Fortinet FortiOS Buffer Overflow Vulnerability (CNVD-2024-13748)

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. A buffer overflow vulnerability...

Unspecified vulnerability in wolfSSL (CNVD-2024-37452)

wolfSSL CyaSSL is the United States wolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. A security vulnerability exists in wolfSSL versions prior to 5.6.6, which can be exploited by an attacker to trigger a 5-byte buffer out-of-bounds read...

Unspecified Vulnerability in Oracle MySQL (CNVD-2024-11119)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. A security vulnerability exists in Oracle MySQL for MySQL Server version 8.0.35 and earlier, version 8.2.0 and earlier, which can be exploited by an...

IBM PowerSC Information Disclosure Vulnerability

IBM PowerSC is an International Business Machines IBM security and compliance solution for IBM Power Systems servers. IBM PowerSC suffers from an information disclosure vulnerability vulnerability that stems from not using proper account lockout settings, which can be exploited by an attacker to...

Cups Easy cross-site scripting vulnerability (CNVD-2024-11147)

Cups Easy is a PHP-based purchasing and inventory software that may become a full-fledged ERP in the future. Cups Easy suffers from a cross-site scripting vulnerability that stems from insufficient escaping of the description parameter on the /cupseasylive/statemodify.php page. An attacker could...

GTKWave buffer overflow vulnerability (CNVD-2024-04855)

GTKWave is a full-featured, GTK+-based waveform viewer from GTKWave. A buffer overflow vulnerability exists in GTKWave version 3.3.115, which can be exploited by an attacker to cause arbitrary code execution via specially crafted .fst files...

Siemens SCALANCE M-800/S615 Series OS Command Injection Vulnerability

The SCALANCE M-800, MUM-800 and S615 and the RUGGEDCOM RM1224 are industrial routers. An operating system command injection vulnerability exists in the Siemens SCALANCE M-800/S615 series, which can be exploited by an attacker to execute commands on the system via a malicious local administrator...

Foxit Reader Type Obfuscation Vulnerability (CNVD-2023-96088)

Foxit Reader is a Chinese Foxit Foxit company's a PDF document reader. A type confusion vulnerability exists in Foxit Reader before version 12.1.2.15356, which can be exploited by an attacker to execute arbitrary code on the system...

Mattermost Denial of Service Vulnerability (CNVD-2023-9448609)

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a denial of service vulnerability that stems from an inability to limit the amount of data extracted from a compressed archive during an import in Mattermost Boards, which can b...

Huawei HarmonyOS and EMUI Privilege Management Vulnerability

Huawei HarmonyOS is an operating system from Huawei, a Chinese company. It provides a full-scenario distributed operating system based on a microkernel.Huawei EMUI is a user interface developed by Huawei based on the Android operating system. Huawei HarmonyOS and EMUI have a privilege management...

Google Android Information Disclosure Vulnerability (CNVD-2023-84090)

Google Android is a Linux-based open source operating system from Google. Google Android has an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

Google Android elevation of privilege vulnerability (CNVD-2023-98748)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability, which is caused by a lack of privilege checking in the Package Installer. An attacker can exploit this vulnerability to gain elevated privileges...

Google Android elevation of privilege vulnerability (CNVD-2023-96079)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by an attacker to escalate privileges...

Google Android elevation of privilege vulnerability (CNVD-2024-10422)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability, which is caused by a free use of GpuService in GpuService.cpp. An attacker can exploit this vulnerability to gain elevated privileges...

F5 Insufficient BIG-IP Session Expiration Vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, and remote access policy management. F5 BIG-IP suffers from an insufficient session expiration vulnerability, which can be exploited by an attacker to reuse sessio...

Cisco Catalyst SD-WAN Manager HTML Injection Vulnerability

Cisco Catalyst is a series of switches from the American company Cisco. An HTML injection vulnerability exists in Cisco Catalyst SD-WAN Manager that stems from improper validation of user-supplied data in element fields and can be exploited by an authenticated, remote attacker to inject HTML...

Google Chrome Security Bypass Vulnerability (CNVD-2023-75499)

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome prior to version 117.0.5938.62, which stems from an improper implementation of the Intents module. An attacker can exploit the vulnerability to bypass security restrictions...

Microsoft 3D Builder Remote Code Execution Vulnerability (CNVD-2023-74907)

Microsoft 3D Builder is a tool for creating models and 3D printing from Microsoft. A remote code execution vulnerability exists in Microsoft 3D Builder, which can be exploited by an attacker to execute arbitrary code on a system...

