FATEK Automation FvDesigner Out-of-Bounds Write Vulnerability

FATEK Automation FvDesigner is a human-computer interaction device from FATEK. A security vulnerability exists in FATEK Automation FvDesigner 1.5.88 and earlier versions, which can be exploited by an attacker to craft an arbitrary code-executing project file...

Huawei EMUI/Magic UI Input Validation Vulnerability (CNVD-2021-64495)

Huawei Emui is a mobile operating system developed on Android. Huawei Magic UI is the operating system for Honor phones. Huawei EMUI/Magic UI has an input validation vulnerability that can be exploited by attackers to cause random address access...

Adobe Illustrator 2021 post-release reuse vulnerability (CNVD-2021-74115)

Adobe Illustrator 2021 is a vector drawing software. A security vulnerability exists in Adobe Illustrator 2021 25.2.3 and earlier versions when handling specially crafted files. An attacker can exploit the vulnerability to read arbitrary file systems...

Unspecified vulnerability in Ypsomed mylife App and mylife Cloud (CNVD-2021-69616)

Ypsomed mylife App is an application of Ypsomed AG. To optimize communication between people with diabetes and healthcare professionals, mylife Therapy Management is an easy-to-use, easy-to-share solution for diabetes therapy data. mylife App and mylife Cloud have a security vulnerability that...

Apache CXF Resource Management Error Vulnerability (CNVD-2021-70100)

Apache CXF is the United States Apache Apache Foundation's an open source Web services framework. The framework supports multiple Web service standards, multiple front-end programming APIs, etc. Apache CXF has a resource management error vulnerability that can be exploited by an attacker to submi...

Unspecified vulnerability in deep-override (CNVD-2021-47378)

deep-override is a software application. Provides a recursive object extension and override. A security vulnerability exists in deep-override versions 1.0.0 through 1.0.1, which can be exploited by an attacker to cause a denial of service and potentially lead to remote code execution...

Huawei eCNS280_TD and ESE620X vESS out-of-bounds read vulnerability

Huawei eCNS280TD is a core network device for Huawei's wireless broadband trunking system. Huawei ESE620X vESS is a virtual enterprise service controller from Huawei, China. Huawei eCNS280TD and ESE620X vESS are vulnerable to an out-of-bounds read vulnerability. An attacker can exploit this...

ThroughTek P2P SDK Information Disclosure Vulnerability

ThroughTek P2P SDK is a software application from Throughtek for video surveillance products and large "audio/video" file transfers. An information disclosure vulnerability exists in the ThroughTek P2P SDK. The vulnerability can be exploited by an attacker to access sensitive information...

Telegram Stack Overflow Vulnerability (CNVD-2021-38308)

Telegram is an instant messaging mobile application. A stack overflow vulnerability exists in the custom derived graysplitcubic function of the Rlottie library for Telegram Android version prior to 7.1.0 2090, iOS version prior to 7.1, and macOS version prior to 7.1. An attacker can exploit this...

Rust Buffer Overflow Vulnerability (CNVD-2021-31918)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A buffer overflow vulnerability exists in reorder crate for Rust 2021-02-24 and earlier versions, which stems from a swap index write operation that oversteps its bounds if the len returned by the iterator is to...

ASUS GPUTweak II Buffer Overflow Vulnerability (CNVD-2021-28253)

ASUS GPUTweak II is a driver from ASUS China. It is used to drive more FPS. A buffer overflow vulnerability exists in ASUS GPUTweak II versions prior to 2.3.0.3, which allows a low-privileged user to obtain NT AUTHORITYSYSTEM privileges via DeviceIoControl. No details of the vulnerability are...

HGiga MailSherlock SQL Injection Vulnerability (CNVD-2021-25618)

Hgiga MailSherlock is a set of enterprise mail audit system from Henderson Hgiga, China. HGiga MailSherlock suffers from a SQL injection vulnerability, which stems from the lack of validation of externally entered SQL statements in database-based applications, and can be exploited by an attacker ...

