Siemens SIMATIC MV500 Devices Uncontrolled Resource Consumption Vulnerability

SIMATIC MV500 products are fixed optical readers for capturing print, laser, drill, punch and dotted line codes on a variety of different surfaces. Siemens SIMATIC MV500 Devices has an uncontrolled resource consumption vulnerability that can be exploited by an attacker to cause a denial of servic...

Siemens RUGGEDCOM ROX Weak Password Vulnerability

RUGGEDCOM products offer a degree of robustness and reliability that sets the standard for communication networks deployed in harsh environments. A weak password vulnerability exists in the Siemens RUGGEDCOM ROX, which can be exploited by an attacker to read and modify any data passed to the...

Milesight UR32L urvpn_client http_connection_readcb Functional Buffer Overflow Vulnerability

The Milesight UR32L is a 4G industrial router from China's Milesight. A buffer overflow vulnerability exists in the Milesight UR32L urvpnclient httpconnectionreadcb function, which can be exploited by an attacker to cause a buffer overflow and execute arbitrary code on the system, or cause an...

Google Android Logic Flaw Vulnerability (CNVD-2023-53155)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from a logic flaw vulnerability that can be exploited by an attacker to cause a local elevation of privilege...

Dell PowerPath Management Appliance Authorization Issues Vulnerability

The Dell PowerPath Management Appliance is a PowerPath host management application from Dell Inc. that offers two models: a virtual machine-based appliance and a Docker containerized appliance. An authorization issue vulnerability exists in Dell PowerPath Management Appliance versions 7.0, 7.1, a...

Odoo Access Control Issue Vulnerability

Odoo is an Enterprise Resource Planning ERP and Customer Relationship Management CRM system from Odoo Belgium. The system is developed in Python language, PostgreSQL as the database, and includes modules for sales management, inventory management, financial management and so on. An access control...

Google Chrome Code Execution Vulnerability (CNVD-2023-46125)

Google Chrome is a web browser from Google, an American company. A code execution vulnerability exists in Google Chrome, which can be exploited by an attacker to execute arbitrary code on a system or cause an application to crash...

Google Chrome OS Inputs Code Execution Vulnerability

Google Chrome is a web browser from Google, an American company. A code execution vulnerability exists in Google Chrome OS Inputs, which can be exploited by an attacker to execute arbitrary code or cause a denial of service condition on a system...

Unspecified Vulnerability in Oracle MySQL Server (CNVD-2023-65514)

Oracle MySQL Server is a relational database from Oracle Corporation. Oracle MySQL Server has a security vulnerability that can be exploited by attackers to cause a takeover of MySQL Server...

Campcodes Online Traffic Offense Management System SQL Injection Vulnerability (CNVD-2023-29406)

Campcodes Online Traffic Offense Management System is a web-based traffic offense management system. A SQL injection vulnerability exists in Campcodes Online Traffic Offense Management System v1.0. The vulnerability stems from the lack of validation of external input SQL statements in the paramet...

MediaWiki authorization error vulnerability (CNVD-2023-29701)

MediaWiki is a free and free-to-use web-based wiki engine from the MediaWiki Foundation, which can be used to deploy in-house knowledge management and content management systems. An authorization error vulnerability exists in the MediaWiki GrowthExperiments extension, which could be exploited by ...

Adobe Dimension Stack Buffer Overflow Vulnerability

Adobe Dimension is a set of 2D and 3D composite design tools from the American company Audobee Adobe. Adobe Dimension suffers from a stack buffer overflow vulnerability that can be exploited by an attacker to execute arbitrary code in the context of the current user...

Siemens Tecnomatix Plant Simulation Out-of-Bounds Read Vulnerability (CNVD-2023-18932)

Siemens Tecnomatix Plant Simulation is an industrial control device from Siemens, Germany. Using the function of discrete event simulation for production volume analysis and optimization, and thus improve the manufacturing system performance. A security vulnerability exists in versions prior to...

Apache Airflow Sqoop Provider Input Validation Error Vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An input validation error vulnerability exists in Apache Airflow Sqoop Provider...

Fortinet FortiWeb has an unspecified vulnerability (CNVD-2023-18296)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. A security vulnerability exists that could b...

Mozilla Firefox Code Execution Vulnerability (CNVD-2023-68438)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox prior to version 110, which stems from an invalid down conversion in GetTableSelectionMode, and can be exploited by attackers to cause undefined...

Mozilla Firefox Denial of Service Vulnerability (CNVD-2023-68440)

Arbitrary Code Execution Vulnerability in Various Apple Products...

