Apache SkyWalking SQL Injection Vulnerability

Apache SkyWalking is an application performance monitor from the Apache Software USA Foundation primarily for environments such as microservices, cloud-native and container-based. An SQL injection vulnerability exists in the H2/MySQL/TiDB storage implementation in Apache SkyWalking versions 6.0.0...

WordPress Gtranslate Cross-Site Scripting Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress Gtranslate versions prior to 2.8.52, which stems from...

Codiad Web IDE Code Injection Vulnerability

Codiad Web IDE is Codiad project a set of Web-based IDE Integrated Development Environment. A code injection vulnerability exists in Codiad Web IDE 2.8.4 and earlier versions, which can be exploited by an attacker to inject PHP code...

openfortivpn Certificate Validation Mishandling Vulnerability

openfortivpn is a client program for PPP Point-to-Point Protocol + SSL Transport Layer Security Protocol VPN tunneling service. A security vulnerability exists in openfortivpn version 1.11.0 using OpenSSL versions prior to 1.0.2, which stems from a failure to take into account the '' character wh...

ELTEX NTP-RG-1402G Operating System Command Injection Vulnerability

ELTEX NTP-RG-1402G is a router product from the Russian company ELTEX. An operating system command injection vulnerability exists in the ELTEX NTP-RG-1402G 1v10 version 3.25.3.32. The vulnerability stems from a network system or product not properly filtering special characters, commands, etc. fr...

CloudBees Jenkins Information Disclosure Vulnerability (CNVD-2020-17202)

CloudBees Jenkins is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . There is a security vulnerability in...

WordPress SlickQuiz SQL Injection Vulnerability

WordPress is a suite of blogging platforms developed in the PHP language by the WordPress Foundation.SlickQuiz is a plugin for displaying and managing nice dynamic quizzes. WordPress SlickQuiz suffers from a SQL injection vulnerability that can be exploited by attackers to execute illegal SQL...

SquirrelMail Cross-Site Scripting Vulnerability (CNVD-2019-20986)

SquirrelMail is a set of PHP language development , cross-platform Webmail mail system . A cross-site scripting vulnerability exists in SquirrelMail versions 1.4.22 and later and version 1.5.x before 1.5.2. The vulnerability stems from a lack of proper validation of client data by the web...

PyXDG Code Injection Vulnerability

PyXDG is a python library that accesses the freedesktop.org standard. A code injection vulnerability exists in PyXDG versions prior to 0.26, which can be exploited by an attacker to generate an illegal code segment that modifies the intended execution control flow of a networked system or compone...

FeiFeiCms v4.1.190209 Has Arbitrary File Read Vulnerability

FeiFeiCms is a PHP movie program. FeiFeiCms v4.1.190209 suffers from an arbitrary file read vulnerability, which stems from failing to filter the input of . / filtering, an attacker can exploit this vulnerability to read arbitrary files...

TCPFLOW Stack Buffer Overflow Vulnerability

TCPFLOW is a network monitoring tool that records TCP sessions. A stack buffer overflow vulnerability exists in the 'setbit' function of the iptree.h file in TCPFLOW version 1.5.0, which originates from a program receiving an incorrect value, which results in a computation error. An attacker can...

marshmallow library for Python Information Disclosure Vulnerability

Python is an open source, object-oriented programming language from the Python Software Foundation. The language is extensible, supports modules and packages, and supports multiple platforms. marshmallow library is one of the lightweight libraries for converting complex objects into Python data...

OpenPGP Information Disclosure Vulnerability

OpenPGP is a set of email encryption standards that supports multiple platforms. An information disclosure vulnerability exists in OpenPGP. An attacker could exploit this vulnerability to conduct a man-in-the-middle attack and obtain messages in plaintext form from encrypted emails...

bibutils null pointer dereference vulnerability

bibutils is a document format conversion tool. A security vulnerability exists in the 'fieldsadd' function in the fields.c file of the libbibcore.a file in bibutils 6.2 and earlier. A remote attacker can exploit this vulnerability to cause a denial of service null pointer backreference and...

FreeRDP Code Execution Vulnerability

FreeRDP is a is a FreeRDP team developed a Windows, OSX and Linux platform based on the free, open source implementation of the Remote Desktop Protocol RDP. A remote code execution vulnerability exists in FreeRDP version 2.0.0-beta1+android11 for Windows, OSX and Linux platforms. A remote attacke...

Apache Syncope Remote Code Execution Vulnerability

Apache Syncope is the United States Apache Apache Software Foundation's set of open source digital identity management system for use in enterprise environments. The system supports identity management, role configuration and more. A security vulnerability exists in Apache Syncope versions 1.2.x...

GraphicsMagick Denial of Service Vulnerability (CNVD-2017-28584)

GraphicsMagick is a simple set of image processing tools. The tool provides resizing, rotating, highlighting and other functions to images. A security vulnerability exists in the 'GMCommand' function in the magick/command.c file in GraphicsMagick version 1.3.26. A remote attacker can exploit this...

