mruby buffer overflow vulnerability (CNVD-2022-12753)

mruby is a lightweight implementation of the Ruby language. mruby suffers from a buffer overflow vulnerability that stems from a read timeout in versions of mruby prior to 3.2. An attacker could exploit this vulnerability to cause a buffer overflow or heap overflow, among other things...

Jenkins Doktor Plugin Proxy Controller Security Bypass Vulnerability

Jenkins plug-ins are plug-ins that provide appropriate functionality for Jenkins. The Jenkins Doktor Plugin Agent Controller security bypass vulnerability can be exploited to allow an attacker to take control of the agent process to determine if a file with a given name exists...

Jenkins Generic Webhook Trigger Plugin跨站脚本漏洞

Jenkins is a Jenkins open source application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.A cross-site scripting vulnerability exists in Jenkins Generic Webhook Trigger Plugin 1.81 and earlier versions, which...

Jenkins Checkmarx Plugin Cross-Site Request Forgery Vulnerability

Jenkins plug-ins are plug-ins that provide appropriate functionality for Jenkins. Jenkins Checkmarx Plugin cross-site request forgery vulnerability. The vulnerability can be exploited by an attacker to connect to an attacker-specified web server via an attacker-specified credential ID to capture...

Google TensorFlow buffer overflow vulnerability (CNVD-2022-11509)

Google TensorFlow is an end-to-end open source platform for machine learning from Google Google. Google Tensorflow has a buffer overflow vulnerability that stems from the fact that Dequantize's implementation does not fully validate the value of axis, which can be exploited by an attacker to caus...

WordPress NextScripts:Social Networks Auto-Poster插件跨站脚本漏洞

NextScripts:Social Networks Auto-Poster WordPress plugin is vulnerable to a cross-site scripting vulnerability in versions prior to 4.3.24. The vulnerability stems from the fact that log requests are not escaped before being exported to the relevant administrative The vulnerability stems from the...

iTunesRPC-Remastered Path Traversal Vulnerability

iTunesRPC-Remastered is a rich discordant state application used with iTunes and Apple Music. iTunesRPC-Remastered suffers from a path traversal vulnerability that stems from iTunesRPC-Remastered not properly sanitizing user input for file deletion. An attacker could exploit this vulnerability to...

Insyde InsydeH2O has an unspecified vulnerability (CNVD-2022-10283)

Insyde InsydeH2O is a C source from Insyde Software Taiwan, China that implements the new technology "EFI/UEFI" specification, designed to replace the legacy BIOS Basic Input/Output System. The vulnerability can be exploited to read or write or manipulate data to SMRAM, resulting in an escalation...

Insyde InsydeH2O Buffer Overflow Vulnerability (CNVD-2022-10280)

Insyde InsydeH2O is a C source from Insyde Software Taiwan, China that implements the new technology "EFI/UEFI" specification, designed to replace the traditional BIOS Basic Input/Output System. Operating System H2O UEFI firmware suffers from a buffer overflow vulnerability that could be exploite...

Linux kernel denial-of-service vulnerability (CNVD-2022-68576)

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. Linux kernel is vulnerable to a denial-of-service vulnerability caused by a flaw in the sctpmakestrresetreq function in net/sctp/smmakechunk. A locally authenticated attacker can exploit this flaw to cau...

Oracle MySQL Cluster Buffer Overflow Vulnerability (CNVD-2022-07922)

Oracle MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database developed by Oracle Corporation. Oracle MySQL Cluster is vulnerable to a buffer overflow vulnerability that could be exploited by an attacker to read the contents of memory or crash the application...

Oracle MySQL Cluster Input Validation Error Vulnerability (CNVD-2022-07923)

Oracle MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database developed by Oracle Corporation. Oracle MySQL Cluster is vulnerable to an input validation error, which can be exploited by attackers to execute arbitrary code...

FlexNet Unauthorized Access Vulnerability

An unauthorized access vulnerability exists in FlexNet 2020 R2.5 and prior versions of FlexNet, a software license manager from Flexera, Inc. of Chicago, USA. An attacker could exploit this vulnerability to modify other restricted files after passing local authentication...

Oracle MySQL Cluster Buffer Overflow Vulnerability (CNVD-2022-07917)

Oracle MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database developed by Oracle Corporation USA. Oracle MySQL Cluster buffer overflow vulnerability can be exploited by attackers to read the contents of memory or crash the application...

wasmcloud-otp has an unspecified vulnerability

wasmcloud-otp is a wasmCloud server process that securely hosts and provides scheduling for participants and capability providers. wasmcloud-otp suffers from a security vulnerability that stems from the fact that in versions prior to 0.52.2, participants can bypass capability authorization. No...

