Oracle VM VirtualBox has an unspecified vulnerability (CNVD-2023-05476)

A security vulnerability exists in Oracle VM VirtualBox, a virtual machine management software from Oracle Corporation. An unauthenticated attacker can use this vulnerability to compromise Oracle VM VirtualBox by accessing the network via multiple protocols...

Autolab OS Command Injection Vulnerability

Autolab is a course management service. Autolab supports automated grading of programming assignments. an operating system command injection vulnerability exists in Autolab. An attacker could exploit this vulnerability to execute code on the hosted Autolab server...

Tenda A15 SYSPS Parameter Stack Overflow Vulnerability

Tenda A15 is a WiFi extender from Tenda China. A stack overflow vulnerability exists in the Tenda A15 SYSPS parameter, which originates from a lack of length checking of input data in the SYSPS parameter of /goform/SysToolChangePwd, which can be exploited by an attacker to cause a denial of servi...

TRENDnet TEW-755AP stack overflow vulnerability (CNVD-2023-18944)

The TRENDnet TEW-755AP is a router from TRENDnet. The TRENDnet TEW-755AP suffers from a stack overflow vulnerability that originates from the lack of size checking of input data in the qcawifi.wifi%dvap%d.maclist parameter in the kickbanwifimacdeny sub415D7C function, which can be exploited by an...

FlatPress Cross-Site Scripting Vulnerability (CNVD-2023-06528)

FlatPress is a Php-based blog building system from the FlatPress community that does not require database support.FlatPress suffers from a cross-site scripting vulnerability that originates in the component XML File Handler/MD File Handler in admin/panels/uploader/admin. The uploader.php file has...

OpenImageIO code execution vulnerability

OpenImageIO is an image read and write library that also provides several tools and applications. a code execution vulnerability exists in the OpenImageIO DDS scanline parsing feature. An attacker could exploit the vulnerability to cause a heap buffer overflow via a specially crafted .dds...

Siemens Teamcenter Visualization and JT2Go Out-of-Bounds Writing Vulnerability

Siemens Teamcenter Visualization is a team collaboration software for designing 2D and 3D scenes. Siemens JT2GO is a JT file viewer. Siemens Teamcenter Visualization and JT2Go are vulnerable to an out-of-bounds write vulnerability, which can be exploited by attackers to execute code in the contex...

Google Android Denial of Service Vulnerability (CNVD-2022-89772)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from a denial of service vulnerability that can be exploited by attackers to cause a denial of service...

Linux kernel L2TP protocol denial of service vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A denial of service vulnerability exists in Linux layer2tunnelingprotocol prior to version 6.0, which stems from a flaw in the Linux kernel's Layer 2 Tunneling Protocol, L2TP,...

WordPress TeraWallet plugin insecure direct object reference vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An insecure direct object...

Socketio Engine.IO Denial of Service Vulnerability

Engine.IO is a transport-based implementation of Socket.IO's cross-browser/cross-device bi-directional communication layer.A denial-of-service vulnerability exists in versions of Socketio Engine.IO prior to 3.6.1, 4.0.0 and later, and prior to 6.2.1, which stems from a failure to properly handle...

Unspecified Vulnerability in LibreNMS

LibreNMS is an open source network monitoring system based on PHP and MySQL from the LibreNMS community. The system features customizable alerts, auto-discovery of the network environment and automatic updates. A security vulnerability exists in LibreNMS versions prior to 22.10.0, which stems fro...

Huawei HarmonyOS Elevation of Privilege Vulnerability (CNVD-2022-78140)

Huawei HarmonyOS is an operating system from Huawei China. Huawei HarmonyOS is vulnerable to an elevation of privilege vulnerability caused by a serialization/deserialization mismatch in the AMS module. An attacker could exploit this vulnerability to elevate privileges...

Democritus Project d8s-python code execution vulnerability (CNVD-2022-84129)

Democritus Project is a collection of simple, effective, modular, well-tested and well-documented features from Democritus. Democritus Project d8s-python has a security vulnerability that stems from its inclusion of a potential code execution backdoor inserted by a third party. An attacker could...

Apache UIMA path traversal vulnerability

Apache UIMA is a component-based software architecture from the Apache Foundation. A path traversal vulnerability exists in Apache UIMA 3.3.0 and earlier, which stems from relative path traversal and can be exploited to create files outside of a specified destination directory using carefully...

Corel CorelDRAW Graphics Suite buffer overflow vulnerability (CNVD-2023-29425)

Corel CorelDRAW Graphics Suite is a vector graphics creation tool from Corel. A buffer overflow vulnerability exists in Corel CorelDRAW Graphics Suite, which can be exploited by attackers to execute code in the context of the current process...

Oracle Database Server Information Disclosure Vulnerability (CNVD-2022-87654)

Oracle Database Server is a relational database management system from Oracle Corporation. The Java VM is a Java Virtual Machine component of the database management system, and an information disclosure vulnerability exists in the Java VM component of Oracle Database Server. An attacker could...

