Huawei HarmonyOS has an unspecified vulnerability (CNVD-2022-08312)

Huawei HarmonyOS is an operating system from Huawei, a Chinese company. A security vulnerability exists in Huawei HarmonyOS, which provides a microkernel-based, fully-scoped distributed operating system. An attacker could exploit the vulnerability to potentially cause a process to reboot...

Controlup Real-Time Agent Command Injection Vulnerability

Controlup Real-Time Agent is a real-time agent from Controlup USA. The Controlup Real-Time Agent suffers from a command injection vulnerability that originates from an unauthenticated named pipe channel in the Controlup Real-Time Agent, which can be exploited by an attacker to run operating syste...

Apache James path traversal vulnerability

Apache James is an open source Smtp and Pop3 mail transfer agent and Nntp news server written entirely in Java by the Apache Foundation. Apache James in version 3.6.1 contains a path traversal vulnerability that stems from a failure of a networked system or product to properly filter special...

Atlassian Jira Cross-Site Scripting Vulnerability (CNVD-2022-05437)

Atlassian Jira is a defect tracking management system from Atlassian Australia. A cross-site scripting vulnerability exists in Atlassian Jira, which stems from a lack of proper validation of client-side data in the application's /rest/collectors/1.0/template/custom endpoint. An attacker could...

Mozilla Rust rusqlite crate memory corruption vulnerability

Mozilla Rust rusqlite crate is an ergonomic wrapper for using SQLite from Rust. it attempts to expose a rust-postgres-like interface. mozilla rust rusqlite crate versions 0.25.4 before 0.25.x and 0.26. 2 prior to 0.26.x versions have a security vulnerability that stems from a resource management...

Garrett Metal Detectors Path Traversal Vulnerability

Garrett Metal Detectors is a walk-in metal detector from Garrett U.S.A. Garrett Metal Detectors is vulnerable to a path traversal vulnerability that could be exploited by remote attackers to submit special requests and execute arbitrary commands in the application context...

Google Android Information Disclosure Vulnerability (CNVD-2021-101960)

Google Android is a Linux-based open source operating system from Google, Inc. Google Android is vulnerable to an information disclosure vulnerability that can be exploited by attackers to cause local information disclosure across Binder transactions without additional execution privileges...

Motorola Solutions Avigilon Cross-Site Scripting Vulnerability

Motorola Solutions Avigilon is a series of security cameras from Motorola Solutions, U.S. A cross-site scripting vulnerability exists in Motorola Solutions Avigilon, which stems from a lack of data validation filtering of user-supplied data and output. An attacker could exploit this vulnerability...

WordPress StopBadBots plugin SQL injection vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. StopBadBots Plugin is a WordPress open source application plugin. WordPress StopBadBots Plugin in versions prior to...

fastadmin code problem vulnerability

fastadmin is a set of ThinkPHP and Bootstrap-based web backend development framework. fastadmin has a security vulnerability that stems from the fact that Fastadmin v1.2.1 is affected by a file upload vulnerability that allows execution of arbitrary code via shell access. No details of the...

Fortinet FortiWeb Command Injection Vulnerability (CNVD-2021-99770)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content.Fortinet FortiWeb A command injection...

TP-Link AX10 has an unspecified vulnerability

TP-Link AX10 is a router from Tp-link, China. TP-Link AX10 has a security vulnerability that could be exploited to disconnect a connected wireless client by sending a spoofed authentication frame specific to the wireless adapter...

Auerswald Compact has an unspecified vulnerability

The Auerswald Compact Series is an Ict solution from Auerswald Germany. a security vulnerability exists in the Auerswald Compact Series that could be exploited by an attacker to access a web-based management application for full administrative access to the device...

NXP i.MX SoC has unspecified vulnerabilities

NXP i.MX SoC is nxp's multi-core solution for multimedia and display applications with scalable, secure and reliable high-performance and low-power features. nXP i.MX SoC devices have a security vulnerability that stems from the OPTEE-OS CSU driver for NXP i.MX SoC devices lacking secure access...

Mozilla Network Security Services Buffer Overflow Vulnerability (CNVD-2021-102398)

Mozilla Network Security Services NSS is a library of functions Network Security Services library from the Mozilla Foundation in the United States. The product provides cross-platform support for SSL, S/MIME and other Internet security standards. A security vulnerability exists in verifies...

IBM QRadar SIEM Cross-Site Scripting Vulnerability (CNVD-2021-94164)

IBM QRadar SIEM is a solution from IBM America that leverages security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user activity, etc. A cross-site...

PortlandLabs Concrete CMS has an unspecified vulnerability (CNVD-2021-94040)

PortlandLabs Concrete Cms is a team-oriented open source content management system from PortlandLabs, Inc. PortlandLabs Concrete CMS has a security vulnerability that could be exploited by attackers to access restricted files...

