SuiteCRM Deserialization Vulnerability

SuiteCRM is a customer relationship management system from the SuiteCRM team. SuiteCRM suffers from a deserialization vulnerability that stems from insecure deserialization of serialized data received by the application from users, which can be exploited by attackers to execute arbitrary code via...

Microsoft Exchange Server Spoofing Vulnerability (CNVD-2022-77978)

Microsoft Exchange Server is a set of email service programs from Microsoft Corporation USA. It provides mail access, storage, forwarding, voice mail, mail filtering, etc. A spoofing vulnerability exists in Microsoft Exchange Server, which can be exploited by attackers to conduct spoofing attacks...

Siemens RUGGEDCOM ROS has an unspecified vulnerability (CNVD-2022-17781)

Siemens RuggedCom ROS is an operating system used in the RuggedCom family of switches from Siemens, Germany. Siemens RUGGEDCOM ROS has a security vulnerability that could be exploited by an attacker to cause data corruption and possibly hard application failures...

Siemens RUGGEDCOM ROS has an unspecified vulnerability (CNVD-2022-17784)

Siemens RuggedCom ROS is an operating system used in the RuggedCom family of switches from Siemens, Germany. Siemens RUGGEDCOM ROS has a security vulnerability that could be exploited by attackers to act as a man-in-the-middle and eavesdrop on encrypted communications...

Scrapy Information Disclosure Vulnerability (CNVD-2022-17012)

Scrapy is a free and open-source web crawler framework written in Python.An information disclosure vulnerability exists in versions of Scrapy prior to 2.6.1, which stems from the product's failure to effectively protect sensitive information. An attacker could use this vulnerability to obtain...

microweber has an unspecified vulnerability (CNVD-2022-13207)

Microweber is a drag-and-drop online store management system from the Microweber community in the United States. The system includes modules for adding products, images, etc. A security vulnerability exists in versions of microweber prior to 1.2.11, which stems from a business logic error in the...

PJSUA API Buffer Overflow Vulnerability (CNVD-2022-15000)

Pjsua Api is an advanced Api for building Sip multimedia user agent applications. a buffer overflow vulnerability exists in the PJSUA API, which can be exploited by attackers to cause out-of-bounds reading of information via a controlled filename parameter...

Jenkins Checkmarx Plugin Cross-Site Request Forgery Vulnerability

Jenkins plug-ins are plug-ins that provide appropriate functionality for Jenkins. Jenkins Checkmarx Plugin cross-site request forgery vulnerability. The vulnerability can be exploited by an attacker to connect to an attacker-specified web server via an attacker-specified credential ID to capture...

Schneider Electric Multiple Product Input Validation Error Vulnerability

Schneider Electric Modicon Quantum and Schneider Electric Modicon M340 are both products of Schneider Electric, a French company. The Schneider Electric Modicon M340 is a mid-range PLC programmable logic controller for industrial processes and infrastructure. The vulnerability sends a specially...

Bentley Systems Bentley View Resource Management Error Vulnerability (CNVD-2022-15825)

Bentley Systems Bentley View is a free viewer from Bentley Systems, USA. A resource management error vulnerability exists in Bentley View that can be exploited by an attacker to execute code in the context of the current process...

Apache Pulsar Input Validation Error Vulnerability

Apache Pulsar is the United States Apache Apache Foundation for cloud environments, set of messages, storage, lightweight functional computing as one of the distributed message flow platform. The software supports multi-tenant, persistent storage, multi-machine room cross-region data replication,...

Adobe Acrobat/Reader Resource Management Error Vulnerability

Adobe Reader also known as Acrobat Reader is a PDF file reader software developed by Adobe. Adobe Acrobat is a PDF editing software developed by Adobe. Adobe Acrobat/Reader has a resource management error vulnerability, which can be exploited by remote attackers to Creating specially crafted PDF...

Jerryscript has an unspecified vulnerability (CNVD-2022-07250)

JerryScript, a lightweight JavaScript engine from the JerryScript project, has a security vulnerability in Jerryscript version 3.0.0, which originates in /jerry-core/ecma/base/ecma-helpers- A heap-based buffer overflow exists in ecmautf8stringtonumberbyradix in conversion.c. No detailed...

Jerryscript has an unspecified vulnerability (CNVD-2022-07249)

JerryScript is a lightweight JavaScript engine from the JerryScript Jerryscript project. version 3.0.0 of Jerryscript has a security vulnerability that stems from the existence of an assertion failure in ecma-helpers-value. No detailed vulnerability details are available...

JerryScript js-scanner-util.c denial-of-service vulnerability

JerryScript, a lightweight JavaScript engine from the JerryScript project, has a denial-of-service vulnerability in version 3.0.0, which stems from an assertion failure in /jerry-core/parser/js/js-scanner-util.c. An attacker could use this vulnerability to launch a denial of service...

microweber access control error vulnerability

Microweber is an online store management system from the Microweber community in the United States that provides drag-and-drop functionality. The system includes modules for adding products, images, and more. microweber is vulnerable to an access control error, which stems from a network system o...