Microsoft Exchange Server Spoofing Vulnerability (CNVD-2021-28797)

Microsoft Exchange Server is the United States Microsoft Microsoft company's set of e-mail service program. It provides e-mail access, storage, forwarding, voice mail, e-mail filtering and screening. A spoofing vulnerability exists in Microsoft Exchange Server. No detailed vulnerability details a...

Bolt Directory Traversal Vulnerability

Bolt is a simple CMS written in PHP. A directory traversal vulnerability exists in Controller/Backend/FileEditController.php and Controller/Backend/FilemanagerController.php in versions of Bolt prior to 4.1.13. No detailed vulnerability details are provided at this time...

Cisco RV110W/RV130/RV130W/RV215W Remote Command Execution and Denial of Service Vulnerability (CNVD-2021-41220)

The Cisco RV110W is a Wireless-N VPN firewall, the Cisco RV130 is a multifunction VPN router, the Cisco RV130W is a Wireless-N multifunction VPN router, and the Cisco RV215W is a Wireless-N VPN router. A remote command execution and denial of service vulnerability exists in the Web management...

Unspecified vulnerability in Red Hat keycloak (CNVD-2021-19381)

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. Red Hat Keycloak has a security vulnerability that originates from the exploitation of the Client Registration API, which can be exploited by a...

JerryScript ecma_is_lexical_environment buffer overflow vulnerability

JerryScript is a lightweight JavaScript engine from the JerryScript project. jerryScript ecmaislexicalenvironment has a buffer overflow vulnerability that can be exploited by attackers to submit special requests that can crash an application or execute arbitrary code...

AnyDesk Formatting String Error Vulnerability

FreeBSD is a set of Unix-like operating systems from the FreeBSD Foundation. A format string error vulnerability exists in AnyDesk versions prior to 5.5.3 Linux and FreeBSD platforms. A remote attacker could exploit this vulnerability to execute code...

Ruby on Rails Cross-Site Request Forgery Vulnerability (CNVD-2020-32423)

Ruby on Rails is a set of Rails team based on the Ruby language open source Web application framework. A cross-site request forgery vulnerability exists in Ruby on Rails versions prior to 5.2.5 and 6.0.4, which stems from a WEB application that does not adequately validate that a request is comin...

rack-cors gem for Ruby directory traversal vulnerability

rack-cors is Rack middleware for handling cross-domain resource sharing CORS. A directory traversal vulnerability in the rack-cors gem for Ruby prior to version 1.0.4, which stems from resource matching failing to ensure that pathnames are in a canonical format, can be exploited by an attacker to...

Magento cross-site scripting vulnerability (CNVD-2019-40746)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. Magento has a cross-site scripting vulnerability. Attackers can use this vulnerability to execute client-side cod...

Cisco Adaptive Security Appliance Software and Cisco Firepower Threat Defense Digital Error Vulnerability

Cisco Firepower Threat Defense FTD and Cisco Adaptive Security Appliances Software ASA Software are both products of Cisco, Inc.Cisco Firepower Threat Defense is a set of unified software that provides next-generation firewall services. Defense is a set of unified software to provide...

Oracle Fusion Middleware BI Publisher Information Disclosure Vulnerability

Oracle Fusion Middleware Oracle Fusion Middleware is a set of Oracle's Oracle business innovation platform for enterprise and cloud environments. The platform provides middleware, software collection and other functions. BI Publisher formerly known as XML Publisher is one of the reporting...

Microsoft Exchange Server Information Disclosure Vulnerability (CNVD-2019-14452)

Microsoft Exchange Server is a set of e-mail service programs from Microsoft, which provides e-mail access, storage, forwarding, voice mail, e-mail filtering and screening. An information disclosure vulnerability exists in Microsoft Exchange Server, which can be exploited by a remote attacker to...

Apache Syncope Cross-Site Scripting Vulnerability

Apache Syncope is an open source system for managing digital identities in enterprise environments, implemented using Java EE technology and released under the Apache 2.0 license. A stored cross-site scripting vulnerability exists in Apache Syncope. A malicious user with sufficient administrative...

