Oracle Database Server has an unspecified vulnerability (CNVD-2021-101531)

Oracle Database Server is a relational database management system from Oracle Corporation USA. The database management system provides data management, distributed processing, and other functions.An unspecified vulnerability exists in the Java VM component of Oracle Database Server versions...

Portlandlabs Concrete5 server-side request forgery vulnerability

Portlandlabs Concrete5 is an open source content management system CMS from PortlandLabs, U.S. Portlandlabs Concrete5 server-side request forgery vulnerability can be exploited by attackers to retrieve HTTP and FTP files from internal server networks by inserting internal addresses...

Moxa MXview Improper Access Control Vulnerability

An improper access control vulnerability exists in Moxa MXview, a network management software used to monitor and diagnose industrial networks. The vulnerability stems from the fact that the affected product has a misconfigured service that allows remote connections to internal communication...

Huawei FusionCompute Command Injection Vulnerability (CNVD-2021-84882)

Huawei FusionCompute is a computer virtualization engine from Huawei China. A command injection vulnerability exists in the CMA service of the Huawei FusionCompute product, which provides Virtual Resource Manager VRM and Compute Node Agent CNA. The vulnerability stems from the fact that special...

Mozilla Rust Command Injection Vulnerability (CNVD-2021-78748)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. Mozilla Rust is vulnerable to a command injection vulnerability that originates from rcucell crate in Rust. For RcuCell there is an unconditional send and sync implementation, which can be exploited by an attack...

LibreDWG null pointer dereference vulnerability (CNVD-2021-74010)

LibreDWG is a free C library for reading and writing DWG files. a null pointer dereference vulnerability exists in the bitreadBB function in bits.c in LibreDWG version 0.10.1.3751. An attacker could exploit this vulnerability to cause a denial of service...

Autodesk Navisworks Buffer Overflow Vulnerability (CNVD-2022-05702)

Autodesk Navisworks, Autodesk's 3D model review software for architecture, engineering and construction, is vulnerable to a buffer overflow vulnerability that originates when a maliciously crafted DWG file may be forced to read beyond its allocated boundaries when parsing the DWG file, allowing a...

Autodesk Navisworks Out-of-Bounds Read Vulnerability (CNVD-2021-99309)

Autodesk Navisworks, a 3D model review software for architecture, engineering and construction, is vulnerable to an out-of-bounds read vulnerability in Autodesk Navisworks versions 2019, 2020, 2021, 2022. An attacker can exploit the vulnerability to execute arbitrary code via specially crafted PD...

lin-cms-flask has an unspecified vulnerability

lin-cms-flask is a content management system framework. lin-cms-flask version 0.1.1 contains a security vulnerability that can be exploited by remote attackers to brute force login via the "login" function in the component "app/api/cms/user.py"...

Libelfin Denial of Service Vulnerability (CNVD-2021-66404)

Libelfin is a C 11 library for reading ELF binaries and DWARFv4 debug information. A denial of service vulnerability exists in the elf::section::asstrtab function of Libelfin 0.3. An attacker could exploit this vulnerability to cause a denial of service via a specially crafted ELF file that cause...

ZOHO ManageEngine ADSelfService Plus CSV Injection Vulnerability

ZOHO ManageEngine ADSelfService Plus is a web-based end-user password management software from ZOHO, Inc. A CSV injection vulnerability exists in ZOHO ManageEngine ADSelfService Plus, which can be exploited by attackers to obtain a reverse shell...

Exiv2 out-of-bounds read vulnerability (CNVD-2021-61793)

Exiv2 is a cross-platform C++ library and command line utility for managing image metadata. An out-of-bounds read vulnerability exists in Exiv2 0.27.4 and earlier versions. An attacker could exploit this vulnerability via specially crafted image files to cause a denial of service...

FATEK Automation FvDesigner Out-of-Bounds Write Vulnerability

FATEK Automation FvDesigner is a human-computer interaction device from FATEK. A security vulnerability exists in FATEK Automation FvDesigner 1.5.88 and earlier versions, which can be exploited by an attacker to craft an arbitrary code-executing project file...

