Google Chrome V8 Out-of-Bounds Write Vulnerability

Google Chrome is a web browser of Google Google, U.S. V8 is one of the open source JavaScript engine. An out-of-bounds write vulnerability exists in V8 in versions prior to Google Chrome 74.0.3729.131. The vulnerability stems from a networked system or product that performs an operation in memory...

Freeware Advanced Audio Decoder 2 Buffer Overflow Vulnerability (CNVD-2019-05832)

Freeware Advanced Audio Decoder 2 FAAD2 is an open source MPEG-4 and MPEG-2 AAC decoder licensed under the GPLv2 license. A stack buffer overflow vulnerability exists in the third instance of the calculategain function in libfaad/sbrhfadj.c in Freeware Advanced Audio Decoder 2 FAAD2 2.8.8, which...

Dell OpenManage Network Manager Improper Access Control Vulnerability

Dell OpenManage Network Manager OMNM manages the entire lifecycle of heterogeneous network environments including Dell EMC, Cisco, HP, Arista, Juniper, Aruba, Brocade, SonicWALL, and more. An improper access control vulnerability exists in Dell OpenManage Network Manager, which can be exploited b...

Geist WatchDog Console Insecure File Permission Vulnerability

Geist WatchDog Console is a suite of environmental monitoring software from Geist USA. A security vulnerability exists in Geist WatchDog Console version 3.2.2 that stems from the program's use of weak access control lists for the C:ProgramDataWatchDog Console directory. A local attacker can explo...

MP4v2 Denial of Service Vulnerability

MP4v2 is an open source library written in C++ for handling MP4 containers. A security vulnerability exists in the MP4Atom class of the mp4atom.cpp file in MP4v2 2.0.0 and earlier versions, which stems from the program's failure to properly handle Entry Number validation. A remote attacker can...

Denial of service vulnerability in several Siemens industrial products (CNVD-2017-06151)

SIMATIC CP, SIMATIC RF600, SCALANCE W700, etc. are industrial automation products of Siemens, Germany. A denial of service vulnerability exists in several Siemens industrial devices. Allows an attacker to launch a denial of service attack via specially crafted PROFINET DCP packets sent on the loc...

Oracle VM VirtualBox Remote Vulnerability

Oracle Virtualization Oracle VirtualBox is a virtual machine component of Oracle's virtualization solution. A security vulnerability exists in the GUI subcomponent of the Oracle VM VirtualBox component in Oracle Virtualization. An attacker could exploit this vulnerability to compromise the...

Core Remote Elevation of Privilege Vulnerability

Joomla! is a PHP-based open source content management system CMS. Can be used to build commercial Web sites , personal blogs , information management systems , Web services , etc. , but also for secondary development to expand the scope of use . A remote elevation of privilege vulnerability exist...

NVIDIA Windows GPU Display Driver Local Elevation of Privilege Vulnerability

NVIDIA Windows GPU Display Driver is a set of graphics processor GPU graphics card drivers for Windows from NVIDIA. The NVIDIA Windows GPU Display Driver local elevation of privilege vulnerability stems from the program failing to properly validate pointers. A local attacker could use this...

Perl DBD::mysql module buffer overflow vulnerability

Perl is a free and powerful cross-platform programming language developed by American programmer Larry Wall.DBD::mysql is used for one of the MySQL Perl5 Database Interface Database Interface, DBI driver module. A buffer overflow vulnerability exists in the Perl DBD::mysql module prior to version...

Zend Framework Information Disclosure Vulnerability

Zend Framework ZF is the United States Zend company developed a set of open source PHP5 development framework. An information disclosure vulnerability exists in ZF. An attacker can exploit this vulnerability by performing a man-in-the-middle attack to impersonate a trusted server and obtain or...

CloudBees Jenkins CI and LTS Scripting Vulnerabilities

CloudBees Jenkins CI formerly known as Hudson Labs is a set of Java-based continuous integration tools from CloudBees, Inc. LTS Long-Term Support is a long-supported version of CloudBees Jenkins CI. A security vulnerability exists in the Combination filter Groovy script in CloudBees Jenkins CI...

Multiple Vulnerabilities in VLC Media Player

VLC Media Player is a popular multimedia playback program. VLC Media Player contains multiple unspecified vulnerabilities that could be exploited by attackers to construct malicious files that could be parsed by users, which could crash the application or execute code...

Zhengfang Software Co., Ltd.'s educational management system has logical defects and vulnerabilities

Positive Software Co., Ltd. hereinafter referred to as "Positive Company" was established in January 1999. It is a software and high-tech enterprise specialized in consulting, planning, construction, and services in the field of higher education informatization. The educational administration...

Google Android elevation of privilege vulnerability (CNVD-2026-13144)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that is caused by a lock screen bypass due to competing conditions in multiple functions of KeyguardViewMediator.java. An attacker can exploit the...

