ThinkPHP Command Execution Vulnerability (CNVD-2022-86535)

ThinkPHP is an open source lightweight PHP framework created to simplify enterprise-level application development and agile WEB application development. ThinkPHP there is a command execution vulnerability , the vulnerability is due to the opening of the multi-language function , the parameter lan...

Google Android Elevation of Privilege Vulnerability (CNVD-2022-47670)

Google Android is a Linux-based open source operating system from Google, Inc. An elevation of privilege vulnerability exists in Google Android, which originates in checkSlicePermission in SliceManagerService.java, due to an input validation error, it is possible to access any slice URI, and an...

Huawei CV81-WDM FW Buffer Overflow Vulnerability

The Huawei CV81-WDM FW is a laser multifunction printer from Huawei China. A buffer overflow vulnerability exists in the Huawei CV81-WDM FW. The vulnerability stems from a networked system or product that does not properly validate data boundaries when performing operations on memory, and can be...

Bootstrap Cross-Site Scripting Vulnerability (CNVD-2022-73141)

Bootstrap is a web front-end framework developed using HTML, CSS, and JavaScript. Bootstrap versions v3.1.11 and v3.3.7 are vulnerable to a cross-site scripting vulnerability that originates in the Title parameter in /vendor/views/addproduct.php. An attacker could exploit this vulnerability to...

Shopware Access Control Error Vulnerability

Shopware is a suite of open source e-commerce software from the German company Shopware. Shopware is vulnerable to an access control error that stems from not properly setting sensitive HTTP headers to non-cacheable, which could be exploited by an attacker to enable HTTP caching and then have...

WordPress SpiderCalendar plugin跨站脚本漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. WordPress SpiderCalendar plugin is vulnerable to a cross-site scripting vulnerability that stems from the...

Google Chrome Animation Code Execution Vulnerability

Google Chrome is a web browser from Google, an American company. A code execution vulnerability exists in Google Chrome Animation, which can be exploited by an attacker to execute arbitrary code on a system or cause a denial of service condition...

Oracle MySQL Cluster Input Validation Error Vulnerability (CNVD-2022-07912)

Oracle MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database developed by Oracle Corporation. Oracle MySQL Cluster 7.4.34, 7.5.24, 7.6.20, 8.0.27 and earlier versions are vulnerable to an input validation error. An attacker could use this vulnerability to corrupt or...

DBeaver XML External Entity Injection Vulnerability

DBeaver is a free multi-platform database tool for developers, Sql programmers, database administrators and analysts from the DBeaver team in the U.S. An XML external entity injection vulnerability exists in DBeaver, which stems from a web-based system or product that does not set the correct...

Unspecified Vulnerability in Ajax.NET Professional

NET Professional is Ajax.NET Professional AjaxPro is one of the first AJAX frameworks available for Microsoft ASP.NET. NET Professional has a security vulnerability that originates from the possibility of deserializing arbitrary . An attacker could use this vulnerability to perform a...

Unspecified Vulnerability in MySQL Connectors (CNVD-2021-89938)

MySQL Connectors is a standards-based driver for JDBC, ODBC, and . NET that enables developers to build database applications in their language of choice. A security vulnerability exists in the Connector/J component of MySQL Connectors 8.0.26 and earlier versions. The vulnerability can be exploit...

Wireshark infinite loop vulnerability (CNVD-2022-11207)

Wireshark is a network packet analyzer. Wireshark is a network packet analyzer that captures network packets and displays the most detailed packet information possible.Wireshark uses WinPCAP as an interface to exchange data packets directly with the network card. An infinite loop vulnerability...

Code execution vulnerability in multiple Mozilla products (CNVD-2024-14974)

Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox the web browser.Mozilla Thunderbird is a suite of email client software separate from the Mozilla Application Suite. A code execution vulnerability exists in multiple Mozilla products that...

ZTE MC801A Command Injection Vulnerability

The ZTE MC801A is a 5g indoor WiFi router from China's ZTE ZTE. The ZTE MC801A suffers from an input validation vulnerability in the handling of multiple network parameters, which can be exploited by a remote attacker to submit a special request that can be used in the application context to...

Apache Airflow Information Disclosure Vulnerability (CNVD-2023-85617)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An information disclosure vulnerability exists in Apache Airflow Spark Provider...

ThinkCMF Cross-Site Scripting Vulnerability

ThinkCMF is a CMS Content Management System based on ThinkPHP. A cross-site scripting vulnerability exists in ThinkCMF version 5.1.5, which stems from the lack of effective filtering and escaping of user-supplied data in the file UserController.php, and can be exploited by an attacker to execute...

