Rust Resource Management Error Vulnerability (CNVD-2021-30582)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A resource management error vulnerability exists in endiantrait crate for Rust 2021-01-04 and earlier versions, which stems from an error that can occur when a user-supplied endian impl occurs panic. No detailed...

Atlassian Jira Server and Jira Data Center have unspecified vulnerabilities

Atlassian JIRA Server and Atlassian JIRA Data Center are both products of Atlassian Australia, Atlassian JIRA Server is a server version of a defect tracking management system. Atlassian JIRA Data Center is the data center version of Atlassian JIRA. Atlassian JIRA Server and Atlassian JIRA Data...

Oracle VM VirtualBox Input Validation Error Vulnerability (CNVD-2021-30038)

Oracle VM VirtualBox is a virtual machine management software from Oracle. Oracle VM VirtualBox suffers from an input validation error vulnerability that stems from an input validation error in the core components of Oracle VM VirtualBox. No detailed vulnerability details are provided at this tim...

VMware NSX-T Privilege License and Access Control Issues Vulnerability

Vmware VMware NSX-T is a Vmware architecture for building cloud-native applications. The service provides networking, security and automation and simplifies operations for emerging application frameworks and architectures with heterogeneous endpoint environments and technology stacks. NSX-T 3.1.1...

GitLab CE/EE Authorization Issues Vulnerability

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is the GitLab Enterprise Edition and GitLab CE is the GitLab Community Edition. GitLab CE/...

TYPO3 cross-site scripting vulnerability (CNVD-2021-26144)

TYPO3 is a free and open source content management system. A cross-site scripting vulnerability exists in TYPO3 Form Framework, which can be exploited by attackers to inject malicious script or HTML code...

Google Chrome Information Disclosure Vulnerability (CNVD-2021-16856)

Chrome is a simple and efficiently designed web browsing tool developed by Google that is characterized by its simplicity and speed. A side-channel information disclosure vulnerability exists in Network Internals in versions of Google Chrome prior to 89.0.4389.72. An attacker can exploit this...

PostgreSQL Resource Management Error Vulnerability (CNVD-2021-14792)

PostgreSQL is a free object-relational database management system organized by Postgresql. The system supports most of the SQL standards and provides many other features, such as foreign keys, triggers, views, etc. A resource management error vulnerability exists in PostgreSQL, which arises from...

Discourse has an unspecified vulnerability (CNVD-2021-100598)

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features.A security vulnerability exists in Discourse 2.7.0, which stems from 2FA's reliance on certain forms rate-limit.No details of the vulnerability are currently available...

Palo Alto Networks PAN-OS Management Interface Command Injection Vulnerability

Palo Alto Networks PAN-OS is a set of operating systems developed for its firewall appliances. An OS command injection vulnerability exists in the Palo Alto Networks PAN-OS management interface that could be exploited by an attacker to execute arbitrary operating system commands...

WordPress Nexos theme cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.Nexos theme is a real estate website theme plugin used in it. A cross-site scripting vulnerability exists in WordPress Nexos...

IBM Spectrum Protect Plus Command Injection Vulnerability (CNVD-2020-14213)

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A command injection vulnerability exists in...

Vanilla cross-site scripting vulnerability (CNVD-2020-04666)

Vanilla is an open source multi-language, fully extensible forum program. A cross-site scripting vulnerability exists in Vanilla version 2.6.3 in index.php?p = / dashboard / settings / branding. The vulnerability stems from a lack of proper validation of client-side data in the web application. A...

OpenBSD Elevation of Privilege Vulnerability

OpenBSD is a cross-platform, BSD-based UNIX-like operating system from the Canadian OpenBSD project team. An elevation of privilege vulnerability exists in OpenBSD 6.6 and earlier versions, which can be exploited by a local attacker to elevate privileges to root, and then execute his own library...

GitBook Cross-Site Scripting Vulnerability

GitBook is a command-line tool for publishing and hosting books online. A cross-site scripting vulnerability exists in GitBook 2.6.9 and earlier versions. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerability...

CloudBees Jenkins Code Issue Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . LTS is a long-term support for...

Freeware Advanced Audio Decoder 2 Buffer Overflow Vulnerability (CNVD-2019-05832)

Freeware Advanced Audio Decoder 2 FAAD2 is an open source MPEG-4 and MPEG-2 AAC decoder licensed under the GPLv2 license. A stack buffer overflow vulnerability exists in the third instance of the calculategain function in libfaad/sbrhfadj.c in Freeware Advanced Audio Decoder 2 FAAD2 2.8.8, which...

Microsoft .NET Framework Local Elevation of Privilege Vulnerability

Microsoft .NET Framework is a comprehensive and consistent programming model developed by Microsoft Corporation USA and a development platform for building Windows, Windows Store, Windows Phone, Windows Server and Microsoft Azure Windows Store, Windows Phone, Windows Server, and Microsoft Azure...

