Apache Airflow Cross-Site Scripting Vulnerability (CNVD-2024-26529)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow version 2.9.0 suffers from a cross-site scripting vulnerability that...

FleetCart Information Disclosure Vulnerability

FleetCart is an e-commerce CMS from FleetCart, Inc. An information disclosure vulnerability exists in FleetCart version 4.1.1 and earlier versions, which stems from insufficient protection of sensitive information in the razorpayKeyId parameter and can be exploited by an attacker to obtain...

Siemens Teamcenter Visualization and JT2Go stack buffer overflow vulnerability (CNVD-2024-23523)

Siemens Teamcenter Visualization is a software that provides teamwork capabilities for designing 2D and 3D scenarios.Siemens JT2Go is a JT file viewer. A stack buffer overflow vulnerability exists in Siemens Teamcenter Visualization and JT2Go, which can be exploited by an attacker to execute code...

Unspecified Vulnerability in Oracle VM VirtualBox (CNVD-2024-20434)

Oracle Virtualization and Oracle VM VirtualBox are both products of Oracle Corporation.Oracle Virtualization is a suite of virtualization solutions. The product is used to unify the management of the entire hardware and software system from the application to the disk, can be achieved from the...

Apache Zeppelin Cross-Site Scripting Vulnerability (CNVD-2024-17939)

Apache Zeppelin is a Web-based open source laptop application from the Apache USA Foundation. The program supports interactive data analysis and collaborative documentation. Apache Zeppelin suffers from a cross-site scripting vulnerability that stems from improper coding or escaping, which can be...

Google Chrome Security Bypass Vulnerability (CNVD-2024-16877)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a security bypass vulnerability that stems from an incorrect security UI in iOS. An attacker can exploit this vulnerability to bypass security restrictions...

Command Execution Vulnerability in Dahua EIMS System of Zhejiang Dahua Technology Co.

Zhejiang Dahua Technology Co., Ltd. is the world's leading video-centered intelligent IOT solution provider and operation service provider. A command execution vulnerability exists in the Dahua EIMS system of Zhejiang Dahua Technology Co. Ltd, which can be exploited by attackers to gain server...

Dell Digital Delivery Memory Misreference Vulnerability

Dell Digital Delivery is an application from Dell USA dedicated to Dell computer equipment for the online purchase of pre-installed software for computers. Dell Digital Delivery suffers from a memory misreference vulnerability that originates from a mix-up in the program's instructions responsibl...

Graylog Authorization Issues Vulnerability

Graylog is a centralized log management solution from Graylog USA. The product supports capturing, storing and analyzing logs in real time, among other things. Graylog has an authorization issue vulnerability that stems from the presence of a cookie injection vulnerability. A remote attacker coul...

Cisco Unified Communications Products Command Execution Vulnerability

Cisco Unified Communications Products is a series of unified communications products from the U.S. company Cisco Cisco. A command execution vulnerability exists in Cisco Unified Communications Products that stems from improper handling of user-supplied data read into memory. An attacker could...

Apache Guacamole Integer Overflow Vulnerability

Apache Guacamole is a clientless remote desktop gateway from the Apache USA Foundation. The product supports protocols such as VNC, RDP and SSH. An integer overflow vulnerability exists in Apache Guacamole 1.5.3 and earlier versions, which can be exploited by an attacker to execute arbitrary code...

Siemens SINEC INS Denial of Service Vulnerability

SINEC INS Infrastructure Network Services is a web-based application that combines various network services in one tool. This simplifies the installation and management of all network services associated with industrial networks. A denial of service vulnerability exists in Siemens SINEC INS, whic...

Web Server Denial of Service Vulnerability in Various Siemens Products (CNVD-2023-97269)

SIMATIC PC Station is a software component that manages SIMATIC software products and interfaces on a PC.SIMATIC S7-400 controllers are designed for discrete and continuous control in industrial environments such as manufacturing, food and beverage, and chemical industries around the world. A...

Google Android Denial of Service Vulnerability (CNVD-2024-07124)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from a denial of service vulnerability due to a flaw in PersistableBundle.java's saveToXml, which can be exploited by an attacker to cause a denial of service...

Fortinet FortiEDR Access Control Error Vulnerability (CNVD-2023-98184)

Fortinet FortiEDR is an endpoint security solution built from the ground up by Fortinet. An Access Control Error vulnerability exists in Fortinet FortiEDR Collector Windows that stems from the presence of improper access controls in the application. A local attacker could exploit the vulnerabilit...

Huawei HarmonyOS and EMUI Privilege Management Vulnerability

Huawei HarmonyOS is an operating system from Huawei, a Chinese company. It provides a full-scenario distributed operating system based on a microkernel.Huawei EMUI is a user interface developed by Huawei based on the Android operating system. Huawei HarmonyOS and EMUI have a privilege management...