Linux kernel has unspecified vulnerabilities (CNVD-2023-06474)

Linux kernel is the kernel used by the Linux Foundation's open source operating system, Linux. Linux kernel has a security vulnerability that stems from type obfuscation, which leads to denial of service. No details of the vulnerability are currently available...

Linux kernel resource management error vulnerability (CNVD-2022-70573)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a resource management error vulnerability that originates when the function sessfreebuffer in the file fs/cifs/sess.c is affected, resulting in a doub...

Adobe InCopy Out-of-Bounds Write Vulnerability (CNVD-2022-50232)

Adobe InCopy is a text editing software for creative writing from Adobe, USA. Adobe InCopy suffers from an out-of-bounds write vulnerability that can be exploited by an attacker to execute arbitrary code in the context of the current user...

Google Android Buffer Overflow Vulnerability (CNVD-2022-47671)

Google Android is a Linux-based open source operating system from Google, Inc. Google Android is vulnerable to a buffer overflow vulnerability that originates in l2cbleprocesssigcmd in l2cble.cc, which could result in an out-of-bounds read due to a boundary check error The vulnerability can be...

Shopware Cross-Site Request Forgery Vulnerability

A cross-site request forgery vulnerability exists in versions of Shopware prior to 5.7.9, which stems from vulnerability to cross-site request forgery CSRF token authentication failures. An attacker could exploit this vulnerability to be subject to a cross-site request forgery CSRF attack...

Huawei HarmonyOS Information Disclosure Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. An information disclosure vulnerability exists in Huawei HarmonyOS version 2.0. The vulnerability stems from the failure to properly validate the Array Index...

Halo Cross-Site Scripting Vulnerability (CNVD-2022-47473)

Halo is a personal blogging system for individual developers. Halo is vulnerable to a cross-site scripting vulnerability that originates in adminindex.html/system/tools and contains a stored cross-site scripting XSS vulnerability. No detailed vulnerability details are available at this time...

GenieACS OS Command Injection Vulnerability

GenieACS is a high-performance automatic configuration server ACS for remote management of TR-069-enabled devices. GenieACS is vulnerable to an OS command injection vulnerability, which stems from inadequate input validation and lack of authorization checks, and can be exploited by attackers to...

Google Android Resource Management Error Vulnerability in Android (CNVD-2022-47681)

Google Android is a Linux-based open source operating system from Google, Inc. A resource management error vulnerability exists in Google Android, which stems from an out-of-bounds read in bpfskbchangehead in filter.c due to post-release reuse, which could be exploited by an attacker to The...

Jsish Denial of Service Vulnerability (CNVD-2022-07927)

Jsish is a small JavaScript parser with a built-in database written in C. A security vulnerability exists in Jsish version v3.5.0, which stems from a heap-based buffer overflow in jsiEvalCodeSub in src/jsiEval.c. An attacker could exploit this vulnerability to potentially cause a denial of servic...

Microsoft SharePoint Remote Code Execution Vulnerability

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A code injection...

Tecrail Responsive FileManager Input Validation Error Vulnerability

Tecrail Responsive FileManager is an open source file manager written in PHP by Tecrail Italy. The product supports the uploading and management of videos, images or other files. A security vulnerability exists in the ajaxcalls.php file in Tecrail Responsive FileManager 9.14.0 and earlier version...

Google Android Information Disclosure Vulnerability (CNVD-2023-82065)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability that stems from improper input validation in the parseInputs module of ShimPreparedModel.cpp, which may result in out-of-bounds reads. An attacker can...

Apache Airflow Path Traversal Vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A path traversal vulnerability exists in Apache Airflow versions prior to 2.6.3,...

Zabbix Frontend Cross-Site Scripting Vulnerability (CNVD-2022-56704)

Zabbix Frontend is a monitoring software front-end tool from the American company Zabbix. A cross-site scripting vulnerability exists in Zabbix Frontend, which can be exploited by an authenticated attacker to create a link to a discovery page with reflected Javascript code and send it to other...

Product Show Room Site Cross-Site Scripting Vulnerability (CNVD-2022-48964)

Product Show Room Site is a product showroom site from Carlo Montero's personal developer. version 1.0 of Product Show Room Site is vulnerable to cross-site scripting, which stems from using a special string input text box that leads to cross-site scripting. No details of the vulnerability are...

Jenkins Selection Tasks Plugin跨站脚本漏洞

Jenkins and Jenkins Plugin are both open source products from Jenkins.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.A cross-site scripting vulnerability...

MODX Revolution code issue vulnerability

MODX Revolution is a PHP-based open source content management system CMS from the US company MODX. The system supports online collaboration, search engine optimization SEO, etc. MODX Revolution has a code issue vulnerability that can be exploited by attackers to execute arbitrary code by uploadin...

