Online Sports Complex Booking System SQL注入漏洞（CNVD-2022-58677）

Online Sports Complex Booking System is an online stadium booking system by Carlo Montero, a personal developer. version 1.0 of Online Sports Complex Booking System is vulnerable to SQL injection, which originates in scbs/classes/ Master.php?f=delete, the id parameter of the post request lacks...

Xtend Cross-Site Scripting Vulnerability

Xtend is a general-purpose high-level programming language for the Eclipse Foundation's Java Virtual Machine. Xtend Voice Logger version 1.0 has a security vulnerability that stems from a cross-site scripting vulnerability in the error page. An attacker can use the vulnerability to execute...

Unspecified Vulnerability in Siemens Desigo PXC and DXR Devices (CNVD-2022-37375)

Desigo DXR2 controllers are programmable automation stations to support the standard control needs of end HVAC equipment and TRA Total Room Automation applications. the Desigo PXC3 series of automation stations can be used in buildings where functionality and flexibility are more demanding. Use...

Unspecified vulnerability in Siemens SICAM P850 and SICAM P855 Devices (CNVD-2022-36397)

The SICAM P850 Multifunctional Measurement Device is used to collect, visualize, evaluate and transmit electrical measurement variables such as AC current, AC voltage, frequency, power, harmonics, etc. The SICAM P855 Multifunctional Device is used to collect, display and transmit measured...

WordPress plugin LayerSlider跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. cross-site scripting vulnerability exists in versions prior to WordPress plugin LayerSlider 7.1.2. Th...

F5 BIG-IP multiple products have unspecified vulnerabilities

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing, etc. Several F5 BIG-IP products have security vulnerabilities that can be exploited by attackers to access certificate and key files from remote...

Cyclos 4 PRO Cross-Site Scripting Vulnerability (CNVD-2022-77956)

Cyclos 4 PRO is a web server. a cross-site scripting vulnerability exists in Cyclos 4 PRO version 4.14.7 and earlier, which stems from a failure to validate user input during error notification. A remote, unauthenticated attacker could execute javascript code via undefine enumeration constants...

Delta Electronics DIAEnergie ReadRegIND SQL Injection Vulnerability (CNVD-2022-36021)

Delta Electronics DIAEnergie is an industrial energy management system for monitoring and analyzing energy consumption in real time, calculating energy consumption and load characteristics, optimizing equipment performance, improving production processes and maximizing energy efficiency. Delta...

Attendance and Payroll System SQL注入漏洞（CNVD-2022-33143）

Attendance and Payroll System is a PHP/MySQLi source code attendance and payroll system by oretnom23 individual developers. version v1.0 of Attendance and Payroll System is vulnerable to SQL injection, which originates from the component adminovertime delete.php lacks validation of external input...

Amazon AWS VPN Client Information Disclosure Vulnerability

Amazon AWS VPN Client is a fully managed remote access VPN solution from Amazon.com. Amazon AWS VPN Client for Windows version 2.0.0 is vulnerable to an information disclosure vulnerability that could be exploited by an attacker to disclose a user's Net-NTLMv2 hash to an external server...

Ecommerce-Website File Upload Vulnerability (CNVD-2022-65360)

Ecommerce-Website is a complete e-commerce website with an administration panel built using PHP and MySql.Ecommerce-Website is vulnerable to file uploads, which can be exploited by attackers to execute arbitrary code via carefully crafted PHP files...

SAP Web Dispatcher和Internet Communication Manager拒绝服务漏洞

SAP Web dispatcher and SAP Internet Communication Manager SAP ICM are both products of SAP Germany. SAP Internet Communication Manager is a component of the SAP NetWeaver application server. SAP Web Dispatcher and SAP Internet Communication Manager suffer from a denial-of-service vulnerability th...

Microsoft Windows Graphics Component Remote Code Execution Vulnerability (CNVD-2022-74593)

A remote code execution vulnerability exists in Microsoft Windows Graphics Components, which originates when a network system or product fails to properly filter external input data during the construction of code segments. elements during the construction of code segments from external input dat...

Microsoft Remote Procedure Call Runtime Remote Code Execution Vulnerability

Microsoft Remote Procedure Call Runtime is a technology used to create distributed client/server programs from Microsoft Corporation USA. The vulnerability can be exploited to execute arbitrary code on the system...

Microsoft Windows DNS Server Remote Code Execution Vulnerability (CNVD-2022-84114)

Microsoft Windows is an operating system for personal devices from Microsoft Corporation USA.A remote code execution vulnerability exists in Microsoft Windows DNS Server, which can be exploited by attackers to execute arbitrary code on the system...

Social Codia SMS Cross-Site Scripting Vulnerability

Social Codia SMS is an inventory management system from Social Codia India. v1.0 of Social Codia SMS is vulnerable to a cross-site scripting vulnerability that could be exploited by attackers to execute arbitrary Web script or HTML by injecting a specially crafted payload into the post title text...

Code injection vulnerability in Joomla!