Siemens Tecnomatix Plant Simulation Out-of-Bounds Write Vulnerability (CNVD-2023-10619)

Siemens Tecnomatix Plant Simulation is an object-oriented, graphical, integrated modeling and simulation tool. An out-of-bounds write vulnerability exists in Siemens Tecnomatix Plant Simulation due to an affected application parsing a specially crafted SPP file that contains an out-of-bounds writ...

Adobe After Effects Out-of-Bounds Read Vulnerability (CNVD-2023-17024)

Adobe After Effects is a set of visual effects and motion graphics production software from the American company Audobee Adobe. The software is mainly used for 2D and 3D synthesis, animation and visual effects production. Adobe After Effects suffers from an out-of-bounds read vulnerability that...

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-16876)

Siretta QUARTZ-GOLD is a high-speed industrial router from Siretta.Siretta QUARTZ-GOLD version G5.0.1.5-210720-141020 is vulnerable to a buffer overflow vulnerability that could be exploited by attackers to execute arbitrary commands...

WordPress plugin 0mk Shortener Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

IBM Tivoli Workload Scheduler XML External Entity Injection Vulnerability

IBM Tivoli Workload Scheduler is a suite of enterprise task scheduling software from International Business Machines IBM. IBM Tivoli Workload Scheduler suffers from an external entity injection vulnerability that can be exploited by a remote attacker to submit a special request that could obtain...

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17066)

Siretta QUARTZ-GOLD is an industrial router with multiple features and services.A buffer overflow vulnerability exists in Siretta QUARTZ-GOLD, which can be exploited by attackers to cause arbitrary command execution by sending specially crafted network packets...

TL-WDR7660 httpProcDataSrv arbitrary code execution vulnerability in Pulian Technology Co.

TL-WDR7660 is a Gigabit router from China Pulian TP-LINK. Ltd. TL-WDR7660 httpProcDataSrv arbitrary code execution vulnerability, which can be exploited by remote attackers to submit special requests to execute arbitrary code in the application context...

NexusPHP SQL Injection Vulnerability (CNVD-2023-05400)

NexusPHP is a free and open source complete PT site building solution. versions prior to NexusPHP 1.7.33 have a security vulnerability that could be exploited by attackers to allow remote attackers to execute arbitrary SQL commands via the conuser parameter in takeconfirm.php...

SAP BPC MS SQL Injection Vulnerability

SAP BPC MS is a business planning and consolidation application from SAP Germany that provides planning, budgeting, forecasting, and financial consolidation functions. SAP BPC MS version 10.0 810 contains a SQL injection vulnerability that stems from the application's lack of validation of...

TRENDnet TEW-755AP stack overflow vulnerability (CNVD-2023-18952)

The TRENDnet TEW-755AP is a router from TRENDnet. The TRENDnet TEW-755AP suffers from a stack overflow vulnerability that stems from the lack of size checking of input data in the qcawifi.wifi%dvap%d.maclist parameter in the kickbanwifimacallow sub415B00 function, which can be exploited by an...

Mozilla Firefox competition condition vulnerability

Mozilla Firefox is an open source Web browser from the Mozilla Foundation in the U.S. Mozilla Firefox is vulnerable to a competitive condition vulnerability that exists from a competitive condition in the maintenance updater service. An attacker could exploit the vulnerability to write access to...

Unspecified Vulnerability in ZOHO ManageEngine Device Control Plus

ZOHO ManageEngine Device Control Plus is a USB device control software from ZOHO USA. It is used to control, block and monitor all removable devices connected to the computer. A security vulnerability exists in ZOHO ManageEngine Device Control Plus version 10.1.2228.15 that originates from the...

Google Android elevation of privilege vulnerability (CNVD-2023-07675)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by an attacker to elevate privileges...

Adobe Experience Manager Cross-Site Scripting Vulnerability (CNVD-2023-00610)

Adobe Experience Manager AEM is a content management solution from Adobe that can be used to build websites, mobile applications and forms. The solution supports mobile content management, marketing and sales campaign management, and multi-site management, etc. A cross-site scripting vulnerabilit...

Siemens Parasolid out-of-bounds write vulnerability (CNVD-2022-87977)

An out-of-bounds write vulnerability exists in Siemens Parasolid, a geometric modeling kernel from Siemens, Germany, due to an out-of-bounds write beyond the end of the allocation structure contained in a specially crafted XB file parsed by the affected application. The vulnerability allows an...