JerryScript has an unspecified vulnerability (CNVD-2022-07240)

JerryScript, a lightweight JavaScript engine from the JerryScript project, is vulnerable in JerryScript 3.0.0, which originates in /base/ecma-helpers.cecmagetlexenvtype An assertion ecmaislexicalenvironment objectp fails at /base/ecma-helpers.c ecmagetlexenvtype. No detailed vulnerability details...

microweber information disclosure vulnerability (CNVD-2022-08215)

Microweber is an online store management system from the Microweber community in the United States that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. microweber has an information disclosure vulnerability, which stems from errors in the...

GNU Recutils Resource Management Error Vulnerability

GNU Recutils is a GNU community tool and library for accessing recfiles plain text databases. GNU Recutils has security vulnerabilities that can be exploited by attackers to cause segmentation errors or application crashes...

snipe-it Access Control Error Vulnerability (CNVD-2022-08381)

Snipe-IT is an open source IT asset/license management system. snipe-it is vulnerable to an access control error, which stems from the presence of improper access controls in the software. No details of the vulnerability are currently available...

WordPress Modal Window plugin cross-site request forgery vulnerability

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The WordPress Modal Window plugin was vulnerable to cross-site request forgery prior to 5.2.2. The vulnerability stems from the plugin's failure to effectively filter calls to remote file resources...

WordPress Button Generator Plugin File Inclusion Vulnerability

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The WordPress Button Generator Plugin has a file inclusion vulnerability prior to 2.3.3. The vulnerability stems from the fact that the plugin does not effectively filter calls to remote file...

Google Android Elevation of Privilege Vulnerability (CNVD-2022-16343)

Google Android is a Linux-based open-source operating system from the US company Google. Google Android elevation of privilege vulnerability can be exploited by attackers to elevate privileges...

Adobe Acrobat and Reader Resource Management Error Vulnerability

Adobe Acrobat, a PDF file editing and conversion tool from Adobe, is vulnerable to a resource management error in Adobe Acrobat and Reader, which is caused by a post-release usage error when processing PDF files. A remote attacker could exploit the vulnerability to create a specially crafted PDF...

Google Android Input Validation Error Vulnerability (CNVD-2022-06151)

Google Android is a Linux-based open source operating system from Google, Inc. Google Android 11 is vulnerable to an input validation error, which stems from a network system or product that does not properly validate input data. No details of the vulnerability are currently available...

Kalkitech Sync Products Encryption Issue Vulnerability

Kalkitech Sync Products is a range of substation gateways from Kalkitech India. Kalkitech Sync Products suffers from an encryption issue vulnerability that stems from the use of an insecure communication channel by the management tools Easyconnect and SYNC devices, which can be exploited by an...

Spinnaker Path Traversal Vulnerability

Spinnaker is a continuous delivery platform. Used to release software changes with high speed and confidence. Spinnaker suffers from a path traversal vulnerability that arises from a networked system or product that fails to properly filter for specific elements in a resource or file path. An...

AbanteCart Cross-Site Scripting Vulnerability (CNVD-2021-102795)

AbanteCart is a PHP-based e-commerce platform. AbanteCart 1.3.2 previously had a security vulnerability that could be exploited by attackers to conduct DOM-based XSS attacks...

GPAC double release vulnerability

GPAC is an open source multimedia framework. version 1.0.1 of GPAC has a double-release vulnerability in filedump.c, which can be exploited by attackers to cause a denial of service with the help of a specially crafted MP4Box command...

IBM Business Automation Workflow Cross-Site Scripting Vulnerability (CNVD-2022-15537)

IBM Business Automation Workflow is a workflow automation solution from IBM USA. The product is primarily used for workflow management, compliance management, and features workflow visibility and scalability.IBM Business Automation Workflow has a security vulnerability that stems from the...

Motorola Solutions Avigilon Cross-Site Scripting Vulnerability

Motorola Solutions Avigilon is a series of security cameras from Motorola Solutions, U.S. A cross-site scripting vulnerability exists in Motorola Solutions Avigilon, which stems from a lack of data validation filtering of user-supplied data and output. An attacker could exploit this vulnerability...

Adobe Premiere Rush Code Execution Vulnerability (CNVD-2021-101125)

Adobe Premiere Rush is a set of cross-platform video editing software from the U.S. company Audobee Adobe. A security vulnerability exists in Adobe Premiere Rush, which can be exploited by an attacker to execute arbitrary code on the system...

Bentley View Buffer Overflow Vulnerability (CNVD-2021-101861)

Bentley View is a free viewer from Bentley Systems, U.S.A. Bentley View is vulnerable to a buffer error vulnerability that stems from a boundary error when processing JT files. An attacker could exploit this vulnerability to execute code in the context of the current process...

Bentley View Buffer Overflow Vulnerability (CNVD-2021-101860)

Bentley View is a free viewer from Bentley Systems, U.S.A. Bentley View is vulnerable to a buffer overflow vulnerability that stems from a boundary error when processing JT files. An attacker could exploit this vulnerability to execute code in the context of the current process...