Joomla! is a set of forum components used in the Joomla! content management system. A code injection vulnerability exists in versions 4.0.0 to 4.1.0 of Joomla!, which stems from an HTTP request parameter input validation error. No detailed vulnerability details are available at this time...

NexusPHP SQL Injection Vulnerability (CNVD-2022-65365)

NexusPHP is a free and open source complete solution for building PT websites. NexusPHP version 1.5 is vulnerable to SQL injection, which can be exploited by remote attackers to execute arbitrary SQL commands via the id parameter...

Jenkins Pipeline Phoenix AutoTest Plugin 文件上传漏洞

Jenkins Pipeline is a set of plug-ins that support the implementation and integration of continuous delivery pipelines into Jenkins.The Jenkins Pipeline Phoenix AutoTest Plugin 1.3 and earlier versions are vulnerable to a path traversal vulnerability that could be exploited by an attacker with...

Wordpress Plugin All-in-one Floating Contact Form Cross-Site Scripting Vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. wordpress Plugin All-in-one Floating Contact Form...

Moodle Access Control Error Vulnerability (CNVD-2022-54955)

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment. an access control error vulnerability exists in Moodle, which stems from improper access restrictions. A remote attacker could use the...

GPAC has an unspecified vulnerability (CNVD-2022-22300)

GPAC is an open-source multimedia framework. there is a security vulnerability in MP4Box before GPAC version 2.1.0-DEV, and no detailed vulnerability details are available...

Open-xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2022-28454)

Open-xchange OX App Suite is a set of Web-based cloud desktop environments from Open-Xchange Open-xchange USA. The environment allows users to manage email, tasks, files, etc. more intuitively. A cross-site scripting vulnerability exists in Open-xchange OX App Suite version 7.10.5 and prior...

Apache CloudStack Security Feature Issue Vulnerability

Apache CloudStack is an Infrastructure-as-a-Service IaaS cloud computing platform from the Apache Foundation. The platform is primarily used to deploy and manage large networks of virtual machines.A security feature issue vulnerability exists in versions of Apache CloudStack prior to 4.16.1.0,...

ARRIS TR3300 Command Injection Vulnerability (CNVD-2022-68529)

The ARRIS TR3300 is an 802.11ac Wi-Fi router from ARRIS, Inc. A command injection vulnerability exists in the ARRIS TR3300, which stems from the failure of the wanipstat, wanmaskstat, wangwstat, and wandns1stat parameters in the ip function to properly filter the construct command special...

Huawei Emui and Magic UI PMS module privilege control vulnerability

Huawei Emui is a mobile operating system developed on Android. magic Ui is a mobile operating system developed on Android. Huawei Emui and Magic UI PMS modules have a privilege control vulnerability that could be exploited by attackers to obtain sensitive system information...

Mcafee McAfee Total Protection Competitive Conditions Vulnerability

McAfee McAfee Total Protection MTP is a suite of antivirus software from Mcafee, Inc. McAfee Total Protection for Windows 16.0.43 previously contained a competitive condition vulnerability that could be exploited by a local attacker to gain elevated privileges and execute arbitrary files Delete...

SuiteCRM Deserialization Vulnerability

SuiteCRM is a customer relationship management system from the SuiteCRM team. SuiteCRM suffers from a deserialization vulnerability that stems from insecure deserialization of serialized data received by the application from users, which can be exploited by attackers to execute arbitrary code via...

Microsoft Exchange Server Spoofing Vulnerability (CNVD-2022-77978)

Microsoft Exchange Server is a set of email service programs from Microsoft Corporation USA. It provides mail access, storage, forwarding, voice mail, mail filtering, etc. A spoofing vulnerability exists in Microsoft Exchange Server, which can be exploited by attackers to conduct spoofing attacks...

Siemens RUGGEDCOM ROS has an unspecified vulnerability (CNVD-2022-17781)

Siemens RuggedCom ROS is an operating system used in the RuggedCom family of switches from Siemens, Germany. Siemens RUGGEDCOM ROS has a security vulnerability that could be exploited by an attacker to cause data corruption and possibly hard application failures...

Siemens RUGGEDCOM ROS has an unspecified vulnerability (CNVD-2022-17784)

Siemens RuggedCom ROS is an operating system used in the RuggedCom family of switches from Siemens, Germany. Siemens RUGGEDCOM ROS has a security vulnerability that could be exploited by attackers to act as a man-in-the-middle and eavesdrop on encrypted communications...

Espruino Buffer Overflow Vulnerability (CNVD-2022-20169)

Espruino is a JavaScript interpreter. It is designed for devices with only 128kB of flash memory and 8kB of RAM. espruino has a security vulnerability that stems from src/jsvar.c containing a stack buffer overflow. No details of the vulnerability are currently available...

Scrapy Information Disclosure Vulnerability (CNVD-2022-17012)

Scrapy is a free and open-source web crawler framework written in Python.An information disclosure vulnerability exists in versions of Scrapy prior to 2.6.1, which stems from the product's failure to effectively protect sensitive information. An attacker could use this vulnerability to obtain...

microweber has an unspecified vulnerability (CNVD-2022-13207)

Microweber is a drag-and-drop online store management system from the Microweber community in the United States. The system includes modules for adding products, images, etc. A security vulnerability exists in versions of microweber prior to 1.2.11, which stems from a business logic error in the...