Google Android Information Disclosure Vulnerability (CNVD-2023-04550)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability, which is caused by a logic error in the code beginning with Threads.cpp. An attacker can exploit the vulnerability to obtain sensitive information...

Google Chrome Forms Code Execution Vulnerability

Google Chrome is a web browser from Google, an American company. A code execution vulnerability exists in Google Chrome Forms, which can be exploited by an attacker to execute arbitrary code on a system or cause a denial of service...

WordPress OWM Weather plugin SQL Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

Google Chrome Security Bypass Vulnerability (CNVD-2023-08259)

Google Chrome is a web browser from Google, Inc. A security bypass vulnerability exists in Google Chrome, which stems from insufficient untrusted input validation in CORS. An attacker could exploit this vulnerability to bypass security restrictions...

WordPress Photospace Gallery plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress Photospace Galler...

Unspecified Vulnerability in SolarWinds Security Event Manager

SolarWinds Security Event Manager SolarWinds SEM is an American SolarWinds, Inc. for forensics and troubleshooting, as well as a tool to help you manage log data. A security vulnerability exists in SolarWinds Security Event Manager 2022.2 and prior versions that stems from disclosing HTTP methods...

XWiki Platform Input Validation Error Vulnerability

XWiki Platform is the French company XWiki's set of Wiki platform for creating Web collaboration applications. An input validation error vulnerability exists in XWiki Platform that stems from not properly clearing obfuscated entries. An attacker could exploit this vulnerability to obtain encrypte...

NETGEAR R7000P openvpn_push1 buffer overflow vulnerability

NETGEAR R7000P is a wireless router from NETGEAR, Inc. A buffer overflow vulnerability exists in NETGEAR R7000P firmware version V1.3.1.64, which stems from a lack of length validation of data input to the openvpnpush1 parameter, which could be exploited by an attacker to cause a denial of servic...

Miele appWash Access Control Error Vulnerability

Miele appWash is a laundry room digitization app from Miele Germany. Miele appWash suffers from an Access Control Error vulnerability that stems from the use of an API endpoint to bypass authorization checks. An attacker could use this vulnerability to gain read and partial write access to data...

PicoC StringStrncpy function buffer overflow vulnerability

PicoC is a lightweight C interpreter. A buffer overflow vulnerability exists in PicoC version 3.2.2, which stems from a boundary error in the StringStrncpy function in cstdlib/string.c when ExpressionParseFunctionCall is called while processing untrusted input. An attacker can exploit the...

Democritus Project d8s-urls code execution vulnerability

Democritus Project is a collection of simple, effective, modular, well-tested and well-documented features from Democritus. Democritus Project d8s-urls has a security vulnerability that stems from its inclusion of a potential code execution backdoor inserted by a third party. An attacker could...

Siemens POWER METER SICAM Q100 Input Validation Error Vulnerability (CNVD-2022-75538)

The POWER METER SICAM Q100 is a multifunctional device used to detect, report and analyze measured values and events. Siemens POWER METER SICAM Q100 is vulnerable to an input validation error, which could be exploited by an attacker to crash the device followed by an automatic reboot or execute...

Democritus Project d8s-timer code execution vulnerability

Democritus Project is a collection of simple, effective, modular, well-tested and well-documented features from Democritus. Democritus Project d8s-timer has a security vulnerability that stems from its inclusion of a potential code execution backdoor inserted by a third party. An attacker could...

D-Link DIR-823G Command Injection Vulnerability (CNVD-2023-21667)

D-Link DIR-823G is a wireless router from D-Link China.D-Link DIR-823G v1.0.2 is vulnerable to command injection, which can be exploited by attackers to execute arbitrary commands via specially crafted packets...

Google Chrome Feedback service code execution vulnerability

Google Chrome is a web browser from Google, Inc. A code execution vulnerability exists in the Google Chrome Feedback service, which is caused by free use in the Feedback service. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service on the system...

Google Pixel buffer overflow vulnerability

Google Pixel is a smartphone from Google, Inc. An attacker could use this vulnerability to remotely execute arbitrary code...

Siemens LOGO! 8 BM Unsafe Update Vulnerability

Siemens LOGO! 8 BM is a programming software for industrial environments for the Windows platform from Siemens Germany. A security vulnerability exists in Siemens LOGO! 8 BM prior to version 8.3, which arises from loading a firmware update without checking for authenticity. The vulnerability can ...

WordPress DSGVO All in one for WP cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress DSGVO All in one for WP 4.2 has a cross-site scripting vulnerability that stems from the fact that...