WordPress WP Maintenance plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WordPress plugin is an application plugin. WordPress...

FIS GT.M Denial of Service Vulnerability

FIS GT.M is a database platform. A security vulnerability exists in FIS GT.M versions prior to V7.0-000, which can be exploited by an attacker to calculate the size of a call to memset in opfnj3 in srport/opfnj3.c, resulting in a very large value that can cause a segmentation error and crash the...

Microsoft Windows Print Spooler Elevation of Privilege Vulnerability (CNVD-2022-62513)

Microsoft Windows Print Spooler is a print backend processor component of Microsoft Corporation USA.An elevation of privilege vulnerability exists in Microsoft Windows Print Spooler, which could be exploited by attackers to execute arbitrary code with elevated privileges...

Microsoft Windows Telephony Serve Elevation of Privilege Vulnerability

Microsoft Windows is a set of operating systems for use on personal devices from the American company Microsoft. An elevation of privilege vulnerability exists in Microsoft Windows Telephony Server. The vulnerability stems from an incorrect programmatic call to an advanced local procedure. An...

AeroCMS Cross-Site Scripting Vulnerability (CNVD-2022-30784)

AeroCMS is a content management system from AeroCMS, Inc. A cross-site scripting vulnerability exists in AeroCMS v0.0.1, which can be exploited to execute arbitrary Web script or HTML by injecting a specially crafted payload into the "comment" text field...

Rumble Mail Server Code Execution Vulnerability

Rumble Mail Server is a mail server suite for SMTP ESMTPSA, HTTP, POP3 and IMAP4v1 by Daniel Gruno, a personal developer.A code execution vulnerability exists in Rumble Mail Server version 0.51.3135, which stems from an unquoted service path in The service path is not referenced in RumbleService,...

Omron CX-Position Buffer Overflow Vulnerability

Omron CX-Position is a position control software from Omron Corporation of Japan. Simplifies all aspects of position control, from creating/editing data used in a position control unit NC unit to online communication and monitoring operations.Omron CX-Position suffers from a buffer overflow...

Wordpress Plugin Paid Memberships Pro SQL Injection Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in Wordpress Plugin Paid Memberships Pro versions prior to 2.6....

showdoc .properties file upload vulnerability (CNVD-2022-20508)

showdoc is an open source tool for IT teams to share documents online. showdoc versions prior to v2.10.4 are vulnerable to file uploads, which stem from the lack of effective detection of .properties file extensions in the application's file upload feature. An attacker could use this vulnerabilit...

Totolink X5000R and TotoLink A7000R Command Injection Vulnerability (CNVD-2022-21813)

Totolink X5000R is a router from Totolink, China.TotoLink A7000R is a wireless router from TotoLink, China.Totolink routers X5000R V9.1.0u.6118B20201102 and A7000R V9.1.0u.6115 B20201022 contain a security vulnerability that could be exploited by attackers to execute arbitrary commands via crafte...

TP-Link Omada Controller Software Licensing Issue Vulnerability

TP-Link Omada Controller Software is a set of software from Tp-link that supports the management of wireless access points.TP-Link Omada Controller Software versions prior to 5.0.15 are vulnerable to authorization issues, which stem from a lack of authentication measures or insufficient...

Samsung Wear Os Access Control Error Vulnerability

Samsung Wear Os is a version of the Android operating system from Samsung South Korea, designed for wearable computer devices such as smartwatches. Designed for wearable computer devices such as smartwatches, an access control error vulnerability exists in StRetailModeReceiver in Samsung Wear Os ...

Luocms SQL Injection Vulnerability (CNVD-2022-20133)

Luocms is an article management system. A SQL injection vulnerability exists in Luocms v2.0, which stems from a lack of validation of external input SQL statements in /admin/news/newsmod.php. An attacker could use this vulnerability to execute illegal SQL commands to steal sensitive database data...

SAP Focused Run Access Control Error Vulnerability

SAP Focused Run is a data center and large customer systems operations management solution the ultimate solution for high volume monitoring, alerting, diagnostics and analysis from SAP. An Access Control Error vulnerability exists in SAP Focused Run, which stems from a failure to perform any...

Siemens RUGGEDCOM ROS has an unspecified vulnerability (CNVD-2022-17784)

Siemens RuggedCom ROS is an operating system used in the RuggedCom family of switches from Siemens, Germany. Siemens RUGGEDCOM ROS has a security vulnerability that could be exploited by attackers to act as a man-in-the-middle and eavesdrop on encrypted communications...

Microsoft Azure Site Recovery Permissions Licensing and Access Control Issues Vulnerability (CNVD-2022-17999)

Microsoft Azure Site Recovery is a site recovery DRaaS from Microsoft Corporation for cloud and hybrid cloud architectures. Microsoft Azure Site Recovery is vulnerable to privilege permission and access control issues. No details of the vulnerability are available at this time...