AirTies Air 5453 Cross-Site Scripting Vulnerability

AirTies Air 5453 is a wireless router product from Airties Turkey. A cross-site scripting vulnerability exists in the AirTies Air 5453. A remote attacker can exploit this vulnerability by sending the 'productboardtype' parameter to the top.html page to inject arbitrary web script or HTML...

Red Hat WildFly IIOP OpenJDK Subsystem Unauthorized Operation Vulnerability

Red Hat Wildfly formerly known as JBoss Application Server is the United States Red Hat Red Hat a JavaEE-based open source application server. IIOP OpenJDK subsystem is one of the Java-based subsystem. A security vulnerability exists in the IIOP OpenJDK subsystem in Red Hat WildFly versions prior...

OpenCV 'cv::PxMDecoder::readData' function buffer overflow vulnerability

OpenCV is an open source, cross-platform, lightweight computer vision library. A buffer overflow vulnerability exists in the 'cv::PxMDecoder::readData' function of the grfmtpxm.cpp file in OpenCV version 3.3.1, which stems from the program using incorrect size values. An attacker could exploit th...

Flexense Sync Breeze Enterprise Buffer Overflow Vulnerability

Flexense Sync Breeze Enterprise is a set of file synchronization tools from Flexense Canada. The tool has features such as file management and data synchronization. A buffer overflow vulnerability exists in Flexense Sync Breeze Enterprise version 10.0.28. A remote attacker could exploit this...

vtiger Company Logo Upload Arbitrary Command Execution Vulnerability

vtiger CRM is a Web-based sales force automation SFA based customer relationship management system CRM. A security vulnerability exists in the logo upload function in the vtiger CRM SettingsVtigerCompanyDetailsSaveAction class, which allows authenticated users to upload arbitrary files and execut...

Google Android Stagefright Integer Overflow Vulnerability

Stagefright is a media playback service for Android. Stagefright for Google Android suffers from an integer overflow vulnerability when malformed media files are present, which can be exploited by an attacker to execute arbitrary code on an affected device...

Google Android elevation of privilege vulnerability (CNVD-2026-13144)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that is caused by a lock screen bypass due to competing conditions in multiple functions of KeyguardViewMediator.java. An attacker can exploit the...

D-Link Nuclias Connec Login Endpoint Observable Response Discrepancy Vulnerability

D-Link Nuclias Connect is a network management software from D-Link for centralized management of wireless access points APs, supporting multi-device remote control and reporting capabilities. D-Link Nuclias Connect suffers from an observable response difference vulnerability that stems from the...

WordPress Backup Bolt plugin Arbitrary File Download Vulnerability

WordPress Backup Bolt plugin is a backup plugin for WordPress websites, mainly used to automate the backup of website data including files, databases, etc., and support the recovery function. WordPress Backup Bolt plugin has an arbitrary file download vulnerability, which stems from a flaw in the...

DELL iDRAC Service Module Code Execution Vulnerability

The DELL iDRAC Service Module is a lightweight software service on Dell servers that is primarily used to enhance the functionality of iDRAC Integrated Dell Remote Control Card and improve server management efficiency by consolidating operating system information. A code execution vulnerability...

Freescout Helper::decrypt() function deserialization vulnerability

FreeScout is an open source helpdesk system built on the PHP Laravel framework, designed to provide users with functionality similar to Zendesk or Help Scout, but without sacrificing privacy or freedom. Freescout suffers from a deserialization vulnerability that stems from an application that...

MB CONNECT LINE mbNET.mini SQL Injection Vulnerability

The mbNET.mini from MB CONNECT LINE is an industrial router designed for industrial scenarios and is primarily used to enable secure remote connections to machines and systems. MB CONNECT LINE mbNET.mini suffers from a SQL injection vulnerability that stems from improper neutralization of special...

