SourceCodester Bank Management System SQL Injection Vulnerability

Bank Management System is a bank management system. SourceCodester Bank Management System is vulnerable to SQL injection, which can be exploited by attackers to execute illegal SQL commands to steal sensitive database data...

WordPress theme Discy cross-site request forgery vulnerability

WordPress is a blogging platform developed in PHP by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress theme is a theme for WordPress. A cross-site request forgery vulnerability exists in WordPress theme Discy versions prior to...

WordPress Bestbooks plugin SQL注入漏洞

WordPress and others are products of the WordPress Foundation. WordPress is a blogging platform developed in PHP. stb and others are products of the WordPress Foundation. stb is a single-file public domain library for C/C. WordPress plugin is an application plugin. WordPress Bestbooks plugin 2.6....

WordPress WP Born Babies plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress WP Born Babies plugin version 1.0 and prior versions contain a cross-site scripting vulnerability...

Rescue Dispatch Management System SQL注入漏洞（CNVD-2022-53917）

Rescue Dispatch Management System is a rescue dispatch management system from Carlo Montero's personal developer. v1.0 of Rescue Dispatch Management System is vulnerable to SQL injection, which originates from /rdms/admin/ incidentreports/viewreport.php?id=The page lacks validation for external...

Online Fire Reporting System SQL注入漏洞

Online Fire Reporting System is an online fire reporting system from Carlo Montero's personal developer. version v1.0 of Online Fire Reporting System is vulnerable to SQL injection, which originates from /ofrs/classes/Master.php?f= deleteteam lacks validation of external input SQL statements, whi...

HUAWEI HarmonyOS Buffer Overflow Vulnerability (CNVD-2022-66178)

HUAWEI HarmonyOS is an operating system from Huawei, China HUAWEI. HUAWEI HarmonyOS 2.0 is vulnerable to a buffer overflow vulnerability that can be exploited by attackers to cause availability impairment...

TOTOLINK EX1200T Command Injection Vulnerability (CNVD-2022-53569)

TOTOLINK EX1200T is a Wi-Fi range extender from China-based Gion Electronics TOTOLINK.TOTOLINK EX1200T has a command injection vulnerability, which originates from the NTPSyncWithHost function of the file system containing a remote command injection issue that can be exploited by an attacker to...

BigBlueButton Information Disclosure Vulnerability (CNVD-2022-82640)

BigBlueButton is an open source Web conferencing system from the BigBlueButton community.BigBlueButton is vulnerable to an information disclosure vulnerability that could be exploited by an attacker to find information related to an external video being shared...

solidus_backend cross-site request forgery vulnerability

Solidus is an open source e-commerce system. solidusbackend is the administrative interface of the Solidus e-commerce framework. solidusbackend is vulnerable to cross-site request forgery, which can be exploited by attackers to change the status of order adjustments while holding an order number,...

Publify Access Control Error Vulnerability

Publify is a simple but full-featured web publishing software.An access control error vulnerability exists in versions of Publify prior to 9.2.9, which stems from incorrect access control. An attacker could exploit this vulnerability to allow an unprivileged user to modify/delete an administrator...

Cisco UCS Director Cross-Site Scripting Vulnerability (CNVD-2022-68519)

Cisco UCS Director is a private cloud infrastructure-as-a-service IaaS heterogeneous platform from Cisco Cisco U.S. A cross-site scripting vulnerability exists in versions prior to Cisco UCS Director 6.6, which stems from a lack of data validation filtering of user-supplied data and output. An...

Elgg Cross-Site Scripting Vulnerability (CNVD-2022-38755)

Elgg is a set of open source social networking engine. The product blogs, file sharing, groups and other features. elgg has a cross-site scripting vulnerability, there are no details of the vulnerability provided...

Publify Access Control Error Vulnerability

Publify is a simple but full-featured web publishing software.An access control error vulnerability exists in versions of Publify prior to 9.2.8. The vulnerability stems from an access control error in draft mode, which could be exploited by an attacker to comment on articles in draft mode...

Xtend Cross-Site Scripting Vulnerability

Xtend is a general-purpose high-level programming language for the Eclipse Foundation's Java Virtual Machine. Xtend Voice Logger version 1.0 has a security vulnerability that stems from a cross-site scripting vulnerability in the error page. An attacker can use the vulnerability to execute...

TOTOLINK N600R Command Injection Vulnerability (CNVD-2022-53554)

TOTOLINK N600R is a wireless router from Taiwan-based Gion Electronics TOTOLINK, China.A command injection vulnerability exists in TOTOLINK N600R, which can be exploited by attackers to conduct command injection attacks via the ipdoamin parameter in /setting/setDiagnosisCfg...

Microsoft Windows Print Spooler Components Information Disclosure Vulnerability

An information disclosure vulnerability exists in Microsoft Windows Print Spooler Components, a print backend processor component of Microsoft Corporation. The vulnerability stems from a configuration or other error in the operation of the network system or product. An attacker could use this...