Fortinet FortiClient MacOS installer data forgery issue vulnerability

Fortinet FortiClient MacOS installer is a client installer from Fortinet. The Fortinet FortiClient MacOS installer suffers from a data forgery issue vulnerability that stems from improper cryptographic signature validation, which can be exploited by an attacker to cause elevation of privilege for...

WordPress Backup Bolt plugin Arbitrary File Download Vulnerability

WordPress Backup Bolt plugin is a backup plugin for WordPress websites, mainly used to automate the backup of website data including files, databases, etc., and support the recovery function. WordPress Backup Bolt plugin has an arbitrary file download vulnerability, which stems from a flaw in the...

Tenda AC6 fromSetRouteStatic function buffer overflow vulnerability

Tenda AC6 is a dual-band wireless router from Tenda. Tenda AC6 suffers from a buffer overflow vulnerability that stems from the list parameter in the fromSetRouteStatic function failing to properly validate the length size of the input data, no detailed vulnerability details are provided at this...

PDF-XChange Editor Information Disclosure Vulnerability (CNVD-2025-16293)

PDF-XChange Editor is a PDF-XChange company running on Microsoft Windows systems in the PDF file viewer software. An information disclosure vulnerability exists in PDF-XChange Editor, which is caused by a lack of proper validation of user-supplied data. An attacker could exploit this vulnerabilit...

TOTOLINK EX1200T /boafrm/formSysCmd File Buffer Overflow Vulnerability

The TOTOLINK EX1200T is a Wi-Fi range extender from China's Gion Electronics TOTOLINK. The TOTOLINK EX1200T suffers from a buffer overflow vulnerability, which originates from the failure of the parameter submit-url in the file /boafrm/formSysCmd to correctly validate the length and size of the...

Delta Electronics CNCSoft-G2 Input Validation Error Vulnerability

Delta Electronics CNCSoft-G2 is a human-machine interface HMI software from Delta Electronics, China. An input validation error vulnerability exists in Delta Electronics CNCSoft-G2 version 2.1.0.16 and prior versions, which can be exploited by an attacker to execute code in the current process...

IBM Aspera Shares Input Validation Error Vulnerability

IBM Aspera Shares is a Web application from International Business Machines IBM. An input validation error vulnerability exists in IBM Aspera Shares, which stems from improper validation of the "Client-IP" header, and can be exploited by an attacker to spoof its IP address written to a log file...

Tenda AC10 Command Injection Vulnerability

The Tenda AC10 is a wireless router from the Chinese company Tenda. A command injection vulnerability exists in Tenda AC10 version 16.03.10.20, which stems from the failure of the file /goform/telnet to properly filter constructed command special characters, commands, etc. An attacker could use...

Unspecified Vulnerability in Mozilla Firefox (CNVD-2024-48568)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox, which stems from the fact that under certain circumstances, navigating to a web page can result in a missing address in the location URL bar. No...

Siemens Mendix Encryption Module Hardcoded Default Encryption Key Vulnerability

The Mendix Encryption module takes care of the following encryption requirements: plain text encryption e.g. passwords and FileDocument encryption e.g. documents or photos. A hard-coded default encryption key vulnerability exists in the Siemens Mendix Encryption module, which can be exploited by ...

Apache Airflow Cross-Site Scripting Vulnerability (CNVD-2024-26529)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow version 2.9.0 suffers from a cross-site scripting vulnerability that...

Apache Kafka Denial of Denial Vulnerability

Apache Kafka is an open source distributed streaming platform from the Apache Foundation in the United States. The platform is capable of acquiring real-time data for building applications that react in real time to changes in the data stream. Apache Kafka suffers from a denial-of-acceptance...

IBM Maximo Application Suite Cross-Site Scripting Vulnerability

IBM Maximo Application Suite is a single platform for intelligent asset management, monitoring, maintenance, computer vision, security and reliability from International Business Machines IBM. A cross-site scripting vulnerability exists in IBM Maximo Application Suite version 7.6.1.3, which stems...

Apache InLong Code Issue Vulnerability (CNVD-2024-16113)

Apache InLong is the U.S. Apache Apache Foundation's one-stop massive data integration framework. Provides automated, secure and reliable data transfer capabilities. A code issue vulnerability exists in Apache InLong versions 1.8.0 through 1.10.0, which can be exploited by an attacker to read...

Simple School Managment System SQL Injection Vulnerability (CNVD-2024-14038)

Simple School Managment System is Code-projects open source a simple school management system . Simple School Managment System version 1.0 SQL injection vulnerability , the vulnerability stems from the application lack of external input SQL statement validation , an attacker can exploit the...

IBM PowerSC Encryption Problem Vulnerability (CNVD-2024-09945)

IBM PowerSC is an International Business Machines IBM security and compliance solution for IBM Power Systems servers. IBM PowerSC has an encryption issue vulnerability that stems from the use of a weaker-than-expected encryption algorithm, which could be exploited by an attacker to decrypt highly...

IBM Operational Decision Manager Code Issue Vulnerability

IBM Operational Decision Manager is a decision management solution from International Business Machines IBM used to help organizations better manage and enforce business rules and decisions. IBM Operational Decision Manager suffers from a code issue vulnerability that originates from the ability ...