Multiple Siemens Products Input Validation Error Vulnerability

Siemens SIMATIC HMI Comfort Panels is a touch panel device from Siemens Germany. Multiple Siemens products are vulnerable to an input validation error, which stems from the inability of the affected device to properly validate input sent to certain services over TCP. An unauthenticated remote...

SAP Enable Now Cross-Site Scripting Vulnerability

SAP Enable Now is a collaborative content creation, management and sharing platform from SAP. The platform is primarily used for e-learning and training in SAP and non-SAP systems. A cross-site scripting vulnerability exists in SAP Enable Now 10 version 1. The vulnerability stems from failure to...

SAP 3D Visual Enterprise Author .emf Buffer Overflow Vulnerability

SAP 3D Visual Enterprise Author is a desktop application for managing 2D, 3D, animation, video and audio assets from SAP. A buffer overflow vulnerability exists in SAP 3D Visual Enterprise Author version 9, which stems from a lack of proper memory management and can be exploited by an attacker to...

Fortinet FortiOS Command Execution Vulnerability

Fortinet FortiOS is a security operating system dedicated to the FortiGate network security platform from Fortinet, a US-based company. The system provides users with a variety of security features such as firewall, anti-virus, IPSec/SSLVPN, Web content filtering and anti-spam.Fortinet FortiOS ha...

Etaplighting Etap Safety Manager Cross-Site Scripting Vulnerability

ETAP Safety Manager is a management system where users observe, configure and maintain emergency lighting. Etaplighting Etap Safety Manager version 1.0.0.32 is vulnerable to a cross-site scripting vulnerability that stems from action parameters not being properly cleared before being returned to...

Rocket.Chat Input Validation Error Vulnerability

Rocket.Chat is an open source team chat software. Rocket.Chat suffers from an input validation error vulnerability that stems from a failure to type validate input data in the getUsersOfRoom Meteor server method. An authenticated attacker could use this vulnerability to enumerate existing rooms a...

OTFCC Buffer Overflow Vulnerability (CNVD-2023-11833)

OTFCC is a C library and utility open sourced by Caryll. It is used to parse and write OpenType font files. OTFCC suffers from a buffer overflow vulnerability that originates in /release-x64/otfccdump 0x4adcdb when handling untrusted input, which can be exploited by an attacker to cause a program...

D-Link DIR-2150 Buffer Overflow Vulnerability (CNVD-2023-21662)

The D-Link DIR-2150 is a wireless router device from D-Link. The D-Link DIR-2150 is vulnerable to a buffer overflow vulnerability that can be exploited by attackers to execute code in the root context...

Adobe InCopy out-of-bounds read vulnerability (CNVD-2023-05234)

Adobe InCopy is an application produced by Adobe for professional word processing. Adobe InCopy 17.3 and 16.4.2 and previous versions have an out-of-bounds read vulnerability that can be exploited by attackers to bypass mitigations such as ASLR and gain access to sensitive information...

Siemens Mendix SAML Module Authentication Bypass Vulnerability

Siemens Mendix SAML Module is an application module from Siemens, Germany. It is used to grant access to Mendix applications based on the end-user's identity in your identity provider. An authentication bypass vulnerability exists in Siemens Mendix SAML Module, which could be exploited by an...

Huawei HarmonyOS deserialization vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a microkernel-based, full-scenario distributed operating system. Huawei HarmonyOS is vulnerable to a deserialization vulnerability in the NFC module that results from insecure deserialization of serialized data submitted by th...

Tenda AC1206 Buffer Overflow Vulnerability (CNVD-2022-78513)

Tenda AC1206 is a wireless pass-through king gigabit router from Tenda China. Tenda AC1206 version V15.03.06.23 is vulnerable to a buffer overflow vulnerability, which is caused by improper boundary checking of the formSetPPTPServer function. An attacker can exploit this vulnerability to overflow...

Hitachi Energy RTU500 series CMU firmware buffer overflow vulnerability

RTU500 is a series of industrial control components from Hitachi, Japan, mainly used in industrial control systems. A buffer overflow vulnerability exists in the Hitachi Energy RTU500 series CMU firmware HCI Modbus TCP function. The vulnerability, which originates when HCI Modbus TCP is enabled a...

D-Link DIR-816 Buffer Overflow Vulnerability

The D-Link DIR-816 is a wireless router from AUO D-Link of Taiwan, China. A buffer overflow vulnerability exists in the mirrored version of the D-link DIR-816 firmware A2v1.10CNB04.img. The vulnerability stems from the fact that when the wantype of its /goform/form2Wan.cgi component is 3, the...

Adobe Acrobat Reader Buffer Overflow Vulnerability (CNVD-2022-56978)

Adobe Acrobat Reader is a PDF viewer from Adobe, a U.S. company. The software is used to print, sign, and annotate PDFs. Adobe Acrobat Reader is vulnerable to a buffer overflow vulnerability that originates from out-of-bounds reads and results in a memory leak. No detailed vulnerability details a...

F5 NGINX Ingress Controller Input Validation Error Vulnerability

NGINX Ingress Controller is an application from F5 that works with NGINX and NGINX Plus and supports the standard ingress features - content-based routing and TLS / SSL offload. Ingress objects can be exploited by an attacker to obtain all available secret objects in the NGINX Ingress Controller...