D-Link DAR-7000 importexport.php file SQL injection vulnerability

D-Link DAR-7000 is an Internet Behavior Audit Gateway from China AUO D-Link. A SQL injection vulnerability exists in the D-Link DAR-7000 importexport.php file. An attacker can exploit this vulnerability to execute illegal SQL commands to steal sensitive database data...

Siemens SINEC NMS Incorrect Privilege Assignment Vulnerability

Siemens SINEC NMS is a network management system NMS from Siemens, Germany, that can be used 24/7 to centrally monitor, manage and configure industrial networks with tens of thousands of devices, including safety-related areas. The Siemens SINEC NMS suffers from an Incorrect Privilege Assignment...

Huawei HarmonyOS Denial of Service Vulnerability (CNVD-2023-98208)

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A denial of service vulnerability exists in Huawei HarmonyOS, which stems from the presence of mutual exclusion lock management in kernel modules. An attacke...

IBM Aspera Faspex Information Disclosure Vulnerability (CNVD-2023-76768)

IBM Aspera is a set of fast file transfer and streaming solutions built on the IBM FASP protocol from International Business Machines IBM. An information disclosure vulnerability exists in IBM Aspera Faspex, which can be exploited by attackers to obtain sensitive information...

Apache Airflow Input Validation Error Vulnerability (CNVD-2023-70278)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An input validation error vulnerability exists in Apache Airflow Sqoop Provider...

Exiv2 buffer overflow vulnerability (CNVD-2023-68223)

Exiv2 is a suite of C++ libraries and command line applications for managing image metadata. It provides the ability to read and write image metadata in a variety of formats including EXIF, IPTC and XMP. A buffer overflow vulnerability exists in Exiv2 version 0.27.1, which stems from a boundary...

Siemens EFI Boot Guard Code Execution Vulnerability

Siemens EFI Boot Guard is a simple UEFI boot loader from Siemens Germany. A code execution vulnerability exists in Siemens EFI Boot Guard versions prior to 0.15, which stems from insufficient input validation and cleanup, and can be exploited by an attacker to execute arbitrary code in privileged...

NETGEAR R7100LG Command Injection Vulnerability

The NETGEAR R7100LG is a router from the American company NETGEAR. A hardware device that connects two or more networks and acts as a gateway between networks. The NETGEAR R7100LG version 1.0.0.78 suffers from a command injection vulnerability that stems from the password parameter in...

SAP Message Server Authorization Issues Vulnerability

SAP Message Server is a message server application from SAP Germany. SAP Message Server is vulnerable to authorization issues, no details of the vulnerability are provided at this time...

SAP Host Agent Information Disclosure Vulnerability (CNVD-2023-65176)

SAP Host Agent is a set of agent programs from SAP that supports a number of lifecycle management tasks such as operating system monitoring, database monitoring and system instance monitoring. An information disclosure vulnerability exists in SAP Host Agent that stems from a lack of authenticatio...

Siemens SIMATIC MV500 Devices Uncontrolled Resource Consumption Vulnerability (CNVD-2023-56540)

SIMATIC MV500 products are fixed optical readers for capturing print, laser, drill, punch and dotted line codes on a variety of different surfaces. Siemens SIMATIC MV500 Devices has an uncontrolled resource consumption vulnerability that can be exploited by an attacker to cause a denial of servic...

SQL Injection Vulnerability in e-cology of Shanghai Panmicro Network Technology Co. Ltd (CNVD-2023-65262)

E-cology is an OA office system made for large and medium-sized enterprises, supporting PC, mobile and WeChat simultaneous office and so on. E-cology of Shanghai Panmicro Network Technology Co., Ltd. suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensiti...

Milesight UR32L set_qos function buffer overflow vulnerability (CNVD-2023-65125)

The Milesight UR32L is a 4G industrial router from China's Milesight. A buffer overflow vulnerability exists in the Milesight UR32L setqos function, which can be exploited by an attacker to cause a buffer overflow and execute arbitrary code on the system, or cause an application to crash...

IBM Spectrum Protect Backup-Archive Client Access Control Error Vulnerability

IBM Spectrum Protect Backup-Archive Client is a set of client programs for IBM Spectrum Protect file backup, archiving from International Business Machines IBM. An Access Control Error vulnerability exists in IBM Spectrum Protect Backup-Archive Client 8.1.0.0 through 8.1.17.2, which stems from...

Google Android Input Validation Error Vulnerability (CNVD-2023-53154)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an input validation error vulnerability that can be exploited by an attacker to cause a local denial of service...

Unauthorized access vulnerability in SuperMap iServer of Beijing SuperMap Software Co. Ltd (CNVD-2023-61163)

SuperMap iServer is a cloud GIS application server based on high-performance cross-platform GIS kernel. An unauthorized access vulnerability exists in SuperMap iServer of Beijing SuperMap Software Co. Ltd, which can be exploited by attackers to obtain sensitive information...

