Cisco Application Policy Infrastructure Controller Cross-Site Scripting Vulnerability (CNVD-2021-68730)

Cisco Application Policy Infrastructure Controller APIC is an automated infrastructure deployment and governance solution from Cisco USA. Controller's web UI contains a stored cross-site scripting vulnerability, which can be exploited by an attacker to execute arbitrary script code or access...

F5 BIG-IP Advanced WAF and ASM are unspecified vulnerabilities

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A security vulnerability exists in F5 BIG-IP Advanced WAF and ASM due to a JSON content profile referenced in an AWAF/ASM...

TPEditor Heap Buffer Overflow Vulnerability

TPEditor is programming software for Delta Text Panel running on Windows. TPEditor 1.98.06 and earlier versions are vulnerable to a heap buffer overflow. An attacker can exploit the vulnerability to execute arbitrary code via specially crafted project files...

PLIB integer overflow vulnerability

PLIB is a set of libraries designed to help developers of interactive 3D applications, such as games. ssgLoadTGA function in src/ssg/ssgLoadTGA.cxx in PLIB 1.85 and earlier versions is vulnerable to an integer overflow. An attacker could exploit this vulnerability to execute arbitrary code via...

ARM mbed TLS Trust Management Issue Vulnerability

ARM mbed TLS is a product from ARM UK that provides secure communication and encryption for mbed products. ARM mbed TLS has a security vulnerability that stems from the fact that the null algorithm parameter term is the same as the real array of size 0 and therefore the certificate is considered...

Google TensorFlow integer division by zero error vulnerability

Google TensorFlow is an end-to-end open source machine learning platform. An integer division by zero error vulnerability exists in the implementation of tf.rawops.SparseReshape in versions prior to Google TensorFlow 2.6.0. No details of the vulnerability are currently available...

Dolibarr Cross-Site Scripting Vulnerability (CNVD-2021-71264)

Dolibarr is an application. A modern software package that helps manage your organization's activities, Dolibarr ERP CRM versions 2.8.1 through 13.0.2 are vulnerable to a cross-site scripting vulnerability caused by a lack of validation of user-submitted data by the editor module in the software...

Apache ServiceComb Service-Center path traversal vulnerability

Apache ServiceComb Service-Center is a Restful-based service registry from the Apache Foundation that provides microservice discovery and microservice management. Apache ServiceComb Service-Center is vulnerable to a path traversal vulnerability in version 1.x.x. The vulnerability stems from A...

Youxiang Technology DSL-2740R code problem vulnerability

The UDomain DSL-2740R is a high-performance ADSL router from D-Link, Taiwan, China. A security vulnerability exists in the D-Link DSL-2740R UK 1.01, which can be exploited by attackers to cause a denial of service on the device...

Mozilla Rust has an unspecified vulnerability (CNVD-2021-61405)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. a security vulnerability exists in the anymap crate of Mozilla Rust version 0.12.1, which can be exploited by attackers to compromise soundness by converting u8 to u64...

Nexus Control Panel Buffer Overflow Vulnerability

Swisslog Healthcare Nexus Panel, a medical device from Swisslog Healthcare, is vulnerable to an integer underflow vulnerability in versions prior to Nexus Control Panel 7.2.5.7. An attacker could use this vulnerability to override the internal queue data structure, which could enable remote code...

Apple macOS Big Sur Buffer Overflow Vulnerability (CNVD-2021-102841)

Apple macOS Big Sur is a mobile application app from Apple Inc. Apple macOS Big Sur is vulnerable to a buffer error that could be exploited by attackers to run specially crafted programs that trigger out-of-bounds writes and cause the system to unexpectedly terminate or write to kernel memory...

GPAC MP4Box code issue vulnerability

GPAC MP4Box is a multimedia packager. It is mainly used to process ISOBMF files e.g. MP4, 3GP, but can also be used to import/export media from AVI, MPG, MKV, MPEG-2 TS and other container files.GPAC MP4Box version 0.8.0 has a security vulnerability, which stems from an issue found in...

Rancher Labs Rancher Licensing Issue Vulnerability

Rancher Labs Rancher is an open source enterprise container management platform from Rancher Labs, Inc. Rancher Labs Rancher has an authorization issue vulnerability that stems from the product's lack of effective privilege management for the management of critical resources, which could be...

Huawei ManageOne Elevation of Privilege Vulnerability

Huawei Manageone is a cloud data center management solution from Huawei of China. huawei ManageOne is vulnerable due to a lack of checksum when the program uses certain parameters from external files. An attacker could use the vulnerability to construct a malicious file to achieve elevation of...

Django SQL Injection Vulnerability (CNVD-2021-49046)

Django is an open source web application framework , written in Python . A SQL injection vulnerability exists in Django versions 3.2.x prior to 3.2.5 and 3.1.x prior to 3.1.13. The vulnerability is related to a code flaw. querySet.orderby does not perform strict validation of data when processing...

Google Golang has an unspecified vulnerability

Google Golang is a statically strongly typed, compiled language from Google, U.S. A security vulnerability exists in Google Golang that could be exploited by attackers to cause a panic or unrecoverable fatal error and lead to a denial of service condition...