OpenCV 'cv::PxMDecoder::readData' function buffer overflow vulnerability

OpenCV is an open source, cross-platform, lightweight computer vision library. A buffer overflow vulnerability exists in the 'cv::PxMDecoder::readData' function of the grfmtpxm.cpp file in OpenCV version 3.3.1, which stems from the program using incorrect size values. An attacker could exploit th...

Siemens SIMATIC HMI Denial of Service Vulnerability

SIMATIC HMI is an industrial device from Siemens, Germany.SIMATIC HMI panels are used for operator control and monitoring of machines and equipment. A denial of service vulnerability in the Siemens SIMATIC HMI Multi-Panel and HMI Mobile Panels, as well as in the S7-300/S7-400 devices, allows an...

html5lib cross-site scripting vulnerability (CNVD-2017-00053)

html5lib is a Python library for parsing HTML. A cross-site scripting vulnerability exists in html5lib, which stems from the program's failure to adequately filter user-submitted input. The vulnerability can be exploited to execute arbitrary script code in a user's browser to steal cookie-based...

Google Android adb backup 'server/BackupManagerService.java' directory traversal vulnerability

Android is an operating system based on the Linux open kernel and is a mobile operating system announced by Google Inc. on November 5, 2007.ADB creates a backup of your Android device that exists on your computer. Google Android adb backup has a directory traversal vulnerability in its...

Microsoft Exchange Server Input Validation Error Vulnerability (CNVD-2025-3057284)

Microsoft Exchange Server is the United States Microsoft Microsoft company's set of e-mail service program. It provides e-mail access, storage, forwarding, voice mail, e-mail filtering and screening. A security vulnerability exists in Microsoft Exchange Server. An attacker could exploit the...

F5 BIG-IP TMM Denial of Service Vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, and remote access policy management. A denial-of-service vulnerability exists in BIG-IP's TMM Traffic Management Microkernel module, which arises because specific...

IrfanView CADImage Plugin Buffer Overflow Vulnerability (CNVD-2025-16831)

IrfanView CADImage Plugin is a CAD plugin from IrfanView. IrfanView CADImage Plugin suffers from a buffer overflow vulnerability that stems from a lack of validation of user data when parsing DWG files, which can be exploited by an attacker to execute code in the context of the current process...

TOTOLINK A3100R comment buffer overflow vulnerability

TOTOLINK A3100R is a series of wireless routers from China's Gion Electronics TOTOLINK. The TOTOLINK A3100R suffers from a buffer overflow vulnerability, which originates from the comment parameter in setIpPortFilterRules, that can be exploited by an attacker to crash an application or execute...

SunGrow WiNet-S stack buffer overflow vulnerability (CNVD-2025-03255)

SunGrow WiNet-S is a LAN communication module from SunGrow, China. The SunGrow WiNet-S suffers from a stack buffer overflow vulnerability that can be exploited by an attacker to execute arbitrary code on the system or cause a denial of service...

Microsoft Excel Code Problem Vulnerability (CNVD-2025-02829)

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. A code issue vulnerability exists in Microsoft Excel. An attacker could exploit the vulnerability to bypass certain functionality...

IBM Cognos Controller File Upload Vulnerability (CNVD-2025-01788)

IBM Cognos Controller is a suite of business intelligence and planning solutions from International Business Machines IBM. The product features process automation, financial audit control, and the creation and management of financial reports. A file upload vulnerability exists in IBM Cognos...

Siemens InterMesh Subscriber Devices Incorrect Privilege Assignment Vulnerability

InterMesh is a wireless alarm reporting system that uses mesh wireless network technology to transmit alarm signals. An incorrect privilege assignment vulnerability exists in Siemens InterMesh Subscriber Devices, which is due to an affected device containing a SUID binary file that can be exploit...

Apache CloudStack Input Validation Error Vulnerability (CNVD-2024-41660)

Apache CloudStack is a suite of Infrastructure as a Service IaaS cloud computing platforms from the Apache Foundation in the United States. The platform is primarily used to deploy and manage large networks of virtual machines. Apache CloudStack has a security vulnerability that can be exploited ...

Delta Electronics CNCSoft-G2 out-of-bounds read vulnerability (CNVD-2024-40832)

Delta Electronics CNCSoft-G2 is a human-machine interface HMI software from Delta Electronics, China. The Delta Electronics CNCSoft-G2 out-of-bounds read vulnerability can be exploited by an attacker to execute code in the context of the current process...

Siemens SIMATIC RFID Readers Hidden Function Vulnerability (CNVD-2024-38007)

SIMATIC RF600 Readers are used for contactless identification of a variety of objects such as shipping containers, pallets, production goods, or often for recording bulk goods.SIMATIC RF1100 is an RFID-based solution for simple and versatile electronic authorization management.SIMATIC RF360R read...

IBM webMethods Integration Elevation of Privilege Vulnerability

IBM webMethods Integration is a hybrid enterprise iPaaS from International Business Machines IBM. An elevation of privilege vulnerability exists in IBM webMethods Integration version 10.15, which can be exploited by an authenticated attacker to create scheduler tasks that elevate their privileges...