VMware Workstation Pro for Linux and VMware Workstation Player for Linux Elevation of Privilege Vulnerability

VMware Workstation Pro for Linux and VMware Workstation Player for Linux are both Linux-based virtual machine software products from VMware.VMware Workstation Pro for Linux is one of the VMware Workstation Pro for Linux is one of the professional editions; VMware Workstation Player for Linux is a...

OpenStack Image Service (kilo) Directory Traversal Vulnerability

OpenStack is the massively scalable cloud operating system. A directory traversal vulnerability in OpenStack Image Service 2015.1.x version kilo prior to 2015.1.2 allows an authenticated, remote user to read arbitrary files from a backup file created with the "qcow2" image...

Huawei HarmonyOS Power Consumption Statistics Module Competitive Conditions Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A competitive condition vulnerability exists in the Huawei HarmonyOS Power Consumption Statistics module, which can be exploited by an attacker to cause...

WordPress Plugin Avada Core Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress plugin Avada Core, which stems fro...

Apache Shiro Authentication Bypass Vulnerability

Apache Shiro is the United States Apache Apache Foundation set of Java security framework for performing authentication, authorization, encryption and session management . An authentication bypass vulnerability exists in Apache Shiro versions prior to 2.0.7. The vulnerability stems from an...

WordPress BigBuy Dropshipping Connector for WooCommerce plugin IP address forgery vulnerability

WordPress BigBuy Dropshipping Connector for WooCommerce plugin is an open source plugin for the WordPress platform for WooCommerce e-commerce platform , support and BigBuy and other Dropshipping supplier docking , to achieve automatic synchronization of goods It supports interfacing with BigBuy a...

Freescout Helper::decrypt() function deserialization vulnerability

FreeScout is an open source helpdesk system built on the PHP Laravel framework, designed to provide users with functionality similar to Zendesk or Help Scout, but without sacrificing privacy or freedom. Freescout suffers from a deserialization vulnerability that stems from an application that...

Tenda AC20 Buffer Overflow Vulnerability

Tenda AC20 is a dual-band wireless router with IPv6 protocol support, featuring a triple-core 1GHz main controller with six 6dBi external antennas and a maximum wireless transmission rate of 2033Mbps. The Tenda AC20 suffers from a buffer overflow vulnerability that originates from a flaw in the...

Microsoft Azure Machine Learning elevation of privilege vulnerability (CNVD-2025-17136)

Microsoft Azure Machine Learning is a machine learning services platform from Microsoft USA. Microsoft Azure Machine Learning has a security vulnerability that can be exploited by an attacker to potentially cause elevation of privilege...

SAMSUNG MagicINFO 9 Server Path Traversal Vulnerability

SAMSUNG MagicINFO 9 Server is an enterprise-class digital signage content management and device monitoring platform from Samsung Korea. SAMSUNG MagicINFO 9 Server suffers from a path traversal vulnerability that can be exploited by an attacker to execute arbitrary code on the system...

SonicWall SMA1000 Cross-Site Request Forgery Vulnerability

The SonicWALL SMA1000 is a series of secure mobile access solutions from SonicWALL, Inc. simplifies end-to-end secure remote access to enterprise resources hosted across local, cloud and hybrid data centers. The SonicWALL SMA1000 suffers from a cross-site request forgery vulnerability that stems...

Siemens Tecnomatix Plant Simulation Out-of-Bounds Write Vulnerability (CNVD-2024-45993)

Siemens Tecnomatix Plant Simulation is an industrial control device from Siemens, Germany. Using the function of discrete event simulation for production volume analysis and optimization, and thus improve the manufacturing system performance. Siemens Tecnomatix Plant Simulation suffers from an...

Google Chrome Code Execution Vulnerability (CNVD-2024-48377)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a code execution vulnerability that is caused by type confusion in V8. An attacker can exploit the vulnerability to execute arbitrary code on the system...

Siemens Tecnomatix Plant Simulation Stack Buffer Overflow Vulnerability (CNVD-2024-45987)

Siemens Tecnomatix Plant Simulation is an industrial control device from Siemens, Germany. Using the function of discrete event simulation for production volume analysis and optimization, and thus improve the manufacturing system performance. A stack buffer overflow vulnerability exists in Siemen...

Microsoft SQL Server Native Client Remote Code Execution Vulnerability (CNVD-2025-02466)

Microsoft SQL Server is the United States Microsoft Microsoft company's set of applications in the Microsoft Windows system under the large commercial database system. A remote code execution vulnerability exists in Microsoft SQL Server Native Client, which can be exploited by an attacker to...

Apache Solr Authentication Error Vulnerability

Apache Solr is the United States Apache Apache Foundation of a search server based on Lucene a full-text search engine. The product supports level search , vertical search , highlighting search results and so on. An authentication error vulnerability exists in Apache Solr that stems from the...

