LG Simple Editor XML External Entity Handling Vulnerability (CNVD-2024-33682)

LG Simple Editor is a simple editor from Luckin LG Korea that creates new content by simplifying the process and instant playback on signage. LG Simple Editor suffers from an XML External Entity Handling vulnerability due to an improper restriction on XML External Entity XXE references, where a...

Apache Airflow code execution vulnerability (CNVD-2024-33592)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow suffers from a code execution vulnerability that can be exploited by...

Delinea PAM Secret Server Security Bypass Vulnerability

Delinea PAM Secret Server is a key service manager from Delinea. A security bypass vulnerability exists in Delinea PAM Secret Server version 11.4, which can be exploited by an attacker to gain unauthorized access to a created remote session...

IBM Cognos Command Center Information Disclosure Vulnerability

IBM Cognos Command Center is a software product from International Business Machines IBM that helps organizations manage and monitor their IBM Cognos Business Intelligence solutions. An information disclosure vulnerability exists in IBM Cognos Command Center that stems from disclosing details of...

Simple School Managment System SQL Injection Vulnerability (CNVD-2024-14038)

Simple School Managment System is Code-projects open source a simple school management system . Simple School Managment System version 1.0 SQL injection vulnerability , the vulnerability stems from the application lack of external input SQL statement validation , an attacker can exploit the...

Siemens SINEC NMS SQL Injection Vulnerability (CNVD-2024-09309)

SINEC NMS is a new generation network management system NMS for digital enterprises. Siemens SINEC NMS suffers from a SQL injection vulnerability that can be exploited by an attacker to execute arbitrary SQL queries on the server database...

Apache Guacamole Integer Overflow Vulnerability

Apache Guacamole is a clientless remote desktop gateway from the Apache USA Foundation. The product supports protocols such as VNC, RDP and SSH. An integer overflow vulnerability exists in Apache Guacamole 1.5.3 and earlier versions, which can be exploited by an attacker to execute arbitrary code...

Siemens User Management Component (UMC) Cross-Site Scripting Vulnerability

Opcenter Quality is a quality management system QMS that enables organizations to safeguard compliance, optimize quality, reduce the cost of defects and rework, and achieve operational excellence by improving process stability. simatic pcs neo is a distributed control system DCS. the SINUMERIK...

Google Android elevation of privilege vulnerability (CNVD-2024-07114)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by an attacker to gain elevated privileges on the system...

Unchecked Return Value Vulnerability in Multiple Siemens Products

The SCALANCE M-800, MUM-800 and S615 and the RUGGEDCOM RM1224 are industrial routers.The SCALANCE W products are wireless communication devices for connecting industrial components, such as Programmable Logic Controllers PLCs or Human Machine Interfaces HMIs, that comply with the IEEE 802.11...

Multiple Siemens Products Forced Browsing Vulnerability

The SCALANCE M-800, MUM-800 and S615 and the RUGGEDCOM RM1224 are industrial routers.The SCALANCE W products are wireless communication devices for connecting industrial components, such as Programmable Logic Controllers PLCs or Human Machine Interfaces HMIs, that comply with the IEEE 802.11...

Siemens Mendix Authentication Bypass Vulnerability

Mendix is a high-productivity application platform for building and continuously improving mobile and web applications at scale. An authentication bypass vulnerability exists in Siemens Mendix, which can be exploited by an attacker to access or modify objects without proper authorization or to...

BaserCMS Cross-Site Request Forgery Vulnerability (CNVD-2023-86125)

baserCMS is an enterprise-level content management system CMS from the baserCMS team. A cross-site request forgery vulnerability exists in baserCMS versions prior to 4.8.0, which stems from the content preview feature not adequately verifying whether a request comes from a trusted user. This...

Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability

Microsoft Dynamics 365 is a suite of ERP business solutions for multinational organizations from Microsoft USA. The product includes financial management, production management and business intelligence management. An information disclosure vulnerability exists in Microsoft Dynamics 365...

Siemens SICAM PAS/PQS Incorrect Privilege Assignment Vulnerability (CNVD-2023-75593)

Siemens SICAM PAS/PQS is a software from Siemens with an operating system for energy automation and power quality. Siemens SICAM PAS/PQS suffers from an incorrect privilege assignment vulnerability that can be exploited to inject arbitrary code and elevate privileges to NT AUTHORITY/SYSTEM...

Siemens SICAM A8000 Device CPCI85 Firmware Web Server Path Traversal Vulnerability

The ICAM A8000 RTU Remote Terminal Unit series is a modular family of devices for remote control and automation applications in all areas of energy supply. A path traversal vulnerability exists in the Siemens SICAM A8000 device CPCI85 firmware web server, which can be exploited by an attacker to...