Adobe InCopy Font Parsing Heap Overflow Vulnerability

Adobe Incopy 2021 is a powerful document article editing software. A heap overflow vulnerability exists in Adobe InCopy Font parsing, which can be exploited by a remote attacker to submit a special file request and trick the user into parsing it, which can crash the application or execute arbitra...

Unspecified Vulnerability in TP-LINK TL-WR841N

The TP-LINK TL-WR841N is a wireless router from China P&L TP-LINK. A security vulnerability exists in the TP-LINK TL-WR841N V12 firmware version 3.16.9, which can be exploited by an authenticated, remote attacker to execute arbitrary code via a GET request to the System Tools page of a Wi-Fi...

IBM Engineering Lifecycle Optimization Cross-Site Scripting Vulnerability (CNVD-2022-55503)

IBM Engineering Lifecycle Optimization ELO is an extension of the Engineering Lifecycle Management ELM portfolio from IBM America. They make it easier to collect and analyze data across the development environment to make better decisions. Automate reporting to ensure that the entire organization...

Adobe Acrobat and Adobe Reader Buffer Overflow Vulnerability (CNVD-2022-56260)

Adobe Acrobat and Adobe Reader are both products of Adobe, a PDF file editing and conversion tool, and Adobe Reader, a PDF document reading software. The vulnerability stems from the existence of a post-release reuse error when dealing with PDF files, an attacker can use the vulnerability to gain...

SAP BusinessObjects Business Intelligence Platform SQL Injection Vulnerability

SAP Business Objects is a business intelligence suite from SAP Germany. An SQL injection vulnerability exists in SAP BusinessObjects Business Intelligence Platform versions 420 and 430, which can be exploited by an authenticated attacker to query and extract SQL backend data through the BI...

FFmpeg decode_slice_header() function denial of service vulnerability

FFmpeg is a complete solution for recording, converting and streaming audio and video from the Ffmpeg team. A denial of service vulnerability exists in the FFmpeg decodesliceheader function, which can be exploited by an attacker to cause a denial of service attack...

WordPress Admin Management Xtended plugin跨站请求伪造漏洞

WordPress and others are products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. Xtend and others are products of the Eclipse Foundation. Xtend is a general-purpose high-level programming language for the Java Virtual Machine. WordPress...

HCL Technologies HCL Launch Information Disclosure Vulnerability (CNVD-2022-58411)

HCL Technologies HCL Launch is a versatile, enterprise-grade continuous delivery automation software from HCL Technologies, India. for handling the most complex deployment processes in DevOps. HCL Technologies HCL Launch suffers from an information disclosure vulnerability that stems from the...

TOTOLINK T6 FUN_0041621c Function Stack Overflow Vulnerability

TOTOLINK T6 is a wireless dual-band router from China Gion Electronics TOTOLINK.A stack overflow vulnerability exists in TOTOLINK T6 V4.1.9cu.5179B20201015, which stems from the cloneMac parameter in the FUN0041621c function that does not check its length for input data. A remote attacker can...

Jenkins XebiaLabs XL Release Plugin Cross-Site Request Forgery Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.Jenkins XebiaLabs XL Release Plugin 22.0....

WordPress New User Approve plugin跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress New User Approve plugin versions prior to 2.4 are vulnerable to cross-site request forgery, which...

Apache Tika Denial of Service Vulnerability (CNVD-2022-51053)

Apache Tika is a collection of content extraction tools from the Apache Foundation that integrates POI an open source library that uses Java programs to provide read and write functionality for Microsoft Office format documents, Pdfbox a pure Java library for reading and creating PDF documents an...

WordPress MyCSS plugin cross-site request forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress MyCSS plugin 1.1 and earlier versions are vulnerable to cross-site request forgery, which stems fro...

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CNVD-2022-57203)

An elevation of privilege vulnerability exists in Microsoft Edge Chromium-based, a Web browser that ships with post-Windows 10 versions of Microsoft Corporation USA. The vulnerability stems from a failure to properly program a call to a high-level native procedure. An attacker could exploit this...

BigBlueButton Cross-Site Scripting Vulnerability (CNVD-2022-62183)

BigBlueButton is BigBlueButton community of a set of open source Web conferencing system . A cross-site scripting vulnerability exists in BigBlueButton v2.4.7 and earlier versions, which stems from a lack of checksum filtering of user-supplied and output data in the chat feature. An attacker can...

deep-get-set prototype contamination vulnerability

deep-get-set is used to set and obtain values on objects via dotted strings. deep-get-set package in all versions suffers from a prototype pollution vulnerability that stems from the vulnerability of products to uncontrolled modification of object prototype properties. An attacker could exploit...

Secheron SEPCOS Control and Protection Relay Elevation of Privilege Vulnerability

Secheron SEPCOS Control and Protection Relay is a relay from Secheron. Control and protect your DC panels and contact lines from short circuits and other electrical faults, and benefit from enhanced communication capabilities.An elevation of privilege vulnerability exists in the Secheron SEPCOS...