Apache Superset Authorization Issues Vulnerability (CNVD-2023-9666047)

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. An authorization issue vulnerability exists in Apache Superset versions prior to 2.1.2 that stems from the presence of incorrect authorization checks. An attacker could exploit this vulnerability...

Adobe ColdFusion Input Validation Error Vulnerability (CNVD-2023-91796)

Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. Adobe ColdFusion has an input validation error vulnerability that can be exploited by an attacker to...

Huawei HarmonyOS and EMUI Privilege Management Vulnerability

Huawei HarmonyOS is an operating system from Huawei, a Chinese company. It provides a full-scenario distributed operating system based on a microkernel.Huawei EMUI is a user interface developed by Huawei based on the Android operating system. Huawei HarmonyOS and EMUI have a privilege management...

Google Android elevation of privilege vulnerability (CNVD-2023-98745)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by an attacker to gain elevated privileges on the system...

Google Android elevation of privilege vulnerability (CNVD-2023-96079)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by an attacker to escalate privileges...

Adobe Commerce SQL Injection Vulnerability

Adobe Commerce is the United States of America Odobie Adobe company's a kind of merchants and brands for the world's leading digital commerce solutions. A SQL injection vulnerability exists in Adobe Commerce prior to version 2.4.7, which stems from the application's lack of validation of external...

Mozilla Firefox Process Created Twice Release Vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox process creation suffers from a two-release vulnerability, which can be exploited by a remote attacker to submit a special Web request, tricking the user into parsing it, which can caus...

Dreamer CMS Cross-Site Scripting Vulnerability (CNVD-2023-79682)

Dreamer CMS is a dreamer content management system. Dreamer CMS version v4.1.3 suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data by the component /admin/u/toIndex, which can be exploited by an attacker to execute...

Google Chrome Security Bypass Vulnerability (CNVD-2023-75499)

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome prior to version 117.0.5938.62, which stems from an improper implementation of the Intents module. An attacker can exploit the vulnerability to bypass security restrictions...

Microsoft 3D Viewer Remote Code Execution Vulnerability (CNVD-2023-74906)

Microsoft 3D Viewer is a simplified and fast graphics editing application from Microsoft. A remote code execution vulnerability exists in Microsoft 3D Viewer, which can be exploited by an attacker to execute code on the target host...

Microsoft Exchange Server Remote Code Execution Vulnerability (CNVD-2023-72227)

Microsoft Exchange Server is the United States Microsoft Microsoft company's set of e-mail service program. It provides e-mail access, storage, forwarding, voice mail, e-mail filtering and screening. A remote code execution vulnerability exists in Microsoft Exchange Server, which can be exploited...

Microsoft 3D Builder Remote Code Execution Vulnerability (CNVD-2023-74907)

Microsoft 3D Builder is a tool for creating models and 3D printing from Microsoft. A remote code execution vulnerability exists in Microsoft 3D Builder, which can be exploited by an attacker to execute arbitrary code on a system...

Fortinet FortiSwitchManager Improper Access Control Vulnerability

Fortinet FortiSwitchManager is a network switch management tool from Fortinet designed to help organizations manage their FortiSwitch family of network switches. An improper access control vulnerability exists in Fortinet FortiSwitchManager. The vulnerability is caused by a flawed authentication...

D-Link DAR-8000-10 Operating System Command Injection Vulnerability

D-Link DAR-8000 is the Internet Behavior Audit Gateway from China AUO D-Link. The D-Link DAR-8000-10 version suffers from an operating system command injection vulnerability, which originates from the parameter id of the file /app/sys1.php failing to correctly filter construct command special...

Cisco Unified Contact Center Express Input Validation Error Vulnerability (CNVD-2023-93334)

Cisco Unified Contact Center Express Unified CCX is a customer relationship management component of a unified communications solution from Cisco. The component supports features such as self-service voice, call distribution, and customer access control. An input validation error vulnerability...

Google Android Denial of Service Vulnerability (CNVD-2024-07848)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from a denial of service full vulnerability due to incorrect input validation in multiple functions of DevicePolicyManager.java, which can be exploited by an attacker to cause a denial of service...

Siemens EFI Boot Guard Code Execution Vulnerability

Siemens EFI Boot Guard is a simple UEFI boot loader from Siemens Germany. A code execution vulnerability exists in Siemens EFI Boot Guard versions prior to 0.15, which stems from insufficient input validation and cleanup, and can be exploited by an attacker to execute arbitrary code in privileged...