IBM Security Access Manager Unauthorized Access Vulnerability

IBM Security Access Manager is a product for information security management applications from International Business Machines IBM. The product enables access management control through integrated appliances for web, mobile and cloud computing. An unauthorized access vulnerability exists in IBM...

Hyperledger Ursa Information Disclosure Vulnerability

Hyperledger Ursa is a cryptographic library open-sourced by Hyperledger for use with the blockchain. Hyperledger Ursa suffers from an information disclosure vulnerability that is caused by a flaw in the dangling scheme in the CL Signatures implementation. An attacker could exploit the vulnerabili...

Command Execution Vulnerability in NBR6205-E of Beijing StarNet Ruijie Network Technology Co. Ltd (CNVD-2024-07921)

The NBR6205-E is a router product. A command execution vulnerability exists in the NBR6205-E of Beijing StarNet Ruijie Network Technology Co. that can be exploited by an attacker to gain server privileges...

Linux kernel code execution vulnerability (CNVD-2024-14767)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel. The vulnerability is due to the aoecmdcfgpkts function in the Linux kernel's ATA over Ethernet AoE driver incorrectly...

Cacti cross-site scripting vulnerability (CNVD-2023-10109007)

Cacti is a set of open source network traffic monitoring and analysis tools from the Cacti team. The tool through snmpget to get the data , using RRDtool drawing graphs to analyze , and provide data and user management features . Cacti versions prior to 1.2.26 cross-site scripting vulnerability ,...

Siemens SINEC INS Denial of Service Vulnerability (CNVD-2023-97253)

SINEC INS Infrastructure Network Services is a web-based application that combines various network services in one tool. This simplifies the installation and management of all network services associated with industrial networks. A denial of service vulnerability exists in Siemens SINEC INS, whic...

Dell DM5500 Operating System Command Injection Vulnerability

The Dell DM5500 is an integrated solution from Dell, Inc. It provides industry-leading deduplication, data protection solutions and multi-cloud capabilities. The Dell DM5500 suffers from an operating system command injection vulnerability that stems from a failure to properly filter construct...

Apache Superset Authorization Issues Vulnerability (CNVD-2023-9666047)

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. An authorization issue vulnerability exists in Apache Superset versions prior to 2.1.2 that stems from the presence of incorrect authorization checks. An attacker could exploit this vulnerability...

Adobe ColdFusion Input Validation Error Vulnerability (CNVD-2023-91796)

Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. Adobe ColdFusion has an input validation error vulnerability that can be exploited by an attacker to...

Google Android elevation of privilege vulnerability (CNVD-2023-98745)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by an attacker to gain elevated privileges on the system...

Adobe Commerce SQL Injection Vulnerability

Adobe Commerce is the United States of America Odobie Adobe company's a kind of merchants and brands for the world's leading digital commerce solutions. A SQL injection vulnerability exists in Adobe Commerce prior to version 2.4.7, which stems from the application's lack of validation of external...

F5 BIG-IP Information Disclosure Vulnerability (CNVD-2023-75598)

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, and remote access policy management. An information disclosure vulnerability exists in F5 BIG-IP, which can be exploited by attackers to view sensitive information...

Mozilla Firefox Process Created Twice Release Vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox process creation suffers from a two-release vulnerability, which can be exploited by a remote attacker to submit a special Web request, tricking the user into parsing it, which can caus...

Dreamer CMS Cross-Site Scripting Vulnerability (CNVD-2023-79682)

Dreamer CMS is a dreamer content management system. Dreamer CMS version v4.1.3 suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data by the component /admin/u/toIndex, which can be exploited by an attacker to execute...

Microsoft Exchange Server Remote Code Execution Vulnerability (CNVD-2023-72227)

Microsoft Exchange Server is the United States Microsoft Microsoft company's set of e-mail service program. It provides e-mail access, storage, forwarding, voice mail, e-mail filtering and screening. A remote code execution vulnerability exists in Microsoft Exchange Server, which can be exploited...

Microsoft 3D Viewer Remote Code Execution Vulnerability (CNVD-2023-74906)

Microsoft 3D Viewer is a simplified and fast graphics editing application from Microsoft. A remote code execution vulnerability exists in Microsoft 3D Viewer, which can be exploited by an attacker to execute code on the target host...

Fortinet FortiSwitchManager Improper Access Control Vulnerability

Fortinet FortiSwitchManager is a network switch management tool from Fortinet designed to help organizations manage their FortiSwitch family of network switches. An improper access control vulnerability exists in Fortinet FortiSwitchManager. The vulnerability is caused by a flawed authentication...

D-Link DAR-8000-10 Operating System Command Injection Vulnerability

D-Link DAR-8000 is the Internet Behavior Audit Gateway from China AUO D-Link. The D-Link DAR-8000-10 version suffers from an operating system command injection vulnerability, which originates from the parameter id of the file /app/sys1.php failing to correctly filter construct command special...