Cisco Identity Services Engine Cross-Site Scripting Vulnerability (CNVD-2024-06170)

Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. A cross-site scripting vulnerability exists in...

Hospital Management System SQL Injection Vulnerability

A Hospital Management System HMS is a computerized system that helps manage healthcare-related information and helps healthcare providers do their jobs effectively. Hospital Management System V4.0 and prior versions suffer from a SQL injection vulnerability that stems from the application's lack ...

Siemens JT2Go and Teamcenter Visualization null pointer dereference vulnerability (CNVD-2024-01392)

JT2Go is a JT file viewer.Teamcenter Visualization is a software that provides teamwork capabilities for designing 2D and 3D scenarios. A null pointer dereference vulnerability exists in Siemens JT2Go and Teamcenter Visualization, which can be exploited by an attacker to cause the application to...

ZZCMS File Upload Vulnerability (CNVD-2024-06241)

ZZCMS is a content management system CMS by the ZZCMS team in China. A file upload vulnerability exists in ZZCMS version 2023, which stems from the lack of valid validation of uploaded files in /Ebak5.1/upload/index.php. An attacker can exploit this vulnerability to gain server privileges and...

IBM AIX and VIOS Elevation of Privilege Vulnerability (CNVD-2023-10015306)

IBM AIX is an open standards-based UNIX operating system developed by International Business Machines IBM for the IBM Power architecture. An elevation of privilege vulnerability exists in IBM AIX and VIOS, which can be exploited by an attacker to gain elevated privileges...

Siemens User Management Component (UMC) Cross-Site Scripting Vulnerability

Opcenter Quality is a quality management system QMS that enables organizations to safeguard compliance, optimize quality, reduce the cost of defects and rework, and achieve operational excellence by improving process stability. simatic pcs neo is a distributed control system DCS. the SINUMERIK...

Siemens SCALANCE M-800/S615 Series OS Command Injection Vulnerability

The SCALANCE M-800, MUM-800 and S615 and the RUGGEDCOM RM1224 are industrial routers. An operating system command injection vulnerability exists in the Siemens SCALANCE M-800/S615 series, which can be exploited by an attacker to execute commands on the system via a malicious local administrator...

Siemens Web Server Denial of Service Vulnerabilities in Various Products

SIMATIC PC Station is a software component that manages SIMATIC software products and interfaces on a PC.SIMATIC S7-400 controllers are designed for discrete and continuous control in industrial environments such as manufacturing, food and beverage, and chemical industries around the world. A...

ThinkAdmin Code Execution Vulnerability

ThinkAdmin is a general purpose backend management system based on the ThinkPHP framework. A security vulnerability exists in ThinkAdmin version v6.1.53, which originates from allowing arbitrary file uploads. An attacker can exploit the vulnerability to execute arbitrary code via a specially...

Foxit Reader Code Execution Vulnerability (CNVD-2023-96089)

Foxit Reader is a Chinese Foxit Foxit company's a PDF document reader. A code execution vulnerability exists in Foxit Reader prior to version 12.1.3.15356 due to a flaw in the Javascript saveAs API. An attacker could exploit this vulnerability to execute arbitrary code on the system...

Multiple Siemens products use hard-coded encryption key vulnerability

The SCALANCE M-800, MUM-800 and S615 and the RUGGEDCOM RM1224 are industrial routers.The SCALANCE W products are wireless communication devices for connecting industrial components, such as Programmable Logic Controllers PLCs or Human Machine Interfaces HMIs, that comply with the IEEE 802.11...

Siemens Mendix Authentication Bypass Vulnerability

Mendix is a high-productivity application platform for building and continuously improving mobile and web applications at scale. An authentication bypass vulnerability exists in Siemens Mendix, which can be exploited by an attacker to access or modify objects without proper authorization or to...

Google Android Information Disclosure Vulnerability (CNVD-2024-10421)

Google Android is a Linux-based open source operating system from Google. Google Android has an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

Open5GS Access Control Error Vulnerability

Open5GS is an open source implementation in C of 5G Core and Epc, the core network of the Lte/Nr network. An Access Control Error vulnerability exists in Open5GS version 2.4.10 and earlier, which stems from a lack of authentication, and can be exploited by an attacker to send an HTTP request to a...

FreeImage load function buffer overflow vulnerability

FreeImage is a cross-platform open source library for supporting popular graphic image formats. A buffer overflow vulnerability exists in the FreeImage load function that can be exploited by an attacker to execute arbitrary code on a system or cause a denial of service attack...

Google Chrome Data Forgery Problem Vulnerability (CNVD-2023-65156)

Google Chrome is a web browser from Google, an American company. A data forgery issue vulnerability exists in Google Chrome prior to version 116.0.5845.96, which stems from insufficient data validation of Systems Extensions, and can be exploited by a remote attacker to bypass file restrictions vi...