OpenBSD Code Issues Vulnerabilities

OpenBSD is a cross-platform, BSD-based UNIX-like operating system from the Canadian OpenBSD project team. A code issue vulnerability exists in versions of OpenBSD prior to 8.1 that stems from incorrect handling of BGP update data path attribute length set by a potential remote participant. An...

IBM Security Guardium Data Encryption Code Execution Vulnerability

IBM Security Guardium Data Encryption is a software from International Business Machines IBM that is used to secure sensitive data within an organization. The software protects assets located in cloud, virtual, big data and physical environments by controlling access to databases, files,...

Cisco Unified Contact Center Express Input Validation Error Vulnerability (CNVD-2023-93334)

Cisco Unified Contact Center Express Unified CCX is a customer relationship management component of a unified communications solution from Cisco. The component supports features such as self-service voice, call distribution, and customer access control. An input validation error vulnerability...

Google Android elevation of privilege vulnerability (CNVD-2023-69045)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability caused by a lack of privilege checks in visitFrees of RemoteViews.java. An attacker can exploit this vulnerability to gain elevated privileges...

Google Android Information Disclosure Vulnerability (CNVD-2023-82069)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability that originates from a messy proxy in the setMetadata module of MediaSessionRecord.java, which can be exploited by an attacker to obtain sensitive...

Microsoft Outlook Remote Code Execution Vulnerability (CNVD-2023-92208)

Microsoft Outlook is a suite of e-mail applications from the American company Microsoft. The Microsoft Outlook remote code execution vulnerability can be exploited by an attacker to execute arbitrary code on the system...

Adobe Dimension Out-of-Bounds Read Vulnerability (CNVD-2023-64506)

Adobe Dimension is a 3D design tool that is very easy for designers to use while providing high quality visuals. To create realistic objects, Adobe Dimension uses materials defined in the NVidia Material Design Language. An out-of-bounds read vulnerability exists in Adobe Dimension. The...

D-Link DIR-895 Authentication Bypass Vulnerability

The D-Link DIR-895 is a wireless router from China's AUO D-Link. The D-Link DIR-895 suffers from an authentication bypass vulnerability that stems from the lack of valid authentication in the phpcgimain function in cgibin, which can be exploited by an attacker to bypass authentication...

Foxit Reader Code Execution Vulnerability (CNVD-2023-96093)

Foxit Reader is a Chinese Foxit Foxit company's a PDF document reader. A code execution vulnerability exists in Foxit Reader version 12.1.2.15332, which can be exploited by an attacker to execute arbitrary code on the system...

Apache Airflow Information Disclosure Vulnerability (CNVD-2023-67075)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An information disclosure vulnerability exists in Apache Airflow versions prior to...

Siemens SIMATIC MV500 Devices Uncontrolled Resource Consumption Vulnerability (CNVD-2023-56540)

SIMATIC MV500 products are fixed optical readers for capturing print, laser, drill, punch and dotted line codes on a variety of different surfaces. Siemens SIMATIC MV500 Devices has an uncontrolled resource consumption vulnerability that can be exploited by an attacker to cause a denial of servic...

Google Android Information Disclosure Vulnerability (CNVD-2023-50827)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability, which is caused by a permissions bypass in multiple files. An attacker can exploit this vulnerability to obtain sensitive information...

H3C Magic R300 Stack Overflow Vulnerability (CNVD-2023-52049)

The H3C Magic R300 is a wireless router from China's Xinhua San H3C. The H3C Magic R300 suffers from a stack overflow vulnerability that is caused by incorrect boundary checking of the EditBasicSID interface on /goform/aspForm. An attacker can exploit this vulnerability to cause a buffer overflow...

Moodle cross-site scripting vulnerability (CNVD-2023-43862)

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A cross-site scripting vulnerability exists in Moodle version 3.10.1 that stems from improper input cleanup and is susceptible to...

IBM MQ Information Disclosure Vulnerability (CNVD-2023-41892)

IBM MQ IBM WebSphere MQ is a messaging middleware product from International Business Machines IBM. The product is mainly for the service-oriented architecture SOA to provide a reliable and proven messaging backbone. An information disclosure vulnerability exists in IBM MQ versions 8.0, 9.0, and...

Google Chrome on ChromeOS Memory Misreference Vulnerability

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in Google Chrome on ChromeOS versions prior to 113.0.5672.114. An attacker can exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system...