Kalkitech Sync Products Encryption Issue Vulnerability

Kalkitech Sync Products is a range of substation gateways from Kalkitech India. Kalkitech Sync Products suffers from an encryption issue vulnerability that stems from the use of an insecure communication channel by the management tools Easyconnect and SYNC devices, which can be exploited by an...

Controlup Real-Time Agent Command Injection Vulnerability

Controlup Real-Time Agent is a real-time agent from Controlup USA. The Controlup Real-Time Agent suffers from a command injection vulnerability that originates from an unauthenticated named pipe channel in the Controlup Real-Time Agent, which can be exploited by an attacker to run operating syste...

Apache James path traversal vulnerability

Apache James is an open source Smtp and Pop3 mail transfer agent and Nntp news server written entirely in Java by the Apache Foundation. Apache James in version 3.6.1 contains a path traversal vulnerability that stems from a failure of a networked system or product to properly filter special...

Django path traversal vulnerability (CNVD-2022-31938)

Django is the Django Foundation's set of Python-based language open source Web application framework . The framework includes an object-oriented mapper, view system, template system, etc. Django version 2.2 before 2.2.26, 3.2.11 before 3.2.2, and 4.0.1 before 4.0.0 contains a path traversal...

Netgear RAX43 Buffer Overflow Vulnerability

The Netgear RAX43 is a router from the American company Netgear. A hardware device that connects two or more networks and acts as a gateway between them. A buffer overflow vulnerability exists in Netgear RAX43 version 1.0.3.96. The vulnerability is caused by the URL parsing functionality of the...

Lantronix PremierWave 2050 Buffer Overflow Vulnerability

The Lantronix PremierWave 2050 is an embedded enterprise Wi-Fi module from Lantronix, Inc. The Lantronix PremierWave 2050 version 8.9.0.0R4 is vulnerable to a buffer overflow vulnerability that could be exploited by an attacker to send specially designed HTTP requests for arbitrary command...

AbanteCart Cross-Site Scripting Vulnerability (CNVD-2021-102795)

AbanteCart is a PHP-based e-commerce platform. AbanteCart 1.3.2 previously had a security vulnerability that could be exploited by attackers to conduct DOM-based XSS attacks...

Adobe Premiere Rush Privilege Escalation Vulnerability

Adobe Premiere Rush is a set of cross-platform video editing software from the U.S. company Audobee Adobe. A security vulnerability exists in Adobe Premiere Rush, which can be exploited by attackers for elevation of privilege...

Fortinet Meru AP Code Injection Vulnerability

Fortinet Meru Ap is a wireless access point from Fortinet, Inc. Fortinet Meru AP is vulnerable to code injection in versions 8.6.1 and 8.5.5 and below. The vulnerability stems from a failure of the network system or product to properly filter special elements in code segments constructed from...

Unspecified vulnerability in Linux kernel (CNVD-2021-102802)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux Kernel that can be exploited by a local attacker with special user privileges to bypass authentication and potentially cause an err...

AOM buffer overflow vulnerability

Aom is a next-generation open source digital media technology for everyone organized by the Alliance For Open Media. version 2.0.1 of AOM contains a buffer overflow vulnerability that stems from a global buffer overflow in the component av1/encoder/partitionsearch.h. No detailed vulnerability...

Hexo cross-site scripting vulnerability

Hexo is a fast, simple and powerful blogging framework from the personal developer Tommy Chen in China. Hexo suffers from a cross-site scripting vulnerability that stems from Hexo's lack of data validation filtering of user-supplied data and output. An attacker could exploit this vulnerability to...

Redash has an unspecified vulnerability

Redash is a data integration and analysis solution from the Israeli company Redash. The product supports data integration, data visualization, query editing, and data sharing.Redash 10.0.0 and earlier versions contain a security vulnerability that could be exploited by an attacker to spoof sessio...

Google TensorFlow code issue vulnerability (CNVD-2022-09869)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow has a code issue vulnerability that can be exploited by an attacker to cause the program to crash...

Apache Superset Code Injection Vulnerability

A code injection vulnerability exists in Apache Superset, a data visualization and data exploration platform from the Apache Foundation, prior to version 1.3.2, which stems from a web-based system or product that does not properly authenticate incoming data. An authenticated attacker could exploi...

BusyBox buffer overflow vulnerability

A buffer overflow vulnerability exists in the Busybox unlzma applet, which stems from an out-of-bounds heap read in Busybox's unlzma applet that can lead to information leakage and denial of service when unzipping lzma compressed input to a denial of service. No details of the vulnerability are...

Microsoft Windows Diagnostic Hub Elevation of Privilege Vulnerability

Microsoft Windows Diagnostic Hub is an application from Microsoft Corporation USA. It is not only a task manager, but also a device diagnostic center. This application combines Windows developer tools with UWP functionality to access new information and features.Microsoft Windows Diagnostic Hub i...