IBM Jazz Reporting Service Cross-Site Scripting Vulnerability (CNVD-2022-28800)

IBM Jazz Reporting Service helps you quickly and easily integrate data from a variety of data sources across your tools and projects, and provides a set of ready-to-use reports for sharing information about your lifecycle management projects. A cross-site scripting vulnerability exists in IBM Jaz...

Liferay Portal and Liferay DXP Cross-Site Scripting Vulnerability (CNVD-2022-19499)

Liferay Portal and Liferay DXP are both products of Liferay, a J2EE-based portal solution that uses EJB and JMS technologies and serves as a web publishing and shared workspace, enterprise collaboration platform, social network, etc. Liferay DXP is a digital experience collaboration platform...

Htmly Cross-Site Scripting Vulnerability (CNVD-2022-73492)

Htmly is a PHP-based blogging platform. version 2.8.1 of Htmly is vulnerable to a cross-site scripting vulnerability. An attacker can exploit this vulnerability to execute arbitrary web script HTML via a specially crafted payload in the blog post content field...

WordPress Yoast SEO plugin information leakage vulnerability

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. An information disclosure vulnerability exists in versions of the WordPress Yoast SEO plugin prior to...

TOTOLink A860R Command Injection Vulnerability

TOTOLink A860R is a wireless router from TotoLink, China.TOTOLink A860R V4.1.2cu.5182B20201027 is vulnerable to command injection, which can be exploited by attackers to execute arbitrary commands via the QUERYSTRING parameter...

Envoy Trust Management Issue Vulnerability (CNVD-2022-15535)

Envoy is an open source distributed proxy server. Envoy is vulnerable to a trust management issue, which stems from the fact that Envoy's tls allows certain certificate authentication settings to be reused after they have been changed from their default configuration. No detailed vulnerability...

Cisco RCM for Cisco StarOS Software拒绝服务漏洞

Cisco RCM for Cisco StarOS Software is a denial-of-service vulnerability that could be exploited to cause the checkpoint manager process to restart upon receipt of malformed TCP data...

Samsung Wear OS has an unspecified vulnerability

Samsung Wear Os is a version of the Android operating system from the South Korean company Samsung. It is designed for wearable computer devices such as smartwatches. Wear OS has a security vulnerability that stems from allowing untrusted apps to fail to disable theater mode with proper...

WordPress WOOF plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed by the WordPress Foundation using the PHP language. WordPress WOOF plugin has a cross-site scripting vulnerability in versions prior to 1.2.6.3, which stems from the lack of escaping of woofredrawelements and can be exploited by attackers to...

SAP NetWeaver Application Server ABAP and ABAP Platform信息泄露漏洞

SAP NetWeaver Application Server is an application server from SAP, Germany.An information disclosure vulnerability exists in SAP NetWeaver Application Server ABAP and ABAP Platform, which can be exploited by attackers to read connection details stored in SAP The vulnerability can be exploited to...

Emlog Cross-Site Scripting Vulnerability (CNVD-2022-11528)

Emlog is a PHP and MySQL-based CMS website builder from Emlog personal developers. Emlog suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data by the WEB application. An attacker could use this vulnerability to execute JavaScript code ...

Reolink RLC-410W Information Disclosure Vulnerability (CNVD-2022-10268)

Reolink Rlc-410W is a Wifi security camera from Reolink China.A security vulnerability exists in the TLS hard-coded key of Reolink RLC-410W v3.0.0.13620121102, which can be exploited by attackers to obtain sensitive information...

Siemens Simcenter Femap内存破坏漏洞

Siemens Simcenter Femap is a cutting-edge engineering simulation application from Siemens, Germany. It is used to create, edit and import/reuse mesh-based finite element analysis models of complex products or systems. Siemens Simcenter Femap suffers from a memory corruption vulnerability that can...

Siemens Teamcenter Visualization and Solid Edge File Parsing Vulnerability

Siemens Teamcenter Visualization is a software that provides team collaboration capabilities for designing 2D and 3D scenes. Siemens Solid Edge is a 3D CAD software from Siemens, Germany. Siemens Teamcenter Visualization and Solid Edge is vulnerable to file parsing, which can be exploited by...

SPIP Cross-site Request Forgery Vulnerability (CNVD-2022-08190)

SPIP is a Web-based content publishing system. A cross-site request forgery vulnerability exists in SPIP, which stems from a Web application that does not adequately validate that requests are coming from trusted users. An attacker could use this vulnerability to send unintended requests to the...

Oracle MySQL Cluster Buffer Overflow Vulnerability (CNVD-2022-07917)

Oracle MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database developed by Oracle Corporation USA. Oracle MySQL Cluster buffer overflow vulnerability can be exploited by attackers to read the contents of memory or crash the application...

Oracle MySQL Cluster Buffer Overflow Vulnerability (CNVD-2022-07918)

Oracle MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database developed by Oracle Corporation. Oracle MySQL Cluster is vulnerable to a buffer overflow vulnerability that could be exploited by an attacker to read the contents of memory or crash the application...