Huawei EMUI/Magic UI Input Validation Vulnerability (CNVD-2021-64495)

Huawei Emui is a mobile operating system developed on Android. Huawei Magic UI is the operating system for Honor phones. Huawei EMUI/Magic UI has an input validation vulnerability that can be exploited by attackers to cause random address access...

Adobe Illustrator 2021 post-release reuse vulnerability (CNVD-2021-74115)

Adobe Illustrator 2021 is a vector drawing software. A security vulnerability exists in Adobe Illustrator 2021 25.2.3 and earlier versions when handling specially crafted files. An attacker can exploit the vulnerability to read arbitrary file systems...

Unspecified vulnerability in Ypsomed mylife App and mylife Cloud (CNVD-2021-69616)

Ypsomed mylife App is an application of Ypsomed AG. To optimize communication between people with diabetes and healthcare professionals, mylife Therapy Management is an easy-to-use, easy-to-share solution for diabetes therapy data. mylife App and mylife Cloud have a security vulnerability that...

Apache CXF Resource Management Error Vulnerability (CNVD-2021-70100)

Apache CXF is the United States Apache Apache Foundation's an open source Web services framework. The framework supports multiple Web service standards, multiple front-end programming APIs, etc. Apache CXF has a resource management error vulnerability that can be exploited by an attacker to submi...

Unspecified vulnerability in deep-override (CNVD-2021-47378)

deep-override is a software application. Provides a recursive object extension and override. A security vulnerability exists in deep-override versions 1.0.0 through 1.0.1, which can be exploited by an attacker to cause a denial of service and potentially lead to remote code execution...

Huawei eCNS280_TD and ESE620X vESS out-of-bounds read vulnerability

Huawei eCNS280TD is a core network device for Huawei's wireless broadband trunking system. Huawei ESE620X vESS is a virtual enterprise service controller from Huawei, China. Huawei eCNS280TD and ESE620X vESS are vulnerable to an out-of-bounds read vulnerability. An attacker can exploit this...

ThroughTek P2P SDK Information Disclosure Vulnerability

ThroughTek P2P SDK is a software application from Throughtek for video surveillance products and large "audio/video" file transfers. An information disclosure vulnerability exists in the ThroughTek P2P SDK. The vulnerability can be exploited by an attacker to access sensitive information...

Telegram Stack Overflow Vulnerability (CNVD-2021-38308)

Telegram is an instant messaging mobile application. A stack overflow vulnerability exists in the custom derived graysplitcubic function of the Rlottie library for Telegram Android version prior to 7.1.0 2090, iOS version prior to 7.1, and macOS version prior to 7.1. An attacker can exploit this...

Rust Buffer Overflow Vulnerability (CNVD-2021-31918)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A buffer overflow vulnerability exists in reorder crate for Rust 2021-02-24 and earlier versions, which stems from a swap index write operation that oversteps its bounds if the len returned by the iterator is to...

ASUS GPUTweak II Buffer Overflow Vulnerability (CNVD-2021-28253)

ASUS GPUTweak II is a driver from ASUS China. It is used to drive more FPS. A buffer overflow vulnerability exists in ASUS GPUTweak II versions prior to 2.3.0.3, which allows a low-privileged user to obtain NT AUTHORITYSYSTEM privileges via DeviceIoControl. No details of the vulnerability are...

HGiga MailSherlock SQL Injection Vulnerability (CNVD-2021-25618)

Hgiga MailSherlock is a set of enterprise mail audit system from Henderson Hgiga, China. HGiga MailSherlock suffers from a SQL injection vulnerability, which stems from the lack of validation of externally entered SQL statements in database-based applications, and can be exploited by an attacker ...

Microsoft Exchange Server Spoofing Vulnerability (CNVD-2021-28797)

Microsoft Exchange Server is the United States Microsoft Microsoft company's set of e-mail service program. It provides e-mail access, storage, forwarding, voice mail, e-mail filtering and screening. A spoofing vulnerability exists in Microsoft Exchange Server. No detailed vulnerability details a...