Nextcloud server processing logic error vulnerability

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A processing logic error vulnerability exists in the Nextcloud server, which stems from the fact that the Nextcloud server is vulnerable to brute-force attack...

Huawei EMUI/Magic UI Logic Bypass Vulnerability (CNVD-2021-64518)

Huawei Emui is an Android-based mobile operating system. Huawei Magic UI is the operating system for Honor phones. Huawei EMUI/Magic UI is vulnerable to a logic bypass vulnerability that could be exploited by attackers to compromise the data security and functional availability of the device...

Google TensorFlow code issue vulnerability (CNVD-2021-48868)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A code issue vulnerability exists in Google TensorFlow 2.4.2, 2.3.3, 2.2.3, 2.1.4, which stems from tf.rawops.FusedBatchNorm demonstrating undefined behavior by dereferencing null pointers to...

Google TensorFlow tf.raw_ops.ImmutableConst Denial of Service Vulnerability

Google TensorFlow is an end-to-end open source machine learning platform. A security vulnerability exists in Google TensorFlow tf.rawops.ImmutableConst. A local attacker can exploit this vulnerability to cause a denial of service...

OpenEXR DwaCompressor Heap Buffer Overflow Vulnerability (CNVD-2021-53912)

OpenEXR is an image file format for high dynamic range HDR images.A heap buffer overflow vulnerability exists in OpenEXR DwaCompressor, which can be exploited by attackers to crash applications compiled using OpenEXR...

Buffalo WSR-2533DHPL2 and WSR-2533DHP3 Access Control Error Vulnerability

Buffalo WSR-2533DHPL2 and WSR-2533DHP3 are routers from Buffalo Japan.The Buffalo WSR-2533DHPL2 and WSR-2533DHP3 are vulnerable to an access control error that could be exploited by an attacker to gain access to unauthorized content...

FreeBSD Injection Vulnerability

FreeBSD is a set of Unix-like operating systems from the Freebsd Foundation. FreeBSD suffers from an injection vulnerability that can be exploited by an attacker to cause the driver to misinterpret portions of the payload of a large package as separate packages...

WonderLink Yomi-Search Cross-Site Scripting Vulnerability

WonderLink Yomi-Search is a WonderLink application. A versatile search engine. A cross-site scripting vulnerability exists in version 4.22 of Yomi-Search Ver4.22, which originates from the ability to execute arbitrary script on the web browser of a user accessing a website that uses Yomi-Search. ...

Cisco Jabber Code Execution Vulnerability (CNVD-2021-22912)

Cisco Jabber is a web conferencing and instant messaging application that allows users to send messages over the Extensible Messaging and Status Protocol XMPP. A code execution vulnerability exists in Cisco Jabber, which is caused by incorrect validation of message content. An attacker can send...

Cisco IOS XE Arbitrary Code Execution Vulnerability (CNVD-2021-22188)

Cisco IOS XE is a set of modular operating system based on Linux kernel developed by Cisco for its network equipment. An arbitrary code execution vulnerability exists in the hardware initialization routines of Cisco IOS XE. The vulnerability stems from incorrect validation of parameters passed to...

Jenkins Matrix Authorization Strategy Access Control Error Vulnerability

Jenkins Matrix Authorization Strategy is a Jenkins open source application plugin . The plug-in in Jenkins to achieve fine-grained access control . An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows attackers with Item/Read permissions to nested...

Atlassian Jira Server and Data Center Cross-Site Scripting Vulnerability

Atlassian JIRA Server and Atlassian JIRA Data Center are both products of Atlassian Australia.Atlassian JIRA Server is a server version of a defect tracking management system. Atlassian JIRA Data Center is the data center version of Atlassian JIRA. validation, an attacker could exploit the...

Google Chrome Insufficient Data Validation Vulnerability

Chrome is a simple and efficiently designed web browsing tool developed by Google that is characterized by its simplicity and speed. A data validation insufficiency vulnerability exists in Google Chrome versions prior to 89.0.4389.72. An attacker can leak cross-origin data via a crafted HTML page...

Path Traversal Vulnerability in Joomla! (CNVD-2020-75069)

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A path traversal vulnerability exists in Joomla! 2.5.0 - 3.9.22. The vulnerabilit...

Microsoft Azure DevOps Server Input Validation Error Vulnerability

Microsoft Azure DevOps Server is a suite of software development collaboration tools from Microsoft Corporation USA. The product includes features such as sharing code, work tracking, and software distribution. A security vulnerability exists in Microsoft Azure DevOps Server. No details of the...

Microsoft Windows and Windows Server Remote Code Execution Vulnerability (CNVD-2021-71411)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, an operating system for personal devices, and Microsoft Windows Server, a server operating system. A remote code execution vulnerability exists in Microsoft Windows and Windows Server. The vulnerability ste...