YetiForceCrm Cross-Site Request Forgery Vulnerability (CNVD-2022-08153)

YetiForceCrm is an open source Crm system from the Polish company YetiForce. A cross-site request forgery vulnerability exists in YetiForceCrm prior to version 6.3.0, which stems from a lack of proper validation of client-side data by the WEB application. An attacker could exploit this...

Jerryscript has an unspecified vulnerability (CNVD-2022-07250)

JerryScript, a lightweight JavaScript engine from the JerryScript project, has a security vulnerability in Jerryscript version 3.0.0, which originates in /jerry-core/ecma/base/ecma-helpers- A heap-based buffer overflow exists in ecmautf8stringtonumberbyradix in conversion.c. No detailed...

JerryScript ecma-helpers-string.c Denial of Service Vulnerability

JerryScript is a lightweight JavaScript engine from the JerryScript project.JerryScript has a denial-of-service vulnerability in version 3.0.0, which stems from a failed assertion in /base/ecma-helpers-string.c. An attacker could use this vulnerability to launch a denial of service...

F5 BIG-IP has an unspecified vulnerability (CNVD-2022-72754)

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. F5 BIG-IP has a security vulnerability that can be exploited by attackers to cause a denial of service...

NUUO NVRmini2 Authorization Issues Vulnerability

NUUO NVRMini2 is a small network DVR device from NUUO, Taiwan, China. The NUUO NVRmini2 suffers from an authorization issue vulnerability that can be exploited by attackers to upload encrypted TAR archives...

Jenkins Input Validation Error Vulnerability (CNVD-2022-05101)

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.The Jenkins Credentials Binding Plugin is vulnerable to an input validation error that stems from the plugin's failure to...

Jenkins Mailer Plugin Cross-Site Request Forgery Vulnerability

Jenkins is a Jenkins open source application . An open source automation server Jenkins provides hundreds of plug-ins to support building, deploying and automating any project . A cross-site request forgery vulnerability exists in Jenkins Mailer that stems from the software's lack of validation f...

Google Android Competitive Conditions Issue Vulnerability (CNVD-2022-15197)

Google Android is a Linux-based open source operating system from Google. A competitive conditions issue vulnerability exists in Google Android, which can be exploited by an attacker to cause a local privilege escalation...

Google Chrome PDF code execution vulnerability

Google Chrome is a web browser from Google, Inc. A code execution vulnerability exists in Google Chrome PDF, which can be exploited by remote attackers to execute arbitrary code on a system or cause a denial of service condition...

BeyondTrust Remote Support Cross-Site Request Forgery Vulnerability

BeyondTrust Remote Support is a remote desktop access, help desk and collaboration software for Windows, Mac, Linux, Ios iPad, iPhone, etc. BeyondTrust Remote Support is vulnerable to cross-site request forgery. The vulnerability stems from the lack of proper validation of client-side data in the...

Mozilla Rust Denial of Service Vulnerability (CNVD-2022-04515)

Rust, a general-purpose, compiled programming language from the Mozilla Foundation, has a security vulnerability in versions prior to Rust ckb crate 0.40.0 that stems from an inability to allocate memory for misbehavior HashMap. An attacker could exploit this vulnerability to cause a denial of...

MediaWiki licensing issue vulnerability (CNVD-2022-03907)

MediaWiki is a free and free-to-use web-based wiki engine from the U.S. Wikimedia MediaWiki Foundation. The product can be used to deploy internal knowledge management and content management systems. mediaWiki suffers from an authorization issue vulnerability that stems from a lack of...

WordPress RegistrationMagic plugin authorization problem vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. registrationMagic plugin is a WordPress open source application plugin. the WordPress RegistrationMagic plugin has an...

Mozilla Firefox Input Validation Error Vulnerability (CNVD-2021-99624)

Mozilla Firefox is an open source Web browser from the Mozilla Foundation. Mozilla Firefox is vulnerable to an input validation error that could be exploited to trick users into copying and pasting an image link into a page through a Web site, which would be able to steal authentication tokens...

AOM buffer overflow vulnerability

Aom is a next-generation open source digital media technology for everyone organized by the Alliance For Open Media. version 2.0.1 of AOM contains a buffer overflow vulnerability that stems from a global buffer overflow in the component av1/encoder/partitionsearch.h. No detailed vulnerability...

D-Link DIR-809 fromLogin Buffer Overflow Vulnerability (CNVD-2021-94720)

A buffer overflow vulnerability exists in the D-Link DIR-809, a dual-band router from D-Link, China, which stems from the failure of the sub8003183C function in the product/fromLogin link to effectively determine data boundaries. An attacker could cause a buffer overflow resulting in a denial of...

Open Design Alliance Drawings SDK Out-of-Bounds Writing Vulnerability (CNVD-2022-01426)

Open Design Alliance Drawings SDK is a software development kit for drawing design applications from Open Design Alliance, Inc. The package provides access to data in .dwg and .dgn through a convenient, object-oriented API, C API, support for repair files, support for . The vulnerability can be...