Microsoft HEVC Video Extensions Remote Code Execution Vulnerability (CNVD-2023-64870)

Microsoft HEVC Video Extensions is a video extension application from Microsoft USA. The application enables computers and devices to read High Efficiency Video Coding or HEVC videos. A remote code execution vulnerability exists in Microsoft HEVC Video Extensions, which can be exploited by an...

Siemens RUGGEDCOM ROX Weak Password Vulnerability

RUGGEDCOM products offer a degree of robustness and reliability that sets the standard for communication networks deployed in harsh environments. A weak password vulnerability exists in the Siemens RUGGEDCOM ROX, which can be exploited by an attacker to read and modify any data passed to the...

Siemens SIMATIC MV500 Devices Uncontrolled Resource Consumption Vulnerability

SIMATIC MV500 products are fixed optical readers for capturing print, laser, drill, punch and dotted line codes on a variety of different surfaces. Siemens SIMATIC MV500 Devices has an uncontrolled resource consumption vulnerability that can be exploited by an attacker to cause a denial of servic...

Siemens SIMATIC MV500 Devices Uncontrolled Resource Consumption Vulnerability (CNVD-2023-56540)

SIMATIC MV500 products are fixed optical readers for capturing print, laser, drill, punch and dotted line codes on a variety of different surfaces. Siemens SIMATIC MV500 Devices has an uncontrolled resource consumption vulnerability that can be exploited by an attacker to cause a denial of servic...

Milesight UR32L urvpn_client http_connection_readcb Functional Buffer Overflow Vulnerability

The Milesight UR32L is a 4G industrial router from China's Milesight. A buffer overflow vulnerability exists in the Milesight UR32L urvpnclient httpconnectionreadcb function, which can be exploited by an attacker to cause a buffer overflow and execute arbitrary code on the system, or cause an...

Google Android Logic Flaw Vulnerability (CNVD-2023-53155)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from a logic flaw vulnerability that can be exploited by an attacker to cause a local elevation of privilege...

Dell PowerPath Management Appliance Authorization Issues Vulnerability

The Dell PowerPath Management Appliance is a PowerPath host management application from Dell Inc. that offers two models: a virtual machine-based appliance and a Docker containerized appliance. An authorization issue vulnerability exists in Dell PowerPath Management Appliance versions 7.0, 7.1, a...

Unspecified Vulnerability in Oracle MySQL Server (CNVD-2023-65514)

Oracle MySQL Server is a relational database from Oracle Corporation. Oracle MySQL Server has a security vulnerability that can be exploited by attackers to cause a takeover of MySQL Server...

Campcodes Online Traffic Offense Management System SQL Injection Vulnerability (CNVD-2023-29406)

Campcodes Online Traffic Offense Management System is a web-based traffic offense management system. A SQL injection vulnerability exists in Campcodes Online Traffic Offense Management System v1.0. The vulnerability stems from the lack of validation of external input SQL statements in the paramet...

MediaWiki authorization error vulnerability (CNVD-2023-29701)

MediaWiki is a free and free-to-use web-based wiki engine from the MediaWiki Foundation, which can be used to deploy in-house knowledge management and content management systems. An authorization error vulnerability exists in the MediaWiki GrowthExperiments extension, which could be exploited by ...

Adobe Dimension Stack Buffer Overflow Vulnerability

Adobe Dimension is a set of 2D and 3D composite design tools from the American company Audobee Adobe. Adobe Dimension suffers from a stack buffer overflow vulnerability that can be exploited by an attacker to execute arbitrary code in the context of the current user...

Siemens Tecnomatix Plant Simulation Out-of-Bounds Read Vulnerability (CNVD-2023-18932)

Siemens Tecnomatix Plant Simulation is an industrial control device from Siemens, Germany. Using the function of discrete event simulation for production volume analysis and optimization, and thus improve the manufacturing system performance. A security vulnerability exists in versions prior to...

Fortinet FortiWeb Buffer Overflow Vulnerability (CNVD-2023-18294)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. A buffer overflow vulnerability exists that...

Apache Airflow Sqoop Provider Input Validation Error Vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An input validation error vulnerability exists in Apache Airflow Sqoop Provider...

Fortinet FortiWeb has an unspecified vulnerability (CNVD-2023-18296)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. A security vulnerability exists that could b...