HTMLDOC buffer overflow vulnerability (CNVD-2023-67081)

HTMLDOC is an open source program that can convert HTML and Markdown files to EPUB, Indexed HTML, PostScript and PDF formats. HTMLDOC version 1.9.12 suffers from a buffer overflow vulnerability that stems from an out-of-bounds flaw found in the parsetree function of toc.cxx, which results in the...

ASUS RT-AX88U Cross-Site Scripting Vulnerability (CNVD-2023-63441)

The ASUS RT-AX88U is a wireless router from Asus China. The ASUS RT-AX88U suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data by the Custom User Icons feature, which can be exploited by an attacker to perform a store...

Microsoft Excel Code Execution Vulnerability (CNVD-2023-80162)

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. A code execution vulnerability exists in Microsoft Office Excel, which can be exploited by an attacker to execute arbitrary code on a system...

Siemens RUGGEDCOM ROX cross-site scripting vulnerability (CNVD-2023-55710)

RUGGEDCOM products offer a degree of robustness and reliability that sets the standard for communication networks deployed in harsh environments. A cross-site scripting vulnerability exists in Siemens RUGGEDCOM ROX, which can be exploited by attackers to execute malicious javascript code by...

Nacos Jraft Hessian Deserialization Vulnerability

Nacos is an acronym for Dynamic Naming and Configuration Service, a dynamic service discovery, configuration management and service management platform that makes it easier to build cloud-native applications. A deserialization vulnerability exists in Nacos Jraft Hessian, which can be exploited by...

ASUS RT-AC86U OS Command Injection Vulnerability

The ASUS RT-AC86U is a dual-band Wi-Fi router from the Chinese company ASUS. The ASUS RT-AC86U suffers from an operating system command injection vulnerability that originates from not filtering the special characters of parameters in specific URLs, which can be exploited by a remote attacker wit...

Trend Micro Apex Central Cross-Site Scripting Vulnerability (CNVD-2023-57662)

Trend Micro Apex Central is a Web-based console from Trend Micro, Inc. A cross-site scripting vulnerability exists in Trend Micro Apex Central, which can be exploited by an attacker to inject malicious script or HTML code...

NETGEAR SRX5308 Cross-Site Scripting Vulnerability

The NETGEAR SRX5308 is a VPN firewall appliance from NETGEAR. The NETGEAR SRX5308 suffers from a cross-site scripting vulnerability that originates from an incorrect operation of the parameter sysLogInfo.serverName, which can be exploited by an attacker to obtain sensitive information such as use...

ChurchCRM CSV Injection Vulnerability

ChurchCRM is an open source CRM system for churches. ChurchCRM v4.5.3 suffers from a CSV injection vulnerability that stems from improperly neutralizing a formula element via the last name and first name input fields when creating a new account, which can be exploited by an attacker to execute...

Google Chrome Memory Misreference Vulnerability

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in versions prior to Google Chrome 112.0.5615.137, which stems from a confusion in the directive responsible for freeing memory in DevTools. An attacker could use this vulnerability to caus...

Schneider Electric StruxureWare Data Center Expert Access Control Error Vulnerability (CNVD-2023-37593)

Schneider Electric StruxureWare Data Center Expert is a monitoring software from the French company Schneider Electric Schneider Electric. It is suitable for a variety of organizations to monitor their company-wide power, cooling, security, and environment. An access control error vulnerability...

Google Android Information Disclosure Vulnerability (CNVD-2023-26068)

Google Android is a Linux-based open source operating system from Google. Google Android has an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

Fortinet FortiWeb has an unspecified vulnerability (CNVD-2023-18296)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. A security vulnerability exists that could b...

wallabag licensing issue vulnerability (CNVD-2023-07920)

wallabag is a web application that allows you to save web pages for later reading. wallabag versions prior to 2.5.3 contain an authorization issue vulnerability that could be exploited by attackers to update other users' comments...

Siretta QUARTZ-GOLD buffer overflow vulnerability (CNVD-2023-17030)

The Siretta QUARTZ-GOLD is a high-speed industrial router from Siretta. A buffer overflow vulnerability exists in Siretta QUARTZ-GOLD version G5.0.1.5-210720-141020, which can be exploited by an attacker to execute arbitrary commands...

Moxa SDS-3008 cross-site scripting vulnerability (CNVD-2023-58304)

Moxa SDS-3008 is a series of industrial switches from MOXA China. The Moxa SDS-3008 suffers from a cross-site scripting vulnerability that can be exploited by an attacker to send a specially crafted HTTP request resulting in arbitrary Javascript execution...

IBM AIX has an unspecified vulnerability (CNVD-2023-05472)

IBM AIX is an open standards-based UNIX operating system developed by International Business Machines IBM for the IBM Power architecture. IBM AIX has a security vulnerability that stems from a buffer overflow caused by a non-privileged local user exploiting a vulnerability in X11, resulting in a...

Lead Management System SQL Injection Vulnerability (CNVD-2023-05740)

Lead management system is a lead management system developed by Mayuri K. The Lead Management System v1.0 version is vulnerable to SQL injection, which stems from the lack of validation of external input SQL statements in the userid parameter of changePassword.php. An attacker could use this...