Adobe Bridge out-of-bounds read vulnerability (CNVD-2021-99773)

Adobe Bridge is a file viewer from Adobe. 11.1.1 and earlier versions of Adobe Bridge contain an out-of-bounds read vulnerability. An attacker could exploit this vulnerability to cause a memory leak...

Librenms path traversal vulnerability

Librenms is a Librenms community of open source network monitoring system based on PHP and MySQL. The system features custom alerts, automatic discovery of network environments and automatic updates.Librenms suffers from a path traversal vulnerability that stems from Librenms 21.11.0 being affect...

Fortinet FortiClient Elevation of Privilege Vulnerability (CNVD-2021-102008)

FortiClient is a mobile endpoint security solution from Fortinet, Inc. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance, and two-factor authentication when connected to a FortiGate firewall appliance.FortiClient is vulnerable to an elevation of privilege...

Google TensorFlow code issue vulnerability (CNVD-2022-09869)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow has a code issue vulnerability that can be exploited by an attacker to cause the program to crash...

Microsoft Azure Information Disclosure Vulnerability (CNVD-2021-100792)

Microsoft Azure is an open, enterprise-class cloud computing platform from Microsoft Corporation USA. Microsoft Azure has a security vulnerability. No details of the vulnerability are currently available...

Metabase Information Disclosure Vulnerability

Metabase is an open source data analysis platform from Metabase, Inc. An information disclosure vulnerability exists in Metabase, which stems from a lack of permission validation in the product's admin-settings-maps-custom maps-add a map operation. An attacker could obtain sensitive information...

jsonpointer type obfuscation vulnerability

jsonpointer is an open source package for simple JSON addressing. jsonpointer suffers from a security vulnerability that stems from improper design or implementation during the development of code for a web-based system or product. No details of the vulnerability are currently available...

Boston Scientific ZOOM LATITUDE Programmer/Recorder/Monitor (PRM) Model 3120 has an unspecified vulnerability

The Boston Scientific ZOOM LATITUDE Programmer/Recorder/Monitor PRM Model 3120 is a portable cardiac rhythm management Crm programming system from Boston Scientific, Inc. The Boston Scientific ZOOM LATITUDE Programmer/Recorder/Monitor PRM Model 3120 contains a security vulnerability that could be...

Mozilla Firefox command injection vulnerability

Mozilla Firefox is an open source Web browser from the Mozilla Foundation in the U.S. A security vulnerability exists in Mozilla Firefox, which stems from a failure to display an executable warning when downloading an inetloc file that can run commands on a user's computer. No details of the...

Google Android Framework Information Disclosure Vulnerability (CNVD-2021-101440)

Android is a Linux-based open source operating system developed by Google Inc. and the Open Handheld Alliance OHA for short. an information disclosure vulnerability exists in the Framework component of Google Android versions 9, 10 and 11. No detailed vulnerability details are available...

Google Android System Remote Code Execution Vulnerability (CNVD-2021-101435)

Android is a Linux-based open source operating system developed by Google and the Open Handheld Alliance OHA for short...

Google Android System Denial of Service Vulnerability (CNVD-2021-101429)

Android is a Linux-based open source operating system developed by Google Inc. and the Open Handheld Alliance OHA. a denial-of-service vulnerability exists in the System component of Google Android versions 9, 10 and 11, which could be exploited by attackers to cause a denial of service...

GitLab Information Disclosure Vulnerability (CNVD-2021-84596)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An information disclosure vulnerability exists in GitLab...

Adobe XMP Toolkit SDK Stack Buffer Overflow Vulnerability (CNVD-2021-91984)

Adobe XMP Toolkit SDK is a tagging technology from Adobe that allows you to embed data about a file called metadata into the file itself.Adobe XMP Toolkit SDK 2021.07 and earlier versions are vulnerable to a stack buffer overflow. An attacker could exploit this vulnerability to execute arbitrary...

Adobe Bridge Memory Corruption Vulnerability (CNVD-2022-67851)

Adobe Bridge is a free digital asset management application from Adobe. 11.1.1 and earlier versions of Adobe Bridge contain a memory corruption vulnerability that could be exploited by attackers to execute arbitrary code in the context of the current user...

Advantech WebAccess Heap Buffer Overflow Vulnerability

Advantech WebAccess is Advantech's suite of HMI/SCADA software based on browser architecture. A heap buffer overflow vulnerability exists in Advantech WebAccess 9.02 and earlier versions. An attacker could exploit this vulnerability to remotely execute code...

Django Cross-Site Scripting Vulnerability (CNVD-2022-31939)

Django is the Django Foundation's set of open source web application framework based on the Python language. The framework includes an object-oriented mapper, view system, template system, etc. Django's Unicorn framework in version 0.35.3 and earlier has a cross-site scripting vulnerability that...