JerryScript jcontext_raise_exception Function Denial of Service Vulnerability

JerryScript is a lightweight JavaScript engine Jerryscript project . A denial of service vulnerability exists in the JerryScript jcontextraiseexception function, which can be exploited by an attacker to cause a denial of service...

Google Android elevation of privilege vulnerability (CNVD-2023-55374)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that originates from a logic error in the multiple functions code of the PackageInstallerService.java and related files component, which can be exploited b...

Unspecified Vulnerability in Oracle MySQL Server (CNVD-2023-65514)

Oracle MySQL Server is a relational database from Oracle Corporation. Oracle MySQL Server has a security vulnerability that can be exploited by attackers to cause a takeover of MySQL Server...

Microsoft Visual Studio Remote Code Execution Vulnerability (CNVD-2023-29362)

Microsoft Windows is a windowed operating system developed by Microsoft Corporation in the United States. A remote code execution vulnerability exists in Microsoft Visual Studio, which can be exploited by attackers to execute code on the target host...

Apache OpenOffice Code Execution Vulnerability (CNVD-2023-25931)

Apache OpenOffice is an open source office software suite from the U.S. Apache Apache Foundation. The suite contains text documents , spreadsheets , presentations , drawings , databases and so on. A code execution vulnerability exists in Apache OpenOffice that originates from a link containing an...

Adobe Dimension Heap Buffer Overflow Vulnerability (CNVD-2023-21652)

Adobe Dimension is the United States of America Odo than Adobe company is a set of 2D and 3D composite design tools. Adobe Dimension suffers from a heap buffer overflow vulnerability that can be exploited by an attacker to execute arbitrary code in the context of the current user...

Microsoft SharePoint Server Spoofing Vulnerability (CNVD-2023-72200)

Microsoft SharePoint Server is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A spoofing...

D-Link DIR-867 Command Injection Vulnerability

The D-Link DIR-867 is a wireless router from China Youxun D-Link.A command injection vulnerability exists in the D-Link DIR-867, which is caused by a command injection vulnerability in the SetVirtualServerSettings function. By sending a carefully crafted request using the LocalIPAddress parameter...

Google Android elevation of privilege vulnerability (CNVD-2023-21686)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by an attacker to cause a local privilege escalation without requiring additional execute privileges...

Fortinet FortiWeb Buffer Overflow Vulnerability (CNVD-2023-18294)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. A buffer overflow vulnerability exists that...

Microsoft Exchange Server Remote Code Execution Vulnerability (CNVD-2023-18284)

Microsoft Exchange Server is the United States Microsoft Microsoft company's set of e-mail service program. It provides e-mail access, storage, forwarding, voice mail, e-mail filtering and screening. A remote code execution vulnerability exists in Microsoft Exchange Server. An attacker can exploi...

Apache NiFi XML External Entity Injection Vulnerability (CNVD-2023-23555)

Apache NiFi is a data processing and distribution system from the Apache USA Foundation. The system is primarily used for data routing, transformation and system intermediary logic. An XML external entity injection vulnerability exists in Apache NiFi versions 1.2.0 through 1.19.1, which stems fro...

phpMyFAQ Cross-Site Scripting Vulnerability (CNVD-2023-09628)

phpMyFAQ is a multilingual, fully database-driven FAQ system. phpMyFAQ versions prior to 3.1.11 are vulnerable to a cross-site scripting vulnerability that originates from cross-site scripting XSS. No detailed vulnerability details are currently available...

Oracle WebLogic Server Information Disclosure Vulnerability (CNVD-2023-08437)

Oracle WebLogic Server is an Oracle Oracle application service middleware for cloud and traditional environments, which provides a modern lightweight development platform that supports the entire lifecycle management of applications from development to production and simplifies application...

Oracle WebLogic Server Information Disclosure Vulnerability (CNVD-2023-08438)

Oracle WebLogic Server is an Oracle Oracle application service middleware for cloud and traditional environments, which provides a modern lightweight development platform that supports the entire lifecycle management of applications from development to production and simplifies application...

Oracle VM VirtualBox has an unspecified vulnerability (CNVD-2023-05477)

A security vulnerability exists in Oracle VM VirtualBox, a virtual machine management software from Oracle Corporation. A low privilege attacker can compromise Oracle VM VirtualBox by logging into the infrastructure where Oracle VM VirtualBox is executing...