F5 BIG-IP SIP Message Handling Denial of Service Vulnerability

The F5 BIG-IP is an F5 load balancing device. A vulnerability in the F5 BIG-IP's handling of SIP messages containing multipart MIME loads can be exploited by a remote attacker to submit a special request, which can result in a memory error and cause a denial of service attack...

Bitrix24 Web Application Firewall Cross-Site Scripting Vulnerability

Bitrix24 is a suite of enterprise social platforms from Bitrix, USA. The platform includes features such as online communication, calendar management and CRM Customer Relationship Management.Web Application Firewall is one of the Web Application Firewalls. A cross-site scripting vulnerability...

Apache SkyWalking SQL Injection Vulnerability

Apache SkyWalking is an application performance monitor from the Apache Software USA Foundation primarily for environments such as microservices, cloud-native and container-based. An SQL injection vulnerability exists in the H2/MySQL/TiDB storage implementation in Apache SkyWalking versions 6.0.0...

GOG Galaxy Privilege Permission and Access Control Issues Vulnerability (CNVD-2021-25692)

GOG Galaxy is a game client program from the Polish company GOG. The program is used to install, launch and update games. A vulnerability exists in GOG Galaxy version 1.2.x prior to 1.2.62 and version 2.0.x prior to 2.0.12 in the context of privilege permission and access control issues. An...

Plone Trust Management Issue Vulnerability

Plone is an open source content management system CMS built on the Zope application server. An input validation error vulnerability exists in Plone. The vulnerability stems from a network system or product that does not properly validate incoming data. No detailed vulnerability details are...

Multiple Siemens Products Input Validation Error Vulnerability (CNVD-2020-23037)

Siemens Scalance X-200 is an industrial Ethernet switch from Siemens, Germany. An input validation error vulnerability exists in multiple Siemens products, which can be exploited by attackers to hijack click-through actions by other users...

Google Android Remote Code Execution Vulnerability (CNVD-2020-04546)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. A remote code execution vulnerability exists in Google Android. An attacker can exploit the vulnerability to obtain URL administrator privileges...

SimpleSAMLphp Input Validation Error Vulnerability

SimpleSAMLphp is a set of PHP authentication applications that implement the SAML 2.0 service provider and identity provider features . A security vulnerability exists in SimpleSAMLphp that stems from the program's failure to properly validate cryptographic signatures in XML files. An attacker ca...

LIVE555 Invalid Memory Access Vulnerability

LIVE555 is a set of open source C++ libraries for multimedia streaming. An invalid memory access vulnerability exists in the parseAuthorizationHeader function in versions prior to LIVE555 2019.02.27. An attacker can exploit this vulnerability via a malformed header to cause a memory access error...

LIVE555 Memory Leak Vulnerability

LIVE555 is a set of open source C++ libraries for multimedia streaming. LIVE555 suffers from a memory leak vulnerability. The vulnerability stems from because when multiple instances of a single field username, realm, nonce, uri, or response exist, only the last instance can be freed. An attacker...

bibutils null pointer dereference vulnerability

bibutils is a document format conversion tool. A security vulnerability exists in the 'fieldsadd' function in the fields.c file of the libbibcore.a file in bibutils 6.2 and earlier. A remote attacker can exploit this vulnerability to cause a denial of service null pointer backreference and...

Apache HTTP Server Denial of Service Vulnerability (CNVD-2018-06535)

Apache HTTP Server is the United States Apache Apache Software Foundation, an open source web server. The server is fast, reliable and can be expanded through a simple API. A security vulnerability exists in Apache HTTP Server that stems from the program's failure to properly destroy HTTP/2...

mini-httpd and thttpd buffer overflow vulnerabilities

Both thttpd and mini-httpd are products developed by ACME Labs. thttpd is a lightweight HTTP server that supports URL-based file traffic limiting as well as support for multiple platforms such as FreeBSD, SunOS, Solaris, BSD, etc. mini-httpd is a small HTTP server that supports basic...

Opentext Documentum Content Server File Download Vulnerability

OpenText Documentum Content Server formerly known as EMC Documentum Content Server is a content management service system from OpenText Canada. The system is mainly used to manage the Documentum content repository, you can create, modify and track documents and other operations. A file download...

FileRun Remote SQL Injection Vulnerability

FileRun File Manager gives you access to your files anytime, anywhere with self-hosted secure cloud storage, file backups and sharing of photos, videos, documents and more. FileRun suffers from a remote SQL injection vulnerability that originates from the program's failure to validate the metafie...

WordPress Mail Masta plugin SQL injection vulnerability (CNVD-2017-02399)

WordPress is the WordPress Software Foundation's set of blogging platform using the PHP language development, the platform supports in PHP and MySQL servers to set up a personal blog site.Mail Masta Plugin is one of the mail plugin. The Mail Masta Plugin for WordPress suffers from a SQL injection...

WordPress Mail Masta plugin SQL injection vulnerability (CNVD-2017-02397)

WordPress is the WordPress Software Foundation's set of blogging platform using the PHP language development, the platform supports in PHP and MySQL servers to set up a personal blog site.Mail Masta Plugin is one of the mail plugin. The Mail Masta Plugin for WordPress suffers from a SQL injection...