multifunctional Measurement Device is used to collect, visualize, evaluate and transmit electrical measurement variables such as AC current, AC voltage, frequency, power, harmonics, etc. The SICAM P855 Multifunctional Device is used to collect, display and transmit measured...

WordPress plugin LayerSlider跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. cross-site scripting vulnerability exists in versions prior to WordPress plugin LayerSlider 7.1.2. Th...

F5 BIG-IP multiple products have unspecified vulnerabilities

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing, etc. Several F5 BIG-IP products have security vulnerabilities that can be exploited by attackers to access certificate and key files from remote...