Siemens SINEMA Server V14 Cross-Site Scripting Vulnerability

Siemens SINEMA Server is a software from Siemens, Germany, developed specifically for industrial applications. It enables you to fully visualize and monitor your network. A cross-site scripting vulnerability exists in Siemens SINEMA Server V14 due to an affected application incorrectly clearing...

Google Chrome Security Bypass Vulnerability (CNVD-2023-75497)

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome prior to version 117.0.5938.62, which stems from an improper implementation of the Custom Mobile Tabs module. An attacker can exploit the vulnerability to bypass security...

MOXA TN-4900 and TN-5900 Command Injection Vulnerability (CNVD-2023-64097)

MOXA TN-4900 is a series of industrial firewall routers from MOXA, China.MOXA TN-5900 is a series of industrial firewall routers from MOXA, China. A command injection vulnerability exists in the MOXA TN-4900 and TN-5900, which can be exploited by an attacker to delete arbitrary files...

Linux kernel memory misreference vulnerability (CNVD-2023-64508)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A memory misreference vulnerability exists in versions of Linux kernel prior to 6.4.10, which stems from the mishandling of sub-processes of sk, and can be exploited by an...

Google Android Information Disclosure Vulnerability (CNVD-2023-82069)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability that originates from a messy proxy in the setMetadata module of MediaSessionRecord.java, which can be exploited by an attacker to obtain sensitive...

Google Android elevation of privilege vulnerability (CNVD-2023-82066)

Google Android is a Linux-based open source operating system from Google. An elevation of privilege vulnerability exists in Google Android, which can be exploited by an attacker to gain elevated privileges and execute arbitrary code on the system...

Microsoft Office Code Execution Vulnerability (CNVD-2024-02722)

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. The product's common components include Word, Excel, Access, Powerpoint, FrontPage, etc.. Microsoft Office has a code execution vulnerability that can be exploited by an attacker to execute arbitra...

The TeleAdapt RoomCast TA-2400 is an all-in-one, self-contained, top-of-the-line content streaming box for guest rooms from TeleAdapt UK. The TeleAdapt RoomCast TA-2400 suffers from an elevation of privilege vulnerability that is caused by improper access control of the Android Debug Bridge (ADB). An attacker can exploit the vulnerability to gain elevated root privileges.

IBM DB2 is a relational database management system from International Business Machines IBM. The main execution environments for this system are UNIX, Linux, IBMi, z/OS, and Windows server versions. IBM DB2 suffers from a stack buffer overflow vulnerability that stems from incorrect boundary...

Rockwell Automation 1756 EN2 and 1756 EN3 Denial of Service Vulnerabilities

Rockwell Automation 1756 is a scalable controller solution from Rockwell Automation. It is capable of addressing a large number of I/O points. A denial of service vulnerability exists in Rockwell Automation 1756 EN2 and 1756 EN3, which arises from a failure to properly handle incoming error...

Google Pixel elevation of privilege vulnerability

Google Pixel is a smartphone from the American company Google Google. Google Pixel suffers from an elevation of privilege vulnerability that stems from improper locking, which can be exploited by an attacker to cause a local privilege escalation that requires system execution privileges...

Mattermost Resource Management Error Vulnerability (CNVD-2023-55044)

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a resource management error vulnerability that stems from an inability to unescape Markdown strings, which can be exploited by an attacker to cause a denial of service by sendin...

Google Android Code Problem Vulnerability (CNVD-2023-53157)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from a code issue vulnerability that can be exploited by an attacker to cause a local privilege escalation without the need for additional execute privileges...

Unauthorized access vulnerability in SuperMap iServer of Beijing SuperMap Software Co. Ltd (CNVD-2023-61163)

SuperMap iServer is a cloud GIS application server based on high-performance cross-platform GIS kernel. An unauthorized access vulnerability exists in SuperMap iServer of Beijing SuperMap Software Co. Ltd, which can be exploited by attackers to obtain sensitive information...

Pimcore Cross-Site Scripting Vulnerability (CNVD-2023-40909)

Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce framework and product information management applications. A cross-site scripting vulnerability exists in...

Google Chrome CORS Security Bypass Vulnerability

Google Chrome is a web browser from Google, an American company. Google Chrome CORS security bypass vulnerability can be exploited by attackers to bypass security restrictions...

Google Android elevation of privilege vulnerability (CNVD-2023-55379)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that originates from improper encryption of the buildPropFile of the filesystem.go component, which can be exploited by an attacker to elevate privileges...

Complaint Management System SQL Injection Vulnerability (CNVD-2023-29364)

Complaint Management System is an open source Php project . Used to request a complaint through the online service . Complaint Management System v1.0 version of the SQL injection vulnerability, the vulnerability stems from the component POST Parameter Handler file/users/checkavailability.php to t...

Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability (CNVD-2023-35218)

Microsoft PostScript Printer Driver is a Microsoft standard printer driver for PostScript printers from Microsoft.Microsoft PCL6 Class Printer Driver is a printer driver from Microsoft. Microsoft PCL6 Class Printer Driver is a printer driver software from Microsoft. A remote code execution...

Google Android elevation of privilege vulnerability (CNVD-2023-26064)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that stems from a proxy obfuscation issue. An attacker can exploit the vulnerability to escalate privileges...

Google Android elevation of privilege vulnerability (CNVD-2023-26078)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by attackers to gain elevated privileges...

Siretta QUARTZ-GOLD Remaining Debug Code Vulnerability

Siretta QUARTZ-GOLD is a high-speed industrial router from Siretta. Siretta QUARTZ-GOLD version G5.0.1.5-210720-141020 contains a residual debug code vulnerability that can be exploited by attackers to cause remote code execution by sending specially crafted HTTP requests...

Fortinet FortiWeb has an unspecified vulnerability (CNVD-2023-18296)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. A security vulnerability exists that could b...

Siemens Tecnomatix Plant Simulation Out-of-Bounds Write Vulnerability (CNVD-2023-10620)

Siemens Tecnomatix Plant Simulation is an object-oriented, graphical, integrated modeling and simulation tool. An out-of-bounds write vulnerability exists in Siemens Tecnomatix Plant Simulation due to an affected application parsing a specially crafted SPP file that contains an out-of-bounds writ...

Siretta QUARTZ-GOLD buffer overflow vulnerability (CNVD-2023-17030)

The Siretta QUARTZ-GOLD is a high-speed industrial router from Siretta. A buffer overflow vulnerability exists in Siretta QUARTZ-GOLD version G5.0.1.5-210720-141020, which can be exploited by an attacker to execute arbitrary commands...

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-15943)

Siretta QUARTZ-GOLD is a high-speed industrial router from Siretta.Siretta QUARTZ-GOLD version G5.0.1.5-210720-141020 is vulnerable to a buffer overflow vulnerability that could be exploited by attackers to execute arbitrary commands...

Ampache Cross-Site Scripting Vulnerability (CNVD-2023-07918)

Ampache is a web-based audio/video application and file manager. cross-site scripting vulnerability exists in versions prior to Ampache 5.5.7, which stems from the fact that a user can insert malicious js in url-specific parameters and send links to other users, leading to a cross-site scripting...

F5 BIG-IP AFM Denial of Service Vulnerability (CNVD-2023-05962)

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A denial of service vulnerability exists in F5 BIG-IP AFM, where undisclosed traffic could cause TMM to crash when an AFM NAT...

Oracle VM VirtualBox has an unspecified vulnerability (CNVD-2023-05476)

A security vulnerability exists in Oracle VM VirtualBox, a virtual machine management software from Oracle Corporation. An unauthenticated attacker can use this vulnerability to compromise Oracle VM VirtualBox by accessing the network via multiple protocols...

Autolab OS Command Injection Vulnerability

Autolab is a course management service. Autolab supports automated grading of programming assignments. an operating system command injection vulnerability exists in Autolab. An attacker could exploit this vulnerability to execute code on the hosted Autolab server...

TRENDnet TEW-755AP stack overflow vulnerability (CNVD-2023-18951)

The TRENDnet TEW-755AP is a router from TRENDnet. The TRENDnet TEW-755AP suffers from a stack overflow vulnerability that stems from the lack of size checking of input data in the setlogonum parameter of the icpsetlogoimg sub41DBF4 function, which can be exploited by an attacker to execute...

Tenda A15 SYSPS Parameter Stack Overflow Vulnerability

Tenda A15 is a WiFi extender from Tenda China. A stack overflow vulnerability exists in the Tenda A15 SYSPS parameter, which originates from a lack of length checking of input data in the SYSPS parameter of /goform/SysToolChangePwd, which can be exploited by an attacker to cause a denial of servi...

TRENDnet TEW-755AP stack overflow vulnerability (CNVD-2023-18944)

The TRENDnet TEW-755AP is a router from TRENDnet. The TRENDnet TEW-755AP suffers from a stack overflow vulnerability that originates from the lack of size checking of input data in the qcawifi.wifi%dvap%d.maclist parameter in the kickbanwifimacdeny sub415D7C function, which can be exploited by an...

FlatPress Cross-Site Scripting Vulnerability (CNVD-2023-06528)

FlatPress is a Php-based blog building system from the FlatPress community that does not require database support.FlatPress suffers from a cross-site scripting vulnerability that originates in the component XML File Handler/MD File Handler in admin/panels/uploader/admin. The uploader.php file has...

OpenImageIO code execution vulnerability

OpenImageIO is an image read and write library that also provides several tools and applications. a code execution vulnerability exists in the OpenImageIO DDS scanline parsing feature. An attacker could exploit the vulnerability to cause a heap buffer overflow via a specially crafted .dds...