Apache StreamPipes Security Bypass Vulnerability

Apache StreamPipes is a self-service industrial IoT toolkit from the Apache USA Foundation that enables non-technical users to connect, analyze and explore IIoT data streams. Apache StreamPipes suffers from a security bypass vulnerability that can be exploited by an attacker to create multiple...

NetBox Cross-Site Scripting Vulnerability (CNVD-2024-37586)

NetBox is a Django, PostgreSql based tool for IP Address Management IPAM and Data Center Infrastructure Management DCIM from the NetBox community. A cross-site scripting vulnerability exists in NetBox v4.0.3, which stems from the lack of effective filtering and escaping of user-supplied data in t...

Rockwell Automation FactoryTalk View SE Elevation of Privilege Vulnerability

Rockwell Automation FactoryTalk View SE is an industrial automation system view interface from Rockwell Automation. An elevation of privilege vulnerability exists in Rockwell Automation FactoryTalk View SE, which can be exploited by an attacker to edit scripts that bypass access control lists and...

Trend Micro Apex One elevation of privilege vulnerability (CNVD-2024-40818)

Trend Micro Apex One is an endpoint protection software from Trend Micro. An elevation of privilege vulnerability exists in Trend Micro Apex One, which can be exploited by an attacker to elevate privileges and execute arbitrary code in the system context...

Adobe Commerce Input Validation Error Vulnerability (CNVD-2024-19008)

Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. Adobe Commerce has an input validation error vulnerability that stems from vulnerability to incorrect input validation vulnerability, which could lead t...

Unspecified Vulnerability in TP-LINK AC1350 (CNVD-2024-20286)

The TP-LINK AC1350 is a router from China P&L TP-LINK. The TP-LINK AC1350 suffers from a security vulnerability that can be exploited by an attacker to cause a reset to factory settings via a series of specially crafted network requests...

Foxit PDF Reader AcroForm Code Execution Vulnerability

Foxit PDF Reader is a PDF document reader and printer with fast startup speed and rich features. A code execution vulnerability exists in Foxit PDF Reader AcroForm, which can be exploited by a remote attacker to submit a special file request and trick the user into parsing it, which can crash the...

Tenda AC10 OS Command Injection Vulnerability (CNVD-2024-15743)

The Tenda AC10 is a wireless router from the Chinese company Tenda. Tenda AC10U version 15.03.06.49 suffers from an operating system command injection vulnerability, which originates from the mac parameter of the formWriteFacMac function of the /goform/WriteFacMac file failing to correctly filter...

Delinea PAM Secret Server Information Disclosure Vulnerability

Delinea PAM Secret Server is a key service manager from Delinea. An information disclosure vulnerability exists in Delinea PAM Secret Server version 11.4, which can be exploited by an attacker to read data from a memory dump...

Siemens Sinteso EN and Cerberus PRO EN Fire Protection Systems Buffer Overflow Vulnerability

Cerberus PRO EN is a fire protection system consisting of fire panels, detection and management stations. It is available to Siemens partners and complies with the European standard EN 54 for fire detection and alarm systems. Sinteso EN is a fire protection system consisting of fire panels,...

Mozilla Firefox Code Execution Vulnerability (CNVD-2024-12546)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A code execution vulnerability exists in Mozilla Firefox, which can be exploited by attackers to execute arbitrary code or cause a denial of service on a vulnerable system using unknown attack vectors...

Huawei HarmonyOS and EMUI WMS Module Privilege Control Class Vulnerability

Huawei HarmonyOS is an operating system from Huawei, a Chinese company. It provides a full-scenario distributed operating system based on a microkernel.Huawei EMUI is a user interface developed by Huawei based on the Android operating system. A privilege control type vulnerability exists in Huawe...

Fortinet FortiOS and FortiProxy Out-of-Bounds Write Vulnerability

Fortinet FortiOS is a dedicated security operating system on the FortiGate network security platform.Fortinet FortiProxy is a secure network proxy that protects employees from cyberattacks by combining a variety of detection technologies, such as Web filtering, DNS filtering, DLP, anti-virus,...

IBM Operational Decision Manager Code Issue Vulnerability

IBM Operational Decision Manager is a decision management solution from International Business Machines IBM used to help organizations better manage and enforce business rules and decisions. IBM Operational Decision Manager suffers from a code issue vulnerability that originates from the ability ...

Siemens Polarion ALM Faulty Default Privileges Vulnerability

Polarion ALM is an application lifecycle management solution that improves the software development process with a single, unified solution for requirements, coding, testing and release. Siemens Polarion ALM has a false default privilege vulnerability that can be exploited by an attacker to...

Tenda AC10U Stack Buffer Overflow Vulnerability

Tenda AC10U is a wireless router from Tenda China. The Tenda AC10U suffers from a stack buffer overflow vulnerability caused by incorrect bounds checking in the formQuickIndex function. A remote attacker can exploit this vulnerability to cause a buffer overflow and execute arbitrary code on the...