Bolt Directory Traversal Vulnerability

Bolt is a simple CMS written in PHP. A directory traversal vulnerability exists in Controller/Backend/FileEditController.php and Controller/Backend/FilemanagerController.php in versions of Bolt prior to 4.1.13. No detailed vulnerability details are provided at this time...

Cisco RV110W/RV130/RV130W/RV215W Remote Command Execution and Denial of Service Vulnerability (CNVD-2021-41220)

The Cisco RV110W is a Wireless-N VPN firewall, the Cisco RV130 is a multifunction VPN router, the Cisco RV130W is a Wireless-N multifunction VPN router, and the Cisco RV215W is a Wireless-N VPN router. A remote command execution and denial of service vulnerability exists in the Web management...

Unspecified vulnerability in Red Hat keycloak (CNVD-2021-19381)

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. Red Hat Keycloak has a security vulnerability that originates from the exploitation of the Client Registration API, which can be exploited by a...

JerryScript ecma_is_lexical_environment buffer overflow vulnerability

JerryScript is a lightweight JavaScript engine from the JerryScript project. jerryScript ecmaislexicalenvironment has a buffer overflow vulnerability that can be exploited by attackers to submit special requests that can crash an application or execute arbitrary code...

AnyDesk Formatting String Error Vulnerability

FreeBSD is a set of Unix-like operating systems from the FreeBSD Foundation. A format string error vulnerability exists in AnyDesk versions prior to 5.5.3 Linux and FreeBSD platforms. A remote attacker could exploit this vulnerability to execute code...

Ruby on Rails Cross-Site Request Forgery Vulnerability (CNVD-2020-32423)

Ruby on Rails is a set of Rails team based on the Ruby language open source Web application framework. A cross-site request forgery vulnerability exists in Ruby on Rails versions prior to 5.2.5 and 6.0.4, which stems from a WEB application that does not adequately validate that a request is comin...

Sensio Labs Symfony Competitive Conditions Issue Vulnerability

Sensio Labs Symfony is a free French Sensio Labs , based on the MVC architecture of the PHP development framework . The framework provides commonly used functional components and tools , can be used to quickly create complex WEB program . A competitive condition issue vulnerability exists in Sens...

rack-cors gem for Ruby directory traversal vulnerability

rack-cors is Rack middleware for handling cross-domain resource sharing CORS. A directory traversal vulnerability in the rack-cors gem for Ruby prior to version 1.0.4, which stems from resource matching failing to ensure that pathnames are in a canonical format, can be exploited by an attacker to...

Magento cross-site scripting vulnerability (CNVD-2019-40746)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. Magento has a cross-site scripting vulnerability. Attackers can use this vulnerability to execute client-side cod...

Cisco Adaptive Security Appliance Software and Cisco Firepower Threat Defense Digital Error Vulnerability

Cisco Firepower Threat Defense FTD and Cisco Adaptive Security Appliances Software ASA Software are both products of Cisco, Inc.Cisco Firepower Threat Defense is a set of unified software that provides next-generation firewall services. Defense is a set of unified software to provide...

Oracle Fusion Middleware BI Publisher Information Disclosure Vulnerability

Oracle Fusion Middleware Oracle Fusion Middleware is a set of Oracle's Oracle business innovation platform for enterprise and cloud environments. The platform provides middleware, software collection and other functions. BI Publisher formerly known as XML Publisher is one of the reporting...

Microsoft Exchange Server Information Disclosure Vulnerability (CNVD-2019-14452)

Microsoft Exchange Server is a set of e-mail service programs from Microsoft, which provides e-mail access, storage, forwarding, voice mail, e-mail filtering and screening. An information disclosure vulnerability exists in Microsoft Exchange Server, which can be exploited by a remote attacker to...