Microsoft SQL Server Elevation of Privilege Vulnerability

Microsoft SQL Server is the United States Microsoft Microsoft company's set of applications in the Microsoft Windows system under the large commercial database system. An elevation of privilege vulnerability exists in Microsoft SQL Server, which can be exploited by an attacker to execute arbitrar...

Unspecified Vulnerability in Mattermost (CNVD-2024-35160)

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a security vulnerability that stems from a failure to disable modification of local users when synchronizing users in a shared channel. An attacker could use the vulnerability t...

Unspecified Vulnerability in Oracle MySQL Connectors (CNVD-2024-34919)

Oracle MySQL is an open source relational database management system from Oracle Corporation.MySQL Connectors is one of the drivers for connecting applications that use MySQL. A security vulnerability exists in Oracle MySQL Connectors, which can be exploited by an attacker to cause unauthorized...

Z-BlogPHP cross-site scripting vulnerability (CNVD-2024-32984)

Z-BlogPHP is an open source PHP-based blogging system for the Z-blog community. Z-BlogPHP suffers from a cross-site scripting vulnerability that can be exploited by an attacker to execute arbitrary web script or HTML via a crafted payload...

Mozilla Firefox Spoofing Vulnerability (CNVD-2024-29137)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A spoofing vulnerability exists in versions of Mozilla Firefox prior to 127, which can be exploited by an attacker to spoof the location URL bar...

Microsoft Excel Remote Code Execution Vulnerability (CNVD-2024-19332)

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. A remote code execution vulnerability exists in Microsoft Excel, which can be exploited by an attacker to execute arbitrary code on a system...

Apache Zeppelin Input Validation Error Vulnerability (CNVD-2024-17937)

Apache Zeppelin is a Web-based open source laptop application from the Apache USA Foundation. The program supports interactive data analysis and collaborative documentation. Apache Zeppelin suffers from an input validation error vulnerability that can be exploited by an attacker to execute a...

Siemens Parasolid Null Pointer Dereference Vulnerability

Siemens Parasolid is a 3D geometric modeling tool that supports a variety of techniques including solid modeling, direct editing and free-form surface/drawing modeling. A null pointer dereference vulnerability exists in Siemens Parasolid, which can be exploited by an attack to crash the applicati...

Moodle Denial of Service Vulnerability (CNVD-2024-13538)

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A denial-of-service vulnerability exists in Moodle, which stems from insufficient file size checking, and can be exploited by an attack...

Siemens Sinteso EN and Cerberus PRO EN Fire Protection Systems Buffer Overflow Vulnerability

Cerberus PRO EN is a fire protection system consisting of fire panels, detection and management stations. It is available to Siemens partners and complies with the European standard EN 54 for fire detection and alarm systems. Sinteso EN is a fire protection system consisting of fire panels,...

SWFTools swfc.c Denial of Service Vulnerability

SWFTools is a set of utilities for working with Adobe Flash files SWF files. A denial of service vulnerability exists in SWFTools version v0.9.2, which originates from a function sfont in the file swftools/src/swfc.c that contains a segmentation conflict. An attacker can exploit this vulnerabilit...

Fortinet FortiSIEM Operating System Command Injection Vulnerability

Fortinet FortiSIEM is a suite of security information and event management systems from the American company Fiat Fortinet. The system includes features such as asset discovery, workflow automation and unified management. Fortinet FortiSIEM suffers from an operating system command injection...

IBM Security Verify Access Information Disclosure Vulnerability (CNVD-2024-09176)

IBM Security Verify Access is a service from International Business Machines IBM that improves user access security. An information disclosure vulnerability exists in IBM Security Verify Access, which can be exploited by an attacker to compromise a server...

SWFTools q.c Page Buffer Overflow Vulnerability

SWFTools is a set of utilities for working with Adobe Flash files SWF files. A buffer overflow vulnerability exists in SWFTools version 0.9.2, which stems from the dictforeachkeyvalue method on the swftools/lib/q.c page failing to correctly validate the length and size of the input data, and can ...

Apache Pulsar WebSocket Proxy Denial of Service Vulnerability

Apache Pulsar is a U.S. Apache Apache Foundation for cloud environments, set of messages, storage, lightweight functional computing as a distributed message flow platform. A denial of service vulnerability exists in Apache Pulsar WebSocket Proxy, which can be exploited by an attacker to cause a...

Web Server Denial of Service Vulnerability in Various Siemens Products (CNVD-2023-97269)

SIMATIC PC Station is a software component that manages SIMATIC software products and interfaces on a PC.SIMATIC S7-400 controllers are designed for discrete and continuous control in industrial environments such as manufacturing, food and beverage, and chemical industries around the world. A...

Siemens SINEC INS Denial of Service Vulnerability (CNVD-2023-97253)

SINEC INS Infrastructure Network Services is a web-based application that combines various network services in one tool. This simplifies the installation and management of all network services associated with industrial networks. A denial of service vulnerability exists in Siemens SINEC INS, whic...