Microsoft Office Visio Remote Code Execution Vulnerability (CNVD-2023-18289)

Microsoft Office is a suite of office software based on the Windows operating system developed by Microsoft. A remote code execution vulnerability exists in Microsoft Office Visio. An attacker could exploit this vulnerability to execute code on the target host...

Microsoft Exchange Server Spoofing Vulnerability (CNVD-2023-51373)

Microsoft Exchange Server is the United States Microsoft Microsoft company's set of e-mail service program. It provides e-mail access, storage, forwarding, voice mail, e-mail filtering and screening. A spoofing vulnerability exists in Microsoft Exchange Server, which can be exploited by attackers...

Google Android elevation of privilege vulnerability (CNVD-2023-18913)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by an attacker to gain elevated privileges on the system...

TRENDnet TEW-755AP stack overflow vulnerability (CNVD-2023-18939)

The TRENDnet TEW-755AP is a router from TRENDnet. A stack overflow vulnerability exists in TRENDnet TEW-755AP version 1.13B01, which stems from a lack of size checking of input data in the comeo.comeo.nslookuptarget parameter of the toolsnslookup function, which can be exploited by an attacker to...

OpenImageIO Code Execution Vulnerability (CNVD-2023-01793)

A code execution vulnerability exists in the IFFOutput::close function of OpenImageIO v2.4.4.2, an image read/write library that also provides tools and applications. An attacker could use this vulnerability to cause a heap buffer overflow via a specially crafted ImageOutput object when the "ymax...

Apache Zeppelin input validation error vulnerability

Apache Zeppelin is a Web-based open source notebook application from the Apache Foundation that supports interactive data analysis and collaborative documentation. Apache Zeppelin is vulnerable to an input validation error that results from improper input validation in its Move folder to Trash...

Siemens SCALANCE X-200RNA Switch Devices Uncontrolled Resource Consumption Vulnerability (CNVD-2022-87967)

The SCALANCE X-204RNA Industrial Ethernet Access Point enables non-PRP end devices to connect to separate parallel networks where required. An uncontrolled resource consumption vulnerability exists in Siemens SCALANCE X-200RNA Switch Devices, which can be exploited by an attacker to cause a denia...

Google Android Denial of Service Vulnerability (CNVD-2022-89772)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from a denial of service vulnerability that can be exploited by attackers to cause a denial of service...

Permission Design Vulnerability in Chocolatey Ruby

Chocolatey is a NuGet-based package manager developed for Windows systems.Ruby is a cross-platform, object-oriented, dynamically-typed programming language developed by the individual developer Yukihiro Matsumoto. A privilege design vulnerability exists in the Chocolatey Ruby package v3.1.2.1 and...

Google Chrome Security Bypass Vulnerability (CNVD-2023-08260)

Google Chrome is a web browser from Google, Inc. A security bypass vulnerability exists in Google Chrome, which is caused by insufficient policy enforcement in DevTools. An attacker could exploit this vulnerability to bypass security restrictions...

D-Link DIR-882 webGetVarString function buffer overflow vulnerability

D-Link DIR-882 is a wireless router from D-Link, China. D-Link DIR-882 firmware versions 1.10B02 and 1.20B06 contain a buffer overflow vulnerability that stems from a lack of length validation of input data in its webGetVarString function, which could be exploited to cause a denial of service or...

NETGEAR R7000P wan_dns1_pri Buffer Overflow Vulnerability

The NETGEAR R7000P is a wireless router from NETGEAR. A buffer overflow vulnerability exists in NETGEAR R7000P version V1.3.1.64, which originates from a lack of length validation of data entered in /usr/sbin/httpd for the wandns1pri parameter, and can be exploited by an attacker to cause a denia...

Command Execution Vulnerability in ZOHO ManageEngine ADManager Plus

ZOHO ManageEngine ADManager Plus is a suite of Microsoft Active Directory management software from ZOHO designed for enterprise users using Windows domains. The software assists AD administrators and helpdesk technicians with day-to-day administrative tasks, such as batch management of user...

Intel Data Center Manager Elevation of Privilege Vulnerability

Intel Data Center Manager is a software solution from Intel Corporation USA. The Intel Data Center Manager version 5.0 or earlier has an elevation of privilege vulnerability, which stems from a failure in the protection mechanism and can be exploited by attackers to elevate privileges...

Aruba Networks ArubaOS Input Validation Error Vulnerability

Aruba Networks ArubaOS, an operating system for Aruba Mobility-Defined Networks including mobile controllers and mobile access switches from Aruba Networks, is vulnerable to an input validation error. The vulnerability can be exploited to interrupt the normal operation of the affected access poin...

Corel CorelDRAW Graphics Suite buffer overflow vulnerability (CNVD-2023-29424)

Corel CorelDRAW Graphics Suite is a vector graphics creation tool from Corel. A buffer overflow vulnerability exists in Corel CorelDRAW Graphics Suite, which can be exploited by attackers to execute code in the context of the current process...