TOTOLink T10 Command Injection Vulnerability

TOTOLink T10 is a wireless network system router from TotoLink, China.TOTOLink T10 V5.9c.5061B20200511 is vulnerable to command injection, which can be exploited by attackers to execute arbitrary commands via the QUERYSTRING parameter...

Google TensorFlow Input Validation Error Vulnerability (CNVD-2022-11504)

Google TensorFlow is an end-to-end open source platform for machine learning from Google USA. Google Tensorflow suffers from an input validation error vulnerability, which can be exploited by an attacker to cause a CHECK failure denial-of-service based assertion failure and result in a denial of...

UpdateStar HD-Network Real-time Monitoring System Path Traversal Vulnerability

UpdateStar HD-Network Real-time Monitoring System is a high-definition network real-time monitoring system from UpdateStar, a German company. updateStar HD-Network Real-time Monitoring System in version 2.0 is vulnerable to path traversal vulnerability, which stems from the failure of a network...

libtorrent 'bdecode' function heap buffer overflow vulnerability

libtorrent is an open source C++ Bittorrent library developed by software developer Arvid Norberg, which provides high performance and good code style of the BT development kit, and supports crawling file pages directly through the network stack. A security vulnerability exists in the 'bdecode'...

Apache Dolphinscheduler Code Execution Vulnerability

Apache Dolphinscheduler is a modern data scheduling platform from the Apache USA Foundation. A code execution vulnerability exists in Apache Dolphinscheduler, which can be exploited by an attacker to execute arbitrary code on a system...

Apache Airflow ODBC Provider Remote Code Execution Vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. A remote code execution vulnerability exists in Apache Airflow ODBC Provider, which can be exploited by an attacker to cause command execution...

Netdata Licensing Issue Vulnerability

Netdata is a high-fidelity infrastructure monitoring and troubleshooting application open-sourced by Netdata.Netdata suffers from an authorization issue vulnerability that stems from the fact that anyone with access to the Netdata agent can access its MACHINEGUID.No details of the vulnerability a...

XWiki Platform Information Disclosure Vulnerability

XWiki Platform is the French company XWiki's set of Wiki platform for creating Web collaboration applications. The XWiki Platform suffers from an information disclosure vulnerability that originates from the fact that when using XWiki's "Reset forgotten password" feature, passwords are stored in...

OpenCATS Cross-Site Scripting Vulnerability (CNVD-2022-70567)

OpenCats is an open source recruitment process management system. A security vulnerability exists in OpenCats v0.9.6, which stems from a security issue with the email parameter in the Check Email feature. No details of the vulnerability are provided at this time...

Democritus Project d8s-asns democritus-html code execution vulnerability

Democritus Project is a collection of simple, effective, modular, well-tested and well-documented features from Democritus. A backdoor vulnerability exists in Democritus Project d8s-asns version 0.1.0, which stems from the presence of a potential code execution package democritus-html inserted by...

Out-of-bounds write vulnerability in multiple Adobe products (CNVD-2022-46974)

Adobe Acrobat is a set of tools for editing and converting PDF files.Adobe Acrobat Reader is a PDF viewer. The software is used to print, sign and annotate PDFs. An out-of-bounds write vulnerability exists in several Adobe products, which can be exploited by an attacker to execute arbitrary code ...

Fortinet FortiMail Cross-Site Scripting Vulnerability (CNVD-2022-19073)

Fortinet FortiMail is a suite of email security gateway products from Fortinet, Inc. Fortinet FortiMail is vulnerable to a cross-site scripting vulnerability that could be exploited to execute unauthorized code or commands via a specially crafted HTTP GET request to the FortiGuard URI protection...

PrinterLogic Web Stack Insecure Direct Object Reference (IDOR) Vulnerability (CNVD-2022-11104)

PrinterLogic Web Stack PrinterLogic Printer Installer is a native Web application from PrinterLogic, Inc. It enables the It department to manage and automate the creation/dissemination of printer Objects and printer drivers across print environments from a single management console. PrinterLogic...

Unspecified Vulnerability in Apache HTTP Server (CNVD-2021-44765)

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. There is a security vulnerability in Apache HTTP Server, no details of the vulnerability are provided at this time...

Mozilla Rust Resource Management Error Vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in http crate in versions of Mozilla Rust prior to 0.1.20, which stems from HeaderMap:: The Drain API can use raw pointers to corrupt sound effects. No details of the vulnerabilit...

Unspecified Vulnerability in Oracle Java SE (CNVD-2025-24093)

Oracle Java SE is a U.S. Oracle Oracle company for the development and deployment of desktop, server and embedded devices and real-time environments in the Java application. A security vulnerability exists in Oracle Java SE for Oracle Java SE and Oracle GraalVM for JDK, which can be exploited by...