SAP Business One Code Injection Vulnerability (CNVD-2022-58479)

SAP Business One is a suite of enterprise management software from SAP, a German company. SAP Business One Hana Chef Cookbook contains a code injection vulnerability that could be exploited to inject code that can be executed by the application...

Microsoft Windows/Windows Server Elevation of Privilege Vulnerability (CNVD-2021-66100)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, an operating system for personal devices, and Microsoft Windows Server, a server operating system. An elevation of privilege vulnerability exists in the "Container Manager Service" of Microsoft...

OpenClinic GA SQL Injection Vulnerability (CNVD-2021-29426)

OpenClinic GA is an open source hospital integrated information management system . An SQL injection vulnerability exists in the description parameter in getAssets.jsp in OpenClinic GA version 5.173.3. An attacker can exploit this vulnerability by sending an HTTP request to perform a SQL injectio...

GitLab Access Control Error Vulnerability (CNVD-2021-22453)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab after version...

GE MU320E Insufficient Encryption Strength Vulnerability

The MU320E is a process interface unit from GE with integrated analog and digital merge interfaces. An insufficient cryptographic strength vulnerability exists in the firmware prior to GE MU320E 04A00.1. The vulnerability stems from some aspects of the SSH server configuration file not being...

Microsoft HEVC Video Extensions Remote Code Execution Vulnerability (CNVD-2021-70134)

Microsoft HEVC Video Extensions is a video extension application from Microsoft USA. The application enables computers and devices to read High Efficiency Video Coding or HEVC videos. A remote code execution vulnerability exists in Microsoft HEVC Video Extensions. An attacker could exploit this...

Unspecified Vulnerability in Mozilla Firefox (CNVD-2021-15355)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox. No details of the vulnerability are provided at this time...

Unspecified Vulnerability in Mozilla Rust

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in flatbuffers crate in versions of Mozilla Rust prior to 0.6.1, which stems from the fact that an arbitrary byte can be reinterpreted as a bool.No details of the vulnerability ar...

i-SENSYS MF237w Information Disclosure Vulnerability

i-SENSYS MF237w is a 4-in-1 multifunction laser printer from Canon for small offices. i-SENSYS MF237w 06.07 is vulnerable to an information disclosure. The vulnerability stems from improper handling of inconsistent length parameters by the IPv4/ICMPv4 component. An attacker could exploit the...

Microsoft Windows/Windows Server Elevation of Privilege Vulnerability (CNVD-2021-90797)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, an operating system for personal devices, and Microsoft Windows Server, a server operating system. An elevation-of-privilege vulnerability exists in Microsoft Windows/Windows Server, which stems from a...

CAYIN Technology xPost SQL Injection Vulnerability

CAYIN Technology xPost is a digital signage system for conference room management from CAYIN Technology in Taiwan, China. A SQL injection vulnerability exists in CAYIN Technology xPost 2.5 and prior versions. The vulnerability stems from a database-based application that lacks validation of...

Caddy Authorization Issues Vulnerability

Caddy is an open source , cross-platform HTTP/Web server . A security vulnerability exists in Caddy versions prior to 0.10.13 that stems from the program not properly handling TLS client authentication. An attacker can exploit the vulnerability to bypass authentication...

WordPress Access Control Error Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An access control error vulnerability exists in WordPress versions 3.7 through 5.4. The vulnerability arises...

Microsoft ChakraCore and Edge Buffer Overflow Vulnerability

Microsoft ChakraCore and Microsoft Edge are both products of Microsoft Corporation.ChakraCore is the core of an open-source Chakra JavaScript scripting engine used in the Edge browser, and is also available as a standalone JavaScript engine. Microsoft Edge is a web browser that comes with Windows...

TypeStack class-validator SQL Injection Vulnerability

TypeStack class-validator is a class validator. A SQL injection vulnerability exists in TypeStack class-validator version 0.10.2, which can be exploited to bypass security checks by injecting attribute entries into user input to override internal attribute entries with the same name...

Webmin Code Issue Vulnerability

Webmin is a set of Web-based system management tools for Unix-like operating systems. Webmin is vulnerable to a code issue. The vulnerability arises from an improper design or implementation during code development of a Web system or product. No details of the vulnerability are available at this...

Joomla Directory Traversal Vulnerability

Joomla! is a U.S. Open Source Matters team using PHP and MySQL development of a set of open source , cross-platform content management system CMS. Media Manager is used in one of the media management components . A path traversal vulnerability exists in commedia in Joomla! CMS versions 1.5.0...

Red Hat Ceph Unauthorized Access Vulnerability

Red Hat Ceph is a Linux petabyte-level distributed file system from Red Hat. The main goal of the system is to be designed as a distributed file system based on POSIX Portable Operating System Interface without a single point of failure, so that data can be fault-tolerant and seamless replication...

