Bosch Ethernet switch PRA-ES8P2S Web service elevation of privilege vulnerability

Bosch Ethernet switch PRA-ES8P2S is a switch from Bosch, Germany.Bosch Ethernet switch PRA-ES8P2S Web service elevation of privilege vulnerability can be exploited by remote attackers to submit special requests that can elevate privileges to execute arbitrary commands in root context...

WordPress Ocean Extra plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. cross-site scripting vulnerability exists in versions prior to WordPress Ocean Extra plugin 1.9.5, which stem...

FFmpeg get_siz() function denial of service vulnerability

FFmpeg is a complete solution for recording, converting and streaming audio and video from the Ffmpeg team. A denial of service vulnerability exists in the FFmpeg getsiz function, which can be exploited by attackers to cause a denial of service attack...

WordPress Genki Pre-Publish Reminder plugin cross-site request forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

WordPress Filr plugin authorization issue vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An authorization issue...

Siemens EN100 Ethernet module内存损坏漏洞

Siemens EN100 Ethernet Module is an Ethernet module product from Siemens, Germany. Siemens EN100 Ethernet module is vulnerable to a memory corruption vulnerability that can be exploited by attackers to crash affected applications, resulting in a denial-of-service condition...

Samsung mobile SemIWCMonitor Information Disclosure Vulnerability (CNVD-2022-67281)

Samsung mobile is a cell phone from Samsung South Korea. samsung mobile SemIWCMonitor is vulnerable to an information disclosure vulnerability that stems from a configuration error in the network system or product during operation. An attacker could exploit this vulnerability to obtain MAC addres...

WordPress WP Born Babies plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress WP Born Babies plugin version 1.0 and prior versions contain a cross-site scripting vulnerability...

SialWeb CMS SQL Injection Vulnerability

SialWeb CMS is a content management system from SialWeb Pakistan. SQL injection vulnerability exists in SialWeb CMS, which can be exploited by attackers to manipulate the parameter Id to cause sql injection...

Online Ordering System SQL注入漏洞

Online Ordering System is a multi-store ordering system that can be used by any small business.An SQL injection vulnerability exists in Online Ordering System version 2.3.2, which originates from /ordering/admin/user/index.php?view=edit&id=page The lack of validation of externally entered SQL...

School Dormitory Management System SQL Injection Vulnerability

School Dormitory Management System is a school dormitory management system. SQL injection vulnerability exists in School Dormitory Management System, which can be exploited by attackers to conduct SQL injection attacks...

SAP Cloud Connector Cross-Site Scripting Vulnerability

SAP Cloud Connector is a connector for connecting to the SAP Cloud Platform from SAP Germany. A cross-site scripting vulnerability exists in SAP Cloud Connector version 2.0, which arises from a program that does not adequately encode user-controlled input, and can be exploited by an attacker with...

MediaWiki SQL Injection Vulnerability

MediaWiki is a set of web-based wiki engines from the U.S. Wikimedia MediaWiki Foundation. The product can be used to deploy internal knowledge management and content management systems. A security vulnerability exists in MediaWiki version 1.37.2 and earlier, which stems from a SemanticDrilldown...

Cisco TelePresence Collaboration Endpoint and RoomOS Software Denial of Service and Information Disclosure Vulnerability

Cisco RoomOS Software and Cisco TelePresence Collaboration Endpoint Software are both products of Cisco, a U.S. company. Cisco TelePresence Collaboration Endpoint Software is a set of collaboration endpoint software. cisco TelePresence Collaboration Endpoint and RoomOS Software has a denial of...

WordPress plugin Master Elements SQL injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress plugin Master Elements 8.0 and earlier versions are vulnerable to SQL injection, which stems from t...

Attendance and Payroll System SQL注入漏洞（CNVD-2022-33143）

Attendance and Payroll System is a PHP/MySQLi source code attendance and payroll system by oretnom23 individual developers. version v1.0 of Attendance and Payroll System is vulnerable to SQL injection, which originates from the component adminovertime delete.php lacks validation of external input...

FANUC ROBOGUIDE XML External Entity Injection Vulnerability

FANUC ROBOGUIDE is a robot simulation software from FANUC Japan. FANUC ROBOGUIDE v9.40083.00.05 and earlier versions exist XML external entity injection vulnerability, which originates from the lack of application restrictions on external entities. An attacker could exploit this vulnerability to...

WordPress WP Maintenance plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WordPress plugin is an application plugin. WordPress...