Library Card System SQL Injection Vulnerability (CNVD-2025-03328)

Library Card System is a library management system. A SQL injection vulnerability exists in Library Card System version 1.0, which originates from a lack of validation of the id parameter of the card.php file against externally entered SQL statements. An attacker can use this vulnerability to...

Apache Superset Information Disclosure Vulnerability (CNVD-2025-03544)

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. An information disclosure vulnerability exists in Apache Superset versions prior to 4.1.0, which stems from an error message generation that contains analysis metadata information. An attacker ca...

TRCore DVC Trust Management Issue Vulnerability

TRCore DVC is a file insurance system from TRCore China. TRCore DVC suffers from a trust management issue vulnerability that originates from encrypting a file using a hard-coded key, which can be exploited by an attacker to decrypt the file using the hard-coded key and recover the original conten...

Siemens Tecnomatix Plant Simulation Stack Buffer Overflow Vulnerability (CNVD-2024-45987)

Siemens Tecnomatix Plant Simulation is an industrial control device from Siemens, Germany. Using the function of discrete event simulation for production volume analysis and optimization, and thus improve the manufacturing system performance. A stack buffer overflow vulnerability exists in Siemen...

Microsoft SQL Server Native Client Remote Code Execution Vulnerability (CNVD-2025-02462)

Microsoft SQL Server is the United States Microsoft Microsoft company's set of applications in the Microsoft Windows system under the large commercial database system. A remote code execution vulnerability exists in Microsoft SQL Server Native Client, which can be exploited by an attacker to...

Siemens OZW devices (web servers) cross-site scripting vulnerability

OZW devices web servers are used for remote monitoring of building controller devices, e.g. for monitoring heating control or air conditioning. A cross-site scripting vulnerability exists in Siemens OZW devices web servers, which can be exploited by an attacker to inject arbitrary JavaScript code...

Siemens InterMesh Subscriber Devices Incorrect Privilege Assignment Vulnerability

InterMesh is a wireless alarm reporting system that uses mesh wireless network technology to transmit alarm signals. An incorrect privilege assignment vulnerability exists in Siemens InterMesh Subscriber Devices, which is due to an affected device containing a SUID binary file that can be exploit...

NetBox Cross-Site Scripting Vulnerability (CNVD-2024-37586)

NetBox is a Django, PostgreSql based tool for IP Address Management IPAM and Data Center Infrastructure Management DCIM from the NetBox community. A cross-site scripting vulnerability exists in NetBox v4.0.3, which stems from the lack of effective filtering and escaping of user-supplied data in t...

Foxit PDF Reader AcroForm Annotation Type Obfuscation Code Execution Vulnerability

Foxit PDF Reader is a PDF document reader and printer with fast startup speed and rich features. A type-obfuscation vulnerability exists in the Foxit PDF Reader AcroForm Annotation, which can be exploited by an attacker to submit a special request for a file, tricking the user into parsing it,...

Ampache Cross-Site Scripting Vulnerability (CNVD-2024-15737)

Ampache is a web-based audio/video application and file manager. A cross-site scripting vulnerability exists in Ampache 6.2.1 and earlier versions, which stems from a lack of effective filtering and escaping of user-supplied data by the rule, and can be exploited by an attacker to execute arbitra...

IBM Maximo Application Suite Cross-Site Scripting Vulnerability

IBM Maximo Application Suite is a single platform for intelligent asset management, monitoring, maintenance, computer vision, security and reliability from International Business Machines IBM. A cross-site scripting vulnerability exists in IBM Maximo Application Suite version 7.6.1.3, which stems...

Apache InLong Code Issue Vulnerability (CNVD-2024-16113)

Apache InLong is the U.S. Apache Apache Foundation's one-stop massive data integration framework. Provides automated, secure and reliable data transfer capabilities. A code issue vulnerability exists in Apache InLong versions 1.8.0 through 1.10.0, which can be exploited by an attacker to read...

Apache Airflow Information Disclosure Vulnerability (CNVD-2024-26530)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An information disclosure vulnerability exists in Apache Airflow versions prior to...