Flex Denial of Service Vulnerability

flex is a program for recognizing lexical patterns in text. A security vulnerability exists in the 'markbeginningasnormal' function in the nfa.c file in flex version 2.6.4. A remote attacker can exploit this vulnerability to cause a denial of service...

Apache Syncope Cross-Site Scripting Vulnerability

Apache Syncope is an open source system for managing digital identities in enterprise environments, implemented using Java EE technology and released under the Apache 2.0 license. A stored cross-site scripting vulnerability exists in Apache Syncope. A malicious user with sufficient administrative...

rubyzip Zip::File component path traversal vulnerability

The rubyzip gem is a Ruby library for reading and writing zip files. zip::File is one of the components for unzipping files. A directory traversal vulnerability exists in the Zip::File component in rubyzip 1.2.1 and earlier versions. An attacker can exploit this vulnerability by uploading a...

bibutils Read Access Conflict Vulnerability

bibutils is a document format conversion tool. A security vulnerability exists in the 'isiinkeyword' function in the isiin.c file of the libbibutils.a file in bibutils 6.2 and earlier, which stems from a read access privilege conflict in the program. A remote attacker could exploit this...

Buffer Overflow Vulnerability in Multiple WECON Products

WECON LeviStudio HMI Editor and PI Studio HMI Project Programmer are both HMI programming software from WECON Technologies, China. A buffer overflow vulnerability exists in WECON LeviStudio HMI Editor and PI Studio HMI Project Programmer versions prior to November 11, 2017 . A remote attacker can...

Unspecified Vulnerability in Micro Focus openSUSE

Micro Focus openSUSE is a Linux-based free operating system from Micro Focus in the UK. openSUSE Leap is a version of openSUSE. A security vulnerability exists in the build package of Micro Focus openSUSE Leap, which stems from the program's failure to validate directory names. An attacker could...

Advantech WebAccess Denial of Service Vulnerability (CNVD-2018-00673)

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. A denial of service vulnerability exists in Advantech...

ImageMagick ExtractPostscript function macrocycle vulnerability

ImageMagick is a software for creating, editing, and compositing images that can read, convert, and write images in many formats. A macrocycle vulnerability exists in the ExtractPostscript function in coders/wpg.c in ImageMagick 7.0.7-12 Q16. An attacker can exploit this vulnerability to cause a...

SoundTouch Denial of Service Vulnerability (CNVD-2017-26277)

SoundTouch is an open-source audio processing library for changing the speed, pitch, and playback rate of an audio stream, among other things. A security vulnerability exists in the 'TDStretch::processSamples' function in the source/SoundTouch/TDStretch.cpp file in SoundTouch version 1.9.2. A...

Libsamplerate Buffer Overflow Vulnerability

libsamplerate is an open source resampling program. A buffer overflow vulnerability exists in libsamplerate that stems from an inability to perform proper boundary checks on user-supplied data. An attacker could exploit this vulnerability to compromise an affected application, resulting in a deni...

LibVNCServer heap buffer overflow vulnerability (CNVD-2017-00065)

LibVNCServer is cross-platform C library. A heap buffer overflow vulnerability exists in versions of LibVNCServer prior to 0.9.11 that can be exploited by an attacker to execute arbitrary code within the context of an application. Failure to exploit could result in a denial of service condition...

Spring Security OAuth Remote Command Execution Vulnerability

Spring is a lightweight Java development framework . Security OAuth provides a Spring Security authorization filter . A remote command execution vulnerability exists in Spring Security OAuth that could be exploited by an attacker to execute arbitrary code in the context of an affected application...

Wolf CMS Metasploit module arbitrary file upload vulnerability (CNVD-2016-04300)

Wolf CMS is a content management system CMS.Metasploit is one of the security vulnerability detection tool components. An arbitrary file upload vulnerability exists in the Metasploit module of Wolf CMS version 0.8.2. An attacker can use this vulnerability to upload arbitrary files to the /public...

Microsoft Windows Graphics Memory Corruption Vulnerability (CNVD-2016-02246)

Microsoft Windows is a series of operating systems released by the American company Microsoft. A remote code execution vulnerability exists in the font library of Microsoft Windows, which arises from a failure of the program to properly handle specially designed embedded fonts. A remote attacker...

Jenkins Remote Code Execution Vulnerability

Jenkins, formerly Hudson is an extensible continuous integration engine. A remote code execution vulnerability exists in Jenkins. Allowing an attacker to execute arbitrary code in the context of an affected application...

Google Chrome Blink Denial of Service Vulnerability (CNVD-2015-05799)

Google Chrome is a WEB-based browser. A vulnerability in the ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in Google Chrome Blink allows remote attackers to construct a malicious WEB page and trick users into parsing it, which can bypass the same-origin policy and execut...