Mozilla Firefox Code Execution Vulnerability (CNVD-2023-68438)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox prior to version 110, which stems from an invalid down conversion in GetTableSelectionMode, and can be exploited by attackers to cause undefined...

Mozilla Firefox Denial of Service Vulnerability (CNVD-2023-68440)

Arbitrary Code Execution Vulnerability in Various Apple Products...

Adobe After Effects Out-of-Bounds Read Vulnerability (CNVD-2023-17024)

Adobe After Effects is a set of visual effects and motion graphics production software from the American company Audobee Adobe. The software is mainly used for 2D and 3D synthesis, animation and visual effects production. Adobe After Effects suffers from an out-of-bounds read vulnerability that...

WordPress plugin 0mk Shortener Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

IBM Tivoli Workload Scheduler XML External Entity Injection Vulnerability

IBM Tivoli Workload Scheduler is a suite of enterprise task scheduling software from International Business Machines IBM. IBM Tivoli Workload Scheduler suffers from an external entity injection vulnerability that can be exploited by a remote attacker to submit a special request that could obtain...

Siretta QUARTZ-GOLD Buffer Overflow Vulnerability (CNVD-2023-17066)

Siretta QUARTZ-GOLD is an industrial router with multiple features and services.A buffer overflow vulnerability exists in Siretta QUARTZ-GOLD, which can be exploited by attackers to cause arbitrary command execution by sending specially crafted network packets...

TL-WDR7660 httpProcDataSrv arbitrary code execution vulnerability in Pulian Technology Co.

TL-WDR7660 is a Gigabit router from China Pulian TP-LINK. Ltd. TL-WDR7660 httpProcDataSrv arbitrary code execution vulnerability, which can be exploited by remote attackers to submit special requests to execute arbitrary code in the application context...

SAP BPC MS SQL Injection Vulnerability

SAP BPC MS is a business planning and consolidation application from SAP Germany that provides planning, budgeting, forecasting, and financial consolidation functions. SAP BPC MS version 10.0 810 contains a SQL injection vulnerability that stems from the application's lack of validation of...

TRENDnet TEW-755AP stack overflow vulnerability (CNVD-2023-18952)

The TRENDnet TEW-755AP is a router from TRENDnet. The TRENDnet TEW-755AP suffers from a stack overflow vulnerability that stems from the lack of size checking of input data in the qcawifi.wifi%dvap%d.maclist parameter in the kickbanwifimacallow sub415B00 function, which can be exploited by an...

Mozilla Firefox competition condition vulnerability

Mozilla Firefox is an open source Web browser from the Mozilla Foundation in the U.S. Mozilla Firefox is vulnerable to a competitive condition vulnerability that exists from a competitive condition in the maintenance updater service. An attacker could exploit the vulnerability to write access to...

Google Android elevation of privilege vulnerability (CNVD-2023-07675)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by an attacker to elevate privileges...

Adobe Experience Manager Cross-Site Scripting Vulnerability (CNVD-2023-00610)

Adobe Experience Manager AEM is a content management solution from Adobe that can be used to build websites, mobile applications and forms. The solution supports mobile content management, marketing and sales campaign management, and multi-site management, etc. A cross-site scripting vulnerabilit...

Siemens Parasolid out-of-bounds write vulnerability (CNVD-2022-87977)

An out-of-bounds write vulnerability exists in Siemens Parasolid, a geometric modeling kernel from Siemens, Germany, due to an out-of-bounds write beyond the end of the allocation structure contained in a specially crafted XB file parsed by the affected application. The vulnerability allows an...

Google Android Information Disclosure Vulnerability (CNVD-2023-04550)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability, which is caused by a logic error in the code beginning with Threads.cpp. An attacker can exploit the vulnerability to obtain sensitive information...

Google Chrome Forms Code Execution Vulnerability

Google Chrome is a web browser from Google, an American company. A code execution vulnerability exists in Google Chrome Forms, which can be exploited by an attacker to execute arbitrary code on a system or cause a denial of service...

WordPress OWM Weather plugin SQL Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

Google Chrome Camera Capture Code Execution Vulnerability

Google Chrome is a web browser from Google, an American company. A code execution vulnerability exists in Google Chrome Camera Capture, which can be exploited by an attacker to execute arbitrary code on a system or cause a denial of service...

WordPress Photospace Gallery plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress Photospace Galler...