REDCap Cross-Site Scripting Vulnerability (CNVD-2022-81345)

A cross-site scripting vulnerability exists in versions of REDCap prior to 11.4.0, which stems from a lack of data validation filtering of user-supplied data and output in the missing data code functionality of the program. An attacker could exploit this vulnerability to execute JavaScript code o...

AeroCMS Cross-Site Scripting Vulnerability (CNVD-2022-30784)

AeroCMS is a content management system from AeroCMS, Inc. A cross-site scripting vulnerability exists in AeroCMS v0.0.1, which can be exploited to execute arbitrary Web script or HTML by injecting a specially crafted payload into the "comment" text field...

ZoneMinder Cross-Site Scripting Vulnerability (CNVD-2022-57819)

ZoneMinder is an open source video surveillance software system. The system supports IP, USB and analog cameras, etc. A cross-site scripting vulnerability exists in ZoneMinder 1.32.3 and earlier versions, which stems from the options.php file not validating the values of 'WEBTITLE, HOMEURL', '...

ZoneMinder Cross-Site Scripting Vulnerability (CNVD-2022-57834)

ZoneMinder is an open source video surveillance software system. The system supports IP, USB and analog cameras, etc. A cross-site scripting vulnerability exists in ZoneMinder 1.32.3 and prior versions, which stems from the fact that the program does not validate input or filter output, and can b...

Jenkins RocketChat Notifier Plugin跨站请求伪造漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.Jenkins RocketChat Notifier Plugin 1.4.10...

Joomla! information disclosure vulnerability (CNVD-2022-64097)

Joomla! is a set of forum components used in the Joomla! content management system. An information disclosure vulnerability exists in versions 3.0.0 through 3.10.6 and 4.0.0 through 4.1.0, which stems from an error caused by uploading a file name that is too long. The error displays a screen with...

Reolink Rlc-410W Denial of Service Vulnerability (CNVD-2022-37388)

Reolink Rlc-410W is a Wifi security camera from Reolink China.A denial of service vulnerability exists in Reolink RLC-410W, which can be exploited by attackers to cause a reboot via a compiled HTTP request...

Wordpress Plugin Paid Memberships Pro SQL Injection Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in Wordpress Plugin Paid Memberships Pro versions prior to 2.6....

WordPress Social Sharing plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress plugin is a WordPress open source application plugin . A cross-site scripting vulnerability exists in the...

Sophos UTM log information leakage vulnerability

Sophos UTM is a next-generation firewall. a security vulnerability existed prior to Sophos UTM 9.710, which stems from the fact that Confd log files contain SHA512crypt password hashes for local users including the root user with insecure access rights, which can be exploited by attackers to...

Moodle Access Control Error Vulnerability (CNVD-2022-54955)

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment. an access control error vulnerability exists in Moodle, which stems from improper access restrictions. A remote attacker could use the...

WordPress WooCommerce plugin SQL注入漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blogging sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. SQL injection vulnerability exists in versions of...

TP-Link Omada Controller Software Licensing Issue Vulnerability

TP-Link Omada Controller Software is a set of software from Tp-link that supports the management of wireless access points.TP-Link Omada Controller Software versions prior to 5.0.15 are vulnerable to authorization issues, which stem from a lack of authentication measures or insufficient...

Adobe After Effects Buffer Overflow Vulnerability (CNVD-2022-22099)

Adobe After Effects is a suite of visual effects and motion graphics software from Adobe, Inc. A buffer overflow vulnerability exists in Adobe After Effects, which stems from a failure to properly validate data boundaries when performing operations on memory, and can be exploited by remote...

Siemens RUGGEDCOM ROS has an unspecified vulnerability (CNVD-2022-17784)

Siemens RuggedCom ROS is an operating system used in the RuggedCom family of switches from Siemens, Germany. Siemens RUGGEDCOM ROS has a security vulnerability that could be exploited by attackers to act as a man-in-the-middle and eavesdrop on encrypted communications...

Elasticsearch permission permission and access control issues vulnerability

Elasticsearch is a set of open source distributed RESTful search engine built on Lucene from the Dutch company Elasticsearch. The product is mainly used in cloud computing and supports data indexing using JSON over HTTP. Elasticsearch is vulnerable to privilege permission and access control issue...

Fortinet FortiWLM Command Injection Vulnerability

A command injection vulnerability exists in Fortinet FortiWLC, a wireless LAN controller from Fortinet, which stems from a failure to properly validate input data in the alert dashboard and controller configuration handler. HTTP requests and execute arbitrary operating system commands on the targ...