Django Denial of Service Vulnerability (CNVD-2015-05667)

Django is a set of Django Software Foundation based on the Python language open source Web application framework. A denial of service vulnerability exists in Django that allows remote attackers to cause a denial of service...

Google Go Denial of Service Vulnerability (CNVD-2026-10647)

Google Go is a static strongly typed, compiled, concatenated, and garbage-collected programming language from Google. A denial of service vulnerability exists in Google Go, which stems from the use of a hyperlinear filename indexing algorithm, and can be exploited by an attacker to cause a denial...

Unspecified Vulnerability in JetBrains IntelliJ IDEA

JetBrains IntelliJ IDEA is an integrated development environment IDE developed by JetBrains , designed to improve developer productivity and code quality , mainly for Java programming , but also supports Kotlin, Web, Spring and other languages and frameworks . A security vulnerability exists in...

Microsoft Azure Machine Learning elevation of privilege vulnerability (CNVD-2025-17136)

Microsoft Azure Machine Learning is a machine learning services platform from Microsoft USA. Microsoft Azure Machine Learning has a security vulnerability that can be exploited by an attacker to potentially cause elevation of privilege...

Zoo Management System /admin/index.php File SQL Injection Vulnerability

Zoo Management System is a zoo management system. Zoo Management System suffers from a SQL injection vulnerability that originates from the lack of validation of an externally entered SQL statement in the parameter Username in file /admin/index.php. An attacker can exploit this vulnerability to...

TOTOLINK A3002R formDhcpv6s Interface addrPoolEnd Parameter Buffer Overflow Vulnerability

The TOTOLINK A3002R is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK A3002R suffers from a buffer overflow vulnerability that originates from the failure of the addrPoolEnd parameter in the formDhcpv6s interface to correctly validate the length size of the input data, and...

Tenda AC8 Stack Buffer Overflow Vulnerability (CNVD-2025-07606)

Tenda AC8 is a wireless router from Tenda, a Chinese company. The Tenda AC8 suffers from a stack buffer overflow vulnerability, which stems from the deviceid parameter in the getparentControllistInfo function failing to properly validate the length of the input data, which can be exploited by an...

Delta Electronics CNCSoft-G2 Input Validation Error Vulnerability

Delta Electronics CNCSoft-G2 is a human-machine interface HMI software from Delta Electronics, China. An input validation error vulnerability exists in Delta Electronics CNCSoft-G2 version 2.1.0.16 and prior versions, which can be exploited by an attacker to execute code in the current process...

Google Chrome Code Execution Vulnerability (CNVD-2025-05085)

Google Chrome is a web browser from Google, an American company. A code execution vulnerability exists in Google Chrome prior to version 134.0.6998.88, which stems from type obfuscation in V8 and can be exploited by an attacker to execute arbitrary code on a system...

Huawei HarmonyOS and EMUI display module memory misreference vulnerability

Huawei HarmonyOS is an operating system from Huawei, a Chinese company. It provides a full-scenario distributed operating system based on a microkernel.Huawei EMUI is a user interface developed by Huawei based on the Android operating system. A memory misreference vulnerability exists in Huawei...

Dell PowerStore Parameter Injection Vulnerability

Dell PowerStore is a scalable all-flash array storage from Dell USA. The Dell PowerStore suffers from a parameter injection vulnerability that originates from improper parameter delimiter neutralization, which can be exploited by an attacker to modify arbitrary system files...

Siemens Solid Edge Out-of-Bounds Read Vulnerability (CNVD-2024-45218)

Solid Edge is a portfolio of software tools that address a variety of product development processes: 3D design, simulation, manufacturing and design management. Siemens Solid Edge suffers from an out-of-bounds read vulnerability that can be exploited by an attacker to execute code in the context ...

Triangle MicroWorks SCADA Data Gateway Information Disclosure Vulnerability

Triangle MicroWorks SCADA Data Gateway is a SCADA data gateway product from Triangle MicroWorks, Inc. An information disclosure vulnerability exists in Triangle MicroWorks SCADA Data Gateway, which can be exploited by attackers to obtain sensitive information...

Apache Airflow code execution vulnerability (CNVD-2024-33592)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow suffers from a code execution vulnerability that can be exploited by...

Mozilla Firefox Security Bypass Vulnerability (CNVD-2024-29140)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security bypass vulnerability exists in Mozilla Firefox, which can be exploited by attackers to bypass security restrictions...

Tenda W20E Stack Buffer Overflow Vulnerability

The Tenda W20E is a wireless router developed by Tenda to provide wireless network connectivity and management capabilities. The Tenda W20E suffers from a stack buffer overflow vulnerability that originates from improper handling of the remoteIP parameter in the formSetRemoteWebManage function in...