PJSUA API Buffer Overflow Vulnerability (CNVD-2022-15000)

Pjsua Api is an advanced Api for building Sip multimedia user agent applications. a buffer overflow vulnerability exists in the PJSUA API, which can be exploited by attackers to cause out-of-bounds reading of information via a controlled filename parameter...

Jenkins Checkmarx Plugin Cross-Site Request Forgery Vulnerability

Jenkins plug-ins are plug-ins that provide appropriate functionality for Jenkins. Jenkins Checkmarx Plugin cross-site request forgery vulnerability. The vulnerability can be exploited by an attacker to connect to an attacker-specified web server via an attacker-specified credential ID to capture...

Schneider Electric Multiple Product Input Validation Error Vulnerability

Schneider Electric Modicon Quantum and Schneider Electric Modicon M340 are both products of Schneider Electric, a French company. The Schneider Electric Modicon M340 is a mid-range PLC programmable logic controller for industrial processes and infrastructure. The vulnerability sends a specially...

Bentley Systems Bentley View Resource Management Error Vulnerability (CNVD-2022-15825)

Bentley Systems Bentley View is a free viewer from Bentley Systems, USA. A resource management error vulnerability exists in Bentley View that can be exploited by an attacker to execute code in the context of the current process...

Apache Pulsar Input Validation Error Vulnerability

Apache Pulsar is the United States Apache Apache Foundation for cloud environments, set of messages, storage, lightweight functional computing as one of the distributed message flow platform. The software supports multi-tenant, persistent storage, multi-machine room cross-region data replication,...

FlexNet Unauthorized Access Vulnerability

An unauthorized access vulnerability exists in FlexNet 2020 R2.5 and prior versions of FlexNet, a software license manager from Flexera, Inc. of Chicago, USA. An attacker could exploit this vulnerability to modify other restricted files after passing local authentication...

Oracle MySQL Cluster Input Validation Error Vulnerability (CNVD-2022-07923)

Oracle MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database developed by Oracle Corporation. Oracle MySQL Cluster is vulnerable to an input validation error, which can be exploited by attackers to execute arbitrary code...

Adobe Acrobat/Reader Resource Management Error Vulnerability

Adobe Reader also known as Acrobat Reader is a PDF file reader software developed by Adobe. Adobe Acrobat is a PDF editing software developed by Adobe. Adobe Acrobat/Reader has a resource management error vulnerability, which can be exploited by remote attackers to Creating specially crafted PDF...

Jerryscript has an unspecified vulnerability (CNVD-2022-07250)

JerryScript, a lightweight JavaScript engine from the JerryScript project, has a security vulnerability in Jerryscript version 3.0.0, which originates in /jerry-core/ecma/base/ecma-helpers- A heap-based buffer overflow exists in ecmautf8stringtonumberbyradix in conversion.c. No detailed...

microweber access control error vulnerability

Microweber is an online store management system from the Microweber community in the United States that provides drag-and-drop functionality. The system includes modules for adding products, images, and more. microweber is vulnerable to an access control error, which stems from a network system o...

Google Android Elevation of Privilege Vulnerability (CNVD-2022-16342)

Google Android is a Linux-based open-source operating system from the U.S. company Google. Google Android elevation of privilege vulnerability can be exploited by attackers to elevate privileges...

Kalkitech Sync Products Encryption Issue Vulnerability

Kalkitech Sync Products is a range of substation gateways from Kalkitech India. Kalkitech Sync Products suffers from an encryption issue vulnerability that stems from the use of an insecure communication channel by the management tools Easyconnect and SYNC devices, which can be exploited by an...

Controlup Real-Time Agent Command Injection Vulnerability

Controlup Real-Time Agent is a real-time agent from Controlup USA. The Controlup Real-Time Agent suffers from a command injection vulnerability that originates from an unauthenticated named pipe channel in the Controlup Real-Time Agent, which can be exploited by an attacker to run operating syste...

Apache James path traversal vulnerability

Apache James is an open source Smtp and Pop3 mail transfer agent and Nntp news server written entirely in Java by the Apache Foundation. Apache James in version 3.6.1 contains a path traversal vulnerability that stems from a failure of a networked system or product to properly filter special...

Django path traversal vulnerability (CNVD-2022-31938)

Django is the Django Foundation's set of Python-based language open source Web application framework . The framework includes an object-oriented mapper, view system, template system, etc. Django version 2.2 before 2.2.26, 3.2.11 before 3.2.2, and 4.0.1 before 4.0.0 contains a path traversal...

Netgear RAX43 Buffer Overflow Vulnerability

The Netgear RAX43 is a router from the American company Netgear. A hardware device that connects two or more networks and acts as a gateway between them. A buffer overflow vulnerability exists in Netgear RAX43 version 1.0.3.96. The vulnerability is caused by the URL parsing functionality of the...