Oracle VM VirtualBox Input Validation Error Vulnerability (CNVD-2022-25214)

Oracle VM VirtualBox is a virtual machine management software from Oracle. Oracle VM VirtualBox has an input validation error vulnerability that originates from an input validation error in the Core component. An attacker could exploit the vulnerability to access sensitive information...

Oracle MySQL Cluster Input Validation Error Vulnerability (CNVD-2022-17689)

Oracle MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database developed by Oracle Corporation. Oracle MySQL Cluster is vulnerable to an input validation error, which can be exploited by attackers to execute arbitrary code...

Pexip Infinity licensing issue vulnerability

Pexip Infinity is a cloud collaboration platform for video conferencing from Pexip, a Norwegian company. A security vulnerability exists in Pexip Infinity Connect versions prior to 1.8.0, which stems from the omission of certain resource provisioning authenticity checks. An attacker could exploit...

mruby buffer overflow vulnerability (CNVD-2022-11177)

mruby is a lightweight implementation of the Ruby language. buffer overflow exists in versions of Mruby prior to 3.2, and the vulnerability stems from a heap overflow in mrbfsend. An attacker could exploit this vulnerability to execute arbitrary code...

WordPress MapPress Maps plugin cross-site scripting vulnerability

WordPress is the WordPress Wordpress Foundation's set of blogging platforms developed using the PHP language. A cross-site scripting vulnerability exists in versions of the WordPress MapPress Maps plugin prior to 2.73.4. The vulnerability stems from the fact that the MapPress Maps plugin does not...

Samsung Wear OS has an unspecified vulnerability

Samsung Wear Os is a version of the Android operating system from the South Korean company Samsung. It is designed for wearable computer devices such as smartwatches. Wear OS has a security vulnerability that stems from allowing untrusted apps to fail to disable theater mode with proper...

Google Android Buffer Overflow Vulnerability (CNVD-2022-47682)

Google Android is a Linux-based open source operating system from Google, Inc. A buffer overflow vulnerability exists in Google Android, which originates in GKIgetbuf in gkibuffer.cc. Due to a heap buffer overflow, an out-of-bounds write may exist, and an attacker could use this vulnerability to...

Unspecified Vulnerability in Bentley Systems Bentley View (CNVD-2022-15836)

Bentley Systems Bentley View is a free viewer from Bentley Systems, USA. A security vulnerability exists in Bentley View that can be exploited by an attacker to execute code in the context of the current process...

WordPress WOOF plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed by the WordPress Foundation using the PHP language. WordPress WOOF plugin has a cross-site scripting vulnerability in versions prior to 1.2.6.3, which stems from the lack of escaping of woofredrawelements and can be exploited by attackers to...

Emlog Cross-Site Scripting Vulnerability (CNVD-2022-11528)

Emlog is a PHP and MySQL-based CMS website builder from Emlog personal developers. Emlog suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data by the WEB application. An attacker could use this vulnerability to execute JavaScript code ...

StarWind SAN

StarWind SAN & NAS is a standalone hypervisor server or group of servers for StarWind.A command injection vulnerability exists in StarWind SAN & NAS, which can be exploited by attackers to remotely execute code...

Unspecified Vulnerability in Google Tensorflow (CNVD-2022-09859)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow suffers from a security vulnerability that can be exploited by an attacker to cause a denial of service by changing the SavedModel so that it can be asserted in a function...

Reolink RLC-410W OS Command Injection Vulnerability (CNVD-2022-10726)

Reolink Rlc-410W is a Wifi security camera from Reolink China.The device network settings feature of Reolink RLC-410W v3.0.0.13620121102 is vulnerable to OS command injection, which can be exploited by attackers to cause OS command injection...

Siemens Simcenter Femap类型混淆漏洞

Siemens Simcenter Femap is a cutting-edge engineering simulation application from Siemens, Germany. It is used to create, edit and import/reuse mesh-based finite element analysis models of complex products or systems. Siemens Simcenter Femap is vulnerable to type obfuscation, which could be...

Denial of Service Vulnerability in Multiple Siemens Industrial Products (CNVD-2022-10003)

SIMATIC Drive Controller family products are machines designed for production automation, combining the functionality of the SIMATIC S7-1500 CPU and the SINAMICS S120 drive control.SIMATIC S7-1200 CPU family products are designed for discrete and continuous control in industrial environments such...