Rockwell Automation Kinetix 5500 Access Control Error Vulnerability

The Rockwell Automation Kinetix 5500 is the first Kinetix drive from Rockwell Automation designed with an external common AC/DC bus connection system. It reduces hardware requirements and allows for seamless expansion, using a single platform for single- or multi-axis systems. An access control...

Google Chrome CORS Security Bypass Vulnerability

Google Chrome is a web browser from Google, an American company. Google Chrome CORS security bypass vulnerability can be exploited by attackers to bypass security restrictions...

chatwoot Cross-Site Scripting Vulnerability (CNVD-2023-29696)

chatwoot is an application. Customer Engagement Suite, an open source alternative to intercom, Zendesk, Salesforce Service Cloud, etc. A cross-site scripting vulnerability exists in chatwoot versions prior to 2.14.0. The vulnerability stems from the application's lack of effective filtering and...

Campcodes Advanced Online Voting System SQL Injection Vulnerability (CNVD-2023-29411)

Campcodes Advanced Online Voting System is an online voting system. Campcodes Advanced Online Voting System v1.0 is vulnerable to SQL injection. The vulnerability stems from the lack of validation of external input SQL statements in the parameter id of the file /admin/ballotdown.php, which can be...

SAP Web Dispatcher Access Control Error Vulnerability

SAP Web Dispatcher is the core component of Load Balancing from SAP, which supports load balancing and provides the function of reverse proxy so that users from outside the network can access internal applications. An Access Control Error vulnerability exists in SAP Web Dispatcher, which stems fr...

Microsoft Windows DNS Remote Code Execution Vulnerability (CNVD-2023-44303)

Microsoft Windows DNS is a domain name resolution service from Microsoft. The Domain Name System DNS is one of the industry-standard suite of protocols that encompasses TCP/IP, and DNS clients and DNS servers work together to provide name resolution services for computers and users that map...

Foxit PDF Reader Resource Management Error Vulnerability (CNVD-2023-25117)

Foxit PDF Reader is a PDF reader from Foxit China. Foxit PDF Reader is vulnerable to resource management errors, which can be exploited to execute arbitrary code in the context of the current process...

IBM Security Guardium Information Disclosure Vulnerability (CNVD-2023-20082)

IBM Security Guardium is a suite of platforms from International Business Machines IBM that provide data protection capabilities. The platform includes features such as customizable UI, report management and streamlined audit process building.IBM Security Guardium Key Lifecycle Manager is...

Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability (CNVD-2023-28103)

Microsoft PostScript Printer Driver is a Microsoft standard printer driver for PostScript printers from Microsoft USA. Microsoft PCL6 Class Printer Driver is a printer driver software from Microsoft Corporation. Microsoft PostScript and PCL6 Class Printer Driver contains a remote code execution...

Google Android elevation of privilege vulnerability (CNVD-2023-21686)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by an attacker to cause a local privilege escalation without requiring additional execute privileges...

phpMyFAQ Cross-Site Scripting Vulnerability (CNVD-2023-09628)

phpMyFAQ is a multilingual, fully database-driven FAQ system. phpMyFAQ versions prior to 3.1.11 are vulnerable to a cross-site scripting vulnerability that originates from cross-site scripting XSS. No detailed vulnerability details are currently available...

F5 BIG-IP AFM Denial of Service Vulnerability (CNVD-2023-05962)

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A denial of service vulnerability exists in F5 BIG-IP AFM, where undisclosed traffic could cause TMM to crash when an AFM NAT...

Microsoft SharePoint Server Remote Code Execution Vulnerability (CNVD-2023-53468)

Microsoft SharePoint Server is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A remote code...

Google Android Denial of Service Vulnerability (CNVD-2023-18909)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from a denial of service vulnerability that can be exploited by attackers to cause a denial of service...

Tenda A15 wepkey1 parameter stack overflow vulnerability

Tenda A15 is a WiFi extender from Tenda, China. A stack overflow vulnerability exists in the Tenda A15 wepkey1 parameter, which stems from a lack of length checking of input data in the wepkey1 parameter of /goform/WifiBasicSet, and can be exploited by attackers to execute arbitrary code on the...

School Dormitory Management System SQL Injection Vulnerability

School Dormitory Management System is a school dormitory management system. A SQL injection vulnerability exists in School Dormitory Management System version 1.0, which stems from an unknown function in its Admin Login component that allows an attacker to perform SQL injection...

Apache Traffic Server Exception Handling Error Vulnerability

Apache Traffic Server ATS is a set of scalable HTTP proxy and caching servers from the Apache Foundation, U.S. An exception handling error vulnerability exists in Apache Traffic Server. An attacker could exploit this vulnerability to crash the server under certain conditions...

Adobe Illustrator out-of-bounds read vulnerability (CNVD-2023-07317)

Adobe Illustrator is a set of vector-based image creation software from Adobe. Adobe Illustrator has an out-of-bounds read vulnerability that can be exploited by attackers to bypass mitigations such as ASLR and cause sensitive memory leaks...