Apache Syncope Cross-Site Scripting Vulnerability

Apache Syncope is an open source system for managing digital identities in enterprise environments, implemented using Java EE technology and released under the Apache 2.0 license. A stored cross-site scripting vulnerability exists in Apache Syncope. A malicious user with sufficient administrative...

AirTies Air 5453 Cross-Site Scripting Vulnerability

AirTies Air 5453 is a wireless router product from Airties Turkey. A cross-site scripting vulnerability exists in the AirTies Air 5453. A remote attacker can exploit this vulnerability by sending the 'productboardtype' parameter to the top.html page to inject arbitrary web script or HTML...

Red Hat WildFly IIOP OpenJDK Subsystem Unauthorized Operation Vulnerability

Red Hat Wildfly formerly known as JBoss Application Server is the United States Red Hat Red Hat a JavaEE-based open source application server. IIOP OpenJDK subsystem is one of the Java-based subsystem. A security vulnerability exists in the IIOP OpenJDK subsystem in Red Hat WildFly versions prior...

OpenCV 'cv::PxMDecoder::readData' function buffer overflow vulnerability

OpenCV is an open source, cross-platform, lightweight computer vision library. A buffer overflow vulnerability exists in the 'cv::PxMDecoder::readData' function of the grfmtpxm.cpp file in OpenCV version 3.3.1, which stems from the program using incorrect size values. An attacker could exploit th...

Flexense Sync Breeze Enterprise Buffer Overflow Vulnerability

Flexense Sync Breeze Enterprise is a set of file synchronization tools from Flexense Canada. The tool has features such as file management and data synchronization. A buffer overflow vulnerability exists in Flexense Sync Breeze Enterprise version 10.0.28. A remote attacker could exploit this...

vtiger Company Logo Upload Arbitrary Command Execution Vulnerability

vtiger CRM is a Web-based sales force automation SFA based customer relationship management system CRM. A security vulnerability exists in the logo upload function in the vtiger CRM SettingsVtigerCompanyDetailsSaveAction class, which allows authenticated users to upload arbitrary files and execut...

Google Android Stagefright Integer Overflow Vulnerability

Stagefright is a media playback service for Android. Stagefright for Google Android suffers from an integer overflow vulnerability when malformed media files are present, which can be exploited by an attacker to execute arbitrary code on an affected device...

Google Android elevation of privilege vulnerability (CNVD-2026-13144)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that is caused by a lock screen bypass due to competing conditions in multiple functions of KeyguardViewMediator.java. An attacker can exploit the...

D-Link Nuclias Connec Login Endpoint Observable Response Discrepancy Vulnerability

D-Link Nuclias Connect is a network management software from D-Link for centralized management of wireless access points APs, supporting multi-device remote control and reporting capabilities. D-Link Nuclias Connect suffers from an observable response difference vulnerability that stems from the...

WordPress Backup Bolt plugin Arbitrary File Download Vulnerability

WordPress Backup Bolt plugin is a backup plugin for WordPress websites, mainly used to automate the backup of website data including files, databases, etc., and support the recovery function. WordPress Backup Bolt plugin has an arbitrary file download vulnerability, which stems from a flaw in the...

DELL iDRAC Service Module Code Execution Vulnerability

The DELL iDRAC Service Module is a lightweight software service on Dell servers that is primarily used to enhance the functionality of iDRAC Integrated Dell Remote Control Card and improve server management efficiency by consolidating operating system information. A code execution vulnerability...

Freescout Helper::decrypt() function deserialization vulnerability

FreeScout is an open source helpdesk system built on the PHP Laravel framework, designed to provide users with functionality similar to Zendesk or Help Scout, but without sacrificing privacy or freedom. Freescout suffers from a deserialization vulnerability that stems from an application that...

MB CONNECT LINE mbNET.mini SQL Injection Vulnerability

The mbNET.mini from MB CONNECT LINE is an industrial router designed for industrial scenarios and is primarily used to enable secure remote connections to machines and systems. MB CONNECT LINE mbNET.mini suffers from a SQL injection vulnerability that stems from improper neutralization of special...