TOTOLINK N600R Command Injection Vulnerability (CNVD-2022-53553)

TOTOLINK N600R is a wireless router from Taiwan-based TOTOLINK, which is vulnerable to a command injection attack via the devicename parameter in /etting/setDeviceName...

Mattermost has an unspecified vulnerability (CNVD-2022-65351)

Mattermost is an open source collaboration platform from Mattermost, a US-based company. mattermost has a security vulnerability and no details of the vulnerability are available at this time...

FANUC ROBOGUIDE path traversal vulnerability

FANUC ROBOGUIDE is a robot simulation software from FANUC, Japan.ROBOGUIDE v9.40083.00.05 and earlier versions have a path traversal vulnerability, which originates from an improper restriction of pathnames to restricted directories. An attacker can exploit this vulnerability using special elemen...

FIS GT.M Denial of Service Vulnerability

FIS GT.M is a database platform. A security vulnerability exists in FIS GT.M versions prior to V7.0-000, which can be exploited by an attacker to calculate the size of a call to memset in opfnj3 in srport/opfnj3.c, resulting in a very large value that can cause a segmentation error and crash the...

Microsoft Windows Print Spooler Elevation of Privilege Vulnerability (CNVD-2022-62513)

Microsoft Windows Print Spooler is a print backend processor component of Microsoft Corporation USA.An elevation of privilege vulnerability exists in Microsoft Windows Print Spooler, which could be exploited by attackers to execute arbitrary code with elevated privileges...

Microsoft Windows Telephony Serve Elevation of Privilege Vulnerability

Microsoft Windows is a set of operating systems for use on personal devices from the American company Microsoft. An elevation of privilege vulnerability exists in Microsoft Windows Telephony Server. The vulnerability stems from an incorrect programmatic call to an advanced local procedure. An...

Microsoft Visual Studio Elevation of Privilege Vulnerability (CNVD-2022-60135)

Microsoft Visual Studio is a family of development tool suites from Microsoft, and a largely complete development toolset that includes most of the tools needed throughout the software life cycle. An elevation of privilege vulnerability exists in Microsoft Visual Studio Code, which stems from...

AeroCMS Cross-Site Scripting Vulnerability (CNVD-2022-30784)

AeroCMS is a content management system from AeroCMS, Inc. A cross-site scripting vulnerability exists in AeroCMS v0.0.1, which can be exploited to execute arbitrary Web script or HTML by injecting a specially crafted payload into the "comment" text field...

Rumble Mail Server Code Execution Vulnerability

Rumble Mail Server is a mail server suite for SMTP ESMTPSA, HTTP, POP3 and IMAP4v1 by Daniel Gruno, a personal developer.A code execution vulnerability exists in Rumble Mail Server version 0.51.3135, which stems from an unquoted service path in The service path is not referenced in RumbleService,...

Omron CX-Position Buffer Overflow Vulnerability

Omron CX-Position is a position control software from Omron Corporation of Japan. Simplifies all aspects of position control, from creating/editing data used in a position control unit NC unit to online communication and monitoring operations.Omron CX-Position suffers from a buffer overflow...

showdoc .properties file upload vulnerability (CNVD-2022-20508)

showdoc is an open source tool for IT teams to share documents online. showdoc versions prior to v2.10.4 are vulnerable to file uploads, which stem from the lack of effective detection of .properties file extensions in the application's file upload feature. An attacker could use this vulnerabilit...

Totolink X5000R and TotoLink A7000R Command Injection Vulnerability (CNVD-2022-21813)

Totolink X5000R is a router from Totolink, China.TotoLink A7000R is a wireless router from TotoLink, China.Totolink routers X5000R V9.1.0u.6118B20201102 and A7000R V9.1.0u.6115 B20201022 contain a security vulnerability that could be exploited by attackers to execute arbitrary commands via crafte...

Nacos Cross-Site Scripting Vulnerability

Nacos is a dynamic service discovery, configuration and service management platform for Alibaba China. It supports DNS-based and RPC-based service discovery, and can provide features such as providing real-time health checks and blocking services from sending requests to unhealthy hosts or servic...

Samsung Wear Os Access Control Error Vulnerability

Samsung Wear Os is a version of the Android operating system from Samsung South Korea, designed for wearable computer devices such as smartwatches. Designed for wearable computer devices such as smartwatches, an access control error vulnerability exists in StRetailModeReceiver in Samsung Wear Os ...

Luocms SQL Injection Vulnerability (CNVD-2022-20133)

Luocms is an article management system. A SQL injection vulnerability exists in Luocms v2.0, which stems from a lack of validation of external input SQL statements in /admin/news/newsmod.php. An attacker could use this vulnerability to execute illegal SQL commands to steal sensitive database data...

SAP Focused Run Access Control Error Vulnerability

SAP Focused Run is a data center and large customer systems operations management solution the ultimate solution for high volume monitoring, alerting, diagnostics and analysis from SAP. An Access Control Error vulnerability exists in SAP Focused Run, which stems from a failure to perform any...

Microsoft Azure Site Recovery Permissions Licensing and Access Control Issues Vulnerability (CNVD-2022-17999)

Microsoft Azure Site Recovery is a site recovery DRaaS from Microsoft Corporation for cloud and hybrid cloud architectures. Microsoft Azure Site Recovery is vulnerable to privilege permission and access control issues. No details of the vulnerability are available at this time...