LibreCad buffer overflow vulnerability

A buffer overflow vulnerability exists in LibreCAD, an open source CAD computer-aided design application from the LibreCAD organization, in LibreCad libdxfrw, which stems from the failure of the product's dwgCompressor::decompress18 function to properly handle special input data. An attacker coul...

PiranhaCMS cross-site request forgery vulnerability

PiranhaCms is a friendly editor-centric Cms for use with .Net5 for integration with Cms or headless Api. posts, deleting media folders, etc., a check for cross-site request forgery is missing. No detailed vulnerability details are available at this time...

Google Chrome cache security bypass vulnerability

Google Chrome is a web browser from Google, Inc. Google chrome has a security vulnerability that can be exploited by attackers to bypass security restrictions...

Incorrect Zero Termination Vulnerability in Multiple Siemens Products (CNVD-2021-89437)

The Nucleus NET module integrates a range of standards-compliant networking and communications protocols, drivers and utilities to provide full-featured networking support in any embedded device, and the Nucleus RTOS is a microkernel-based real-time operating system. A security vulnerability exis...

Google Android Framework Elevation of Privilege Vulnerability (CNVD-2021-101442)

Android is a Linux-based open source operating system developed by Google Inc. and the Open Handheld Alliance OHA for short. an elevation of privilege vulnerability exists in the Framework component of Google Android versions 9, 10, 11, and 12. No detailed vulnerability details are available...

firefly-iii Cross-site Request Forgery Vulnerability (CNVD-2022-19846)

firefly-iii is a free and open source personal finance software. firefly-iii suffers from a cross-site request forgery vulnerability, which originates when a WEB application does not sufficiently validate that a request is from a trusted user, and can be exploited by an attacker to send an...

Nextcloud file traversal vulnerability

Nextcloud is an open source set of self-hosted file synchronization and sharing communication applications platform from Germany-based Nextcloud. nextcloud has a file traversal vulnerability in versions prior to 20.0.13, 21.0.5, and 22.2.0, which stems from a lack of authentication, access contro...

Macrob7 Macs Framework Cms SQL Injection Vulnerability

Macrob7 Macs Framework Cms is an open source Cms framework from the personal developer Macdonald Terrence Robinson. version 1.14 of the Macrob7 Macs Framework Content Management System is vulnerable to SQL injection, which allows attackers to SQL injection can be performed via the "roleId"...

Oracle MySQL Cluster Buffer Overflow Vulnerability (CNVD-2022-18216)

MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database designed to guarantee 99.999% availability. A buffer overflow vulnerability exists in Oracle MySQL Cluster, which stems from a failure to validate the correct length of user-supplied data before copying it to a...

Oracle Database Server has an unspecified vulnerability (CNVD-2021-101531)

Oracle Database Server is a relational database management system from Oracle Corporation USA. The database management system provides data management, distributed processing, and other functions.An unspecified vulnerability exists in the Java VM component of Oracle Database Server versions...

Draytek VigorConnect Local File Inclusion Vulnerability (CNVD-2021-81961)

VigorConnect is the local network management software for DrayTek devices.A local file inclusion vulnerability exists in the file download function of the DownloadFileServlet endpoint of Draytek VigorConnect version 1.6.0-B3. An attacker could exploit this vulnerability to download arbitrary file...

Django Cross-Site Scripting Vulnerability (CNVD-2022-31939)

Django is the Django Foundation's set of open source web application framework based on the Python language. The framework includes an object-oriented mapper, view system, template system, etc. Django's Unicorn framework in version 0.35.3 and earlier has a cross-site scripting vulnerability that...

Mozilla Rust Command Injection Vulnerability (CNVD-2021-85291)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. Mozilla Rust is vulnerable to a command injection vulnerability that can be exploited by attackers to cause memory corruption...

FAAD2 Heap Buffer Overflow Vulnerability (CNVD-2021-89951)

Freeware Advanced Audio Decoder 2 FAAD2 is an open source MPEG-4 and MPEG-2 AAC decoder licensed under the GPLv2 license. a heap buffer overflow vulnerability exists in the stszin function in mp4read.c in FAAD2 version 2.10.0 and earlier. An attacker could exploit this vulnerability to execute co...

Adobe Framemaker out-of-bounds read vulnerability

Adobe FrameMaker is a document processing program used to write and edit large or complex documents, including structured documents.An out-of-bounds read vulnerability exists in Adobe Framemaker 2019 Update 8, 2020 Release Update 2 and earlier versions. An attacker could exploit this vulnerabilit...

Google Chrome Stack Buffer Overflow Vulnerability (CNVD-2021-92833)

Chrome is a simple and efficient web browsing tool developed by Google. a stack buffer overflow vulnerability exists in ANGLE in versions prior to Google Chrome 93.0.4577.82. An attacker could exploit this vulnerability to potentially exploit stack corruption via a crafted HTML page...

Mozilla Rust Memory Corruption Vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in Rust im crate through 2020-11-09, which stems from a limitation that TreeFocus does not have a send feature or a synchronization feature, resulting in a data contention...