Microsoft Azure Sphere Buffer Overflow Vulnerability

Microsoft Azure Sphere is an appliance used to provide security in cloud environments by Microsoft Corporation USA. No detailed vulnerability details are available at this time...

Unspecified Vulnerability in FortiManager

Fortinet FortiManager is a centralized network security management platform from Fortinet. The platform supports centralized management of any number of Fortinet devices, and can group devices into different management domains ADOM to further simplify the deployment and management of multi-device...

Nextcloud has an unspecified vulnerability (CNVD-2022-18417)

Nextcloud is an open source, self-hosted file synchronization and sharing communications application platform from Nextcloud, a German company. nextcloud has a security vulnerability that stems from an improper design or implementation during the development of code for a networked system or...

Oracle MySQL Cluster Buffer Overflow Vulnerability (CNVD-2022-18216)

MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database designed to guarantee 99.999% availability. A buffer overflow vulnerability exists in Oracle MySQL Cluster, which stems from a failure to validate the correct length of user-supplied data before copying it to a...

Oracle Database Server has an unspecified vulnerability (CNVD-2021-101531)

Oracle Database Server is a relational database management system from Oracle Corporation USA. The database management system provides data management, distributed processing, and other functions.An unspecified vulnerability exists in the Java VM component of Oracle Database Server versions...

Portlandlabs Concrete5 server-side request forgery vulnerability

Portlandlabs Concrete5 is an open source content management system CMS from PortlandLabs, U.S. Portlandlabs Concrete5 server-side request forgery vulnerability can be exploited by attackers to retrieve HTTP and FTP files from internal server networks by inserting internal addresses...

Moxa MXview Improper Access Control Vulnerability

An improper access control vulnerability exists in Moxa MXview, a network management software used to monitor and diagnose industrial networks. The vulnerability stems from the fact that the affected product has a misconfigured service that allows remote connections to internal communication...

Huawei FusionCompute Command Injection Vulnerability (CNVD-2021-84882)

Huawei FusionCompute is a computer virtualization engine from Huawei China. A command injection vulnerability exists in the CMA service of the Huawei FusionCompute product, which provides Virtual Resource Manager VRM and Compute Node Agent CNA. The vulnerability stems from the fact that special...

Mozilla Rust Command Injection Vulnerability (CNVD-2021-78748)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. Mozilla Rust is vulnerable to a command injection vulnerability that originates from rcucell crate in Rust. For RcuCell there is an unconditional send and sync implementation, which can be exploited by an attack...

LibreDWG null pointer dereference vulnerability (CNVD-2021-74010)

LibreDWG is a free C library for reading and writing DWG files. a null pointer dereference vulnerability exists in the bitreadBB function in bits.c in LibreDWG version 0.10.1.3751. An attacker could exploit this vulnerability to cause a denial of service...

Autodesk Navisworks Buffer Overflow Vulnerability (CNVD-2022-05702)

Autodesk Navisworks, Autodesk's 3D model review software for architecture, engineering and construction, is vulnerable to a buffer overflow vulnerability that originates when a maliciously crafted DWG file may be forced to read beyond its allocated boundaries when parsing the DWG file, allowing a...

Autodesk Navisworks Out-of-Bounds Read Vulnerability (CNVD-2021-99309)

Autodesk Navisworks, a 3D model review software for architecture, engineering and construction, is vulnerable to an out-of-bounds read vulnerability in Autodesk Navisworks versions 2019, 2020, 2021, 2022. An attacker can exploit the vulnerability to execute arbitrary code via specially crafted PD...

Pimcore Cross-Site Scripting Vulnerability (CNVD-2022-07508)

Pimcore is an open source Web content management platform for creating and managing Web applications from the Austrian company Pimcore. The platform integrates Web content management, e-commerce framework and product information management applications.Pimcore in versions prior to 10.1.2 there is...

lin-cms-flask has an unspecified vulnerability

lin-cms-flask is a content management system framework. lin-cms-flask version 0.1.1 contains a security vulnerability that can be exploited by remote attackers to brute force login via the "login" function in the component "app/api/cms/user.py"...

Libelfin Denial of Service Vulnerability (CNVD-2021-66404)

Libelfin is a C 11 library for reading ELF binaries and DWARFv4 debug information. A denial of service vulnerability exists in the elf::section::asstrtab function of Libelfin 0.3. An attacker could exploit this vulnerability to cause a denial of service via a specially crafted ELF file that cause...

ZOHO ManageEngine ADSelfService Plus CSV Injection Vulnerability

ZOHO ManageEngine ADSelfService Plus is a web-based end-user password management software from ZOHO, Inc. A CSV injection vulnerability exists in ZOHO ManageEngine ADSelfService Plus, which can be exploited by attackers to obtain a reverse shell...

Exiv2 out-of-bounds read vulnerability (CNVD-2021-61793)

Exiv2 is a cross-platform C++ library and command line utility for managing image metadata. An out-of-bounds read vulnerability exists in Exiv2 0.27.4 and earlier versions. An attacker could exploit this vulnerability via specially crafted image files to cause a denial of service...