IBM Jazz Reporting Service Cross-Site Scripting Vulnerability (CNVD-2022-28800)

IBM Jazz Reporting Service helps you quickly and easily integrate data from a variety of data sources across your tools and projects, and provides a set of ready-to-use reports for sharing information about your lifecycle management projects. A cross-site scripting vulnerability exists in IBM Jaz...

Liferay Portal and Liferay DXP Cross-Site Scripting Vulnerability (CNVD-2022-19499)

Liferay Portal and Liferay DXP are both products of Liferay, a J2EE-based portal solution that uses EJB and JMS technologies and serves as a web publishing and shared workspace, enterprise collaboration platform, social network, etc. Liferay DXP is a digital experience collaboration platform...

Htmly Cross-Site Scripting Vulnerability (CNVD-2022-73492)

Htmly is a PHP-based blogging platform. version 2.8.1 of Htmly is vulnerable to a cross-site scripting vulnerability. An attacker can exploit this vulnerability to execute arbitrary web script HTML via a specially crafted payload in the blog post content field...

WordPress Yoast SEO plugin information leakage vulnerability

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. An information disclosure vulnerability exists in versions of the WordPress Yoast SEO plugin prior to...

TOTOLink A860R Command Injection Vulnerability

TOTOLink A860R is a wireless router from TotoLink, China.TOTOLink A860R V4.1.2cu.5182B20201027 is vulnerable to command injection, which can be exploited by attackers to execute arbitrary commands via the QUERYSTRING parameter...

Envoy Trust Management Issue Vulnerability (CNVD-2022-15535)

Envoy is an open source distributed proxy server. Envoy is vulnerable to a trust management issue, which stems from the fact that Envoy's tls allows certain certificate authentication settings to be reused after they have been changed from their default configuration. No detailed vulnerability...

Siemens Simcenter Femap Out-of-Bounds Write Vulnerability (CNVD-2022-12808)

Simcenter Femap is an advanced simulation application for creating, editing, and inspecting finite element models of complex products or systems.Siemens Simcenter Femap out-of-bounds write vulnerability can be exploited by attackers to execute code in the context of the current process...

Cisco RCM for Cisco StarOS Software拒绝服务漏洞

Cisco RCM for Cisco StarOS Software is a denial-of-service vulnerability that could be exploited to cause the checkpoint manager process to restart upon receipt of malformed TCP data...

Samsung Wear Os StTheaterModeReceiver Access Control Error Vulnerability (CNVD-2022-56487)

Samsung Wear Os is a version of the Android operating system from Samsung South Korea designed for wearable computer devices such as smartwatches. An access control error vulnerability exists in versions of Samsung Wear OS prior to 3.0, which is designed for wearable computer devices such as...

SAP NetWeaver Application Server ABAP and ABAP Platform信息泄露漏洞

SAP NetWeaver Application Server is an application server from SAP, Germany.An information disclosure vulnerability exists in SAP NetWeaver Application Server ABAP and ABAP Platform, which can be exploited by attackers to read connection details stored in SAP The vulnerability can be exploited to...

Emlog Cross-Site Scripting Vulnerability (CNVD-2022-11528)

Emlog is a PHP and MySQL-based CMS website builder from Emlog personal developers. Emlog suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data by the WEB application. An attacker could use this vulnerability to execute JavaScript code ...

Reolink RLC-410W Information Disclosure Vulnerability (CNVD-2022-10268)

Reolink Rlc-410W is a Wifi security camera from Reolink China.A security vulnerability exists in the TLS hard-coded key of Reolink RLC-410W v3.0.0.13620121102, which can be exploited by attackers to obtain sensitive information...

Siemens Teamcenter Visualization and Solid Edge File Parsing Vulnerability

Siemens Teamcenter Visualization is a software that provides team collaboration capabilities for designing 2D and 3D scenes. Siemens Solid Edge is a 3D CAD software from Siemens, Germany. Siemens Teamcenter Visualization and Solid Edge is vulnerable to file parsing, which can be exploited by...

Oracle MySQL Cluster Buffer Overflow Vulnerability (CNVD-2022-07917)

Oracle MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database developed by Oracle Corporation USA. Oracle MySQL Cluster buffer overflow vulnerability can be exploited by attackers to read the contents of memory or crash the application...

Oracle MySQL Cluster Buffer Overflow Vulnerability (CNVD-2022-07918)

Oracle MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database developed by Oracle Corporation. Oracle MySQL Cluster is vulnerable to a buffer overflow vulnerability that could be exploited by an attacker to read the contents of memory or crash the application...

YetiForceCrm Cross-Site Request Forgery Vulnerability (CNVD-2022-08153)

YetiForceCrm is an open source Crm system from the Polish company YetiForce. A cross-site request forgery vulnerability exists in YetiForceCrm prior to version 6.3.0, which stems from a lack of proper validation of client-side data by the WEB application. An attacker could exploit this...