Mautic Security Feature Issue Feature Issue Vulnerability

Mautic is an open source marketing automation software. The software monitors and manages websites, sends emails and manages customer resources. mautic versions prior to 3.3.4 and versions prior to 4.0.0 are vulnerable to a security feature issue that stems from the mtrand function in the softwar...

Google Chrome Autofill Spoofing Vulnerability (CNVD-2021-67541)

Google Chrome is a web browser from Google, Inc. A spoofing vulnerability exists in Google Chrome Autofill. An attacker can exploit this vulnerability to perform spoofing...

GPAC Project on Advanced Content Integer Overflow Vulnerability (CNVD-2021-82984)

GPAC Project on Advanced Content is an open source cross-platform library that implements the MPEG-4 system standard and provides tools for media playback, vector graphics, and 3D rendering. an integer overflow vulnerability exists in the MPEG-4 decoding functionality in GPAC Project on Advanced...

F5 Access Guided Configuration logging information disclosure vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. The F5 Access Guided Configuration logging information disclosure vulnerability can be exploited by attackers to obtain...

Crocoblock JetEngine Cross-Site Scripting Vulnerability

Crocoblock JetEngine is a dynamic content plugin that allows you to build complex websites quickly and cost-effectively.A cross-site scripting vulnerability exists in Crocoblock JetEngine that can be exploited by attackers to perform XSS via custom form input...

fig2dev buffer overflow vulnerability (CNVD-2021-79766)

fig2dev is used to convert .fig files to various graphics languages and formats. A global buffer overflow vulnerability exists in putfont in genpict2e.c in fig2dev version 3.2.7b. An attacker could exploit this vulnerability to cause a denial of service by converting xfig files to pict2e format...

Exiv2 Infinite Loop Vulnerability (CNVD-2021-61438)

Exiv2 is a cross-platform C library and command-line utility for managing image metadata. exiv2 0.27.4 and earlier versions are vulnerable to an infinite loop. An attacker could exploit the vulnerability via specially crafted image files to cause a denial of service...

Huawei EMUI/Magic UI memory address out-of-bounds vulnerability

Huawei Emui is an Android-based mobile operating system. Huawei Magic UI is the operating system for Honor phones. Huawei EMUI/Magic UI suffers from a memory address out-of-bounds vulnerability that can be exploited by attackers to cause the execution of malicious code...

Google Chrome Post-release Reuse Vulnerability (CNVD-2021-62185)

Chrome is a web browsing tool developed by Google, and a post-release reuse vulnerability exists in the Page Info UI in versions prior to Google Chrome 92.0.4515.131. A remote attacker could use this vulnerability to execute arbitrary code or cause a denial of service condition on the system...

Foxit PDF Reader Post-release Reuse Vulnerability (CNVD-2021-64091)

Foxit PDF Reader formerly known as Foxit Reader is a set of software used to read PDF format files, developed by Foxit Software Fujian. The vulnerability stems from not verifying the existence of the object before performing operations on it. An attacker could exploit this vulnerability to execut...

Foxit PDF Reader Post-release Reuse Vulnerability (CNVD-2021-79774)

Foxit PDF Reader formerly known as Foxit Reader is a set of software used to read PDF format files, developed by Foxit Software Fujian. The vulnerability stems from not verifying the existence of the object before performing operations on it. An attacker could exploit this vulnerability to execut...

Foxit PDF Reader Post-release Reuse Vulnerability (CNVD-2021-79772)

Foxit PDF Reader formerly known as Foxit Reader is a set of software used to read PDF format files, developed by Foxit Software Fujian. The vulnerability stems from not verifying the existence of the object before performing operations on it. An attacker could exploit this vulnerability to execut...

MetInfo Cross-Site Request Forgery Vulnerability (CNVD-2022-05449)

MetInfo using PHP + Mysql architecture, is a very SEO-friendly, full-featured, support for multi-language, responsive display, extremely suitable for business, corporate website construction cms station-building system. Metinfo 6.1.3 version of the existence of cross-site request forgery...

Foxit PDF Reader has a use-after-release vulnerability

Foxit PDF Reader is a PDF reader. Foxit PDF Reader is vulnerable to a post-release exploit that could be used by remote attackers to execute arbitrary code on the target system...

Oracle Database Server Denial of Service Vulnerability (CNVD-2022-09807)

Oracle Database Server is a relational database management system from Oracle Corporation USA. The database management system provides data management, distributed processing, etc. A denial of service vulnerability exists in the Core RDBMS component of Oracle Database Server version 19c, which ca...

Libvips numeric error vulnerability

libvips is an open source 2D image processing library. libvips version 8.10.5 is vulnerable due to a dezero vulnerability in function "vipseyepoint, eye.cL83" and function "vipsmaskpoint, mask.cL85". No detailed vulnerability details are available at this time...