131315 matches found
WordPress Find and Replace All plugin Cross-Site Request Forgery Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...
VMware Tools for Windows Denial of Service Vulnerability
VMware Tools for Windows 10.0.0 and later, but prior to version 12.1.5, contain a denial of service vulnerability. A denial of service vulnerability exists in the VM3DMP driver, which is caused by improper input validation in the VM3DMP driver and can be exploited by an attacker with local user...
Google Chrome Camera Capture Code Execution Vulnerability
Google Chrome is a web browser from Google, an American company. A code execution vulnerability exists in Google Chrome Camera Capture, which can be exploited by an attacker to execute arbitrary code on a system or cause a denial of service...
Amasty Blog commenting feature cross-site scripting vulnerability
Amasty Blog is a web page extension of Amasty Inc. A cross-site scripting vulnerability exists in the commenting functionality of Amasty Blog Pro version 2.10.3, which can be exploited by attackers to inject cross-site code and launch XSS attacks...
Command Execution Vulnerability in ZOHO ManageEngine ADManager Plus
ZOHO ManageEngine ADManager Plus is a suite of Microsoft Active Directory management software from ZOHO designed for enterprise users using Windows domains. The software assists AD administrators and helpdesk technicians with day-to-day administrative tasks, such as batch management of user...
Cisco Firepower Threat Defense Resource Management Error Vulnerability (CNVD-2022-78144)
Cisco Firepower Threat Defense FTD Software is a unified set of software from Cisco that provides next-generation firewall services.A resource management error vulnerability exists in Cisco Firepower Threat Defense FTD Software, which stems from its management web server Failure to properly...
Linux kernel has unspecified vulnerabilities (CNVD-2022-72079)
Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. Linux kernel has a security vulnerability that affects some unknown processing of the file fs/fscache/cookie.c of the component IPsec. This operation results in a memory leak. No details of the...
Apache Isis Authorization Issues Vulnerability
Apache Isis is the United States Apache Apache Foundation , a framework for rapid development of domain-driven applications in Java . Apache Isis suffers from an authorization issue vulnerability that stems from the h2 webconsole module accessible in the prototype menu automatically providing the...
Oracle E-Business Suite has an unspecified vulnerability (CNVD-2023-05481)
Oracle E-Business Suite E-Business Suite is a fully integrated global business management software from Oracle Corporation USA. A security vulnerability exists in Oracle Web Applications Desktop Integrator for Oracle E-Business Suite. An unauthenticated attacker could exploit the vulnerability to...
Tenda AC18 Stack Overflow Vulnerability
Tenda AC18 is a router from Tenda, a Chinese company. tenda AC18 is vulnerable to a stack overflow vulnerability, which stems from a lack of length validation of the time parameter of the fromSetSysTime function for input data. An attacker could exploit the vulnerability to cause a denial of...
OpenCats SQL Injection Vulnerability (CNVD-2022-70574)
OpenCats is an open source recruitment process management system. OpenCats v0.9.6 suffers from a SQL injection vulnerability that stems from a security issue with the tagid variable in the tag delete function. No detailed vulnerability details are provided at this time...
OTFCC Buffer Overflow Vulnerability (CNVD-2023-11779)
OTFCC is a C library and utility open sourced by Caryll. It is used to parse and write OpenType font files.OTFCC 0.10.4 and earlier versions contain a buffer overflow vulnerability that stems from /release-x64/otfccdump 0x6b5567 boundary error when processing untrusted input, which can be exploit...
Cross-site Request Forgery Vulnerability in Import Files Function of Multiple Siemens Products
Siemens Desigo PX is a building automation control system from Siemens, a German company. A cross-site request forgery vulnerability exists in several Siemens products, stemming from a lack of validation of anti-CSRF tokens or other source checks in the Import Files feature of the "Operation" Web...
Multiple Siemens Products Access Control Error Vulnerabilities
Siemens SICAM is an integrated substation automation system from Siemens Germany. An access control error vulnerability exists in several Siemens products. The vulnerability stems from the fact that the affected device accepts a user-defined session cookie and does not update the session cookie...
Democritus Project d8s-algorithms Code Execution Vulnerability
Democritus Project is a collection of simple, effective, modular, well-tested and well-documented features from Democritus. A backdoor vulnerability exists in Democritus Project d8s-algorithms version 0.1.0, which stems from the presence of a potential code execution package democritus-dicts...
Microsoft Windows Hyper-V Elevation of Privilege Vulnerability
Microsoft Windows Hyper-V is an application from Microsoft Corporation USA. A system hypervisor virtualization technology that enables desktop virtualization, Microsoft Windows Hyper-V has an elevation of privilege vulnerability that stems from improper privilege assignment in the application and...
Huawei HarmonyOS Denial of Service Vulnerability
Huawei HarmonyOS is an operating system from Huawei, China. It provides a microkernel-based distributed operating system. A denial-of-service vulnerability exists in the Huawei HarmonyOS DFX Deployment Stack module interface calls, which can be exploited by attackers to launch denial-of-service...
Online Tours
Online Tours & Travels Management System is an online travel management system developed by Mayuri K. A SQL injection vulnerability exists in Online Tours & Travels Management System v1.0, which originates from /admin/update The id parameter of traveller.php lacks validation for external input SQ...
Rdiffweb Virtual Tampering Vulnerability
Rdiffweb is a web application by Patrik Dufresne, an individual developer in the USA. Provides quick access to your archives through an efficient web interface. A virtual tampering vulnerability exists in Rdiffweb versions prior to 2.4.8, which can be exploited by an attacker to inject malicious...
Caryll OTFCC otfccdump+0x6b559f buffer overflow vulnerability
Caryll OTFCC is Caryll open source a C library and utility programs. Used to parse and write OpenType font files. Caryll OTFCC suffers from a buffer vulnerability that originates from a boundary error in /release-x64/otfccdump+0x6b559f when processing untrusted input. An attacker could exploit th...
Rocket.Chat getReadReceipts Meteor Information Disclosure Vulnerability
Rocket.Chat is an open source team chat software. An information disclosure vulnerability exists in Rocket.Chat versions prior to 4.7.5, 4.8.0 and later, and prior to 4.8.2, which stems from a failure of the getReadReceipts Meteor server method to correctly filter user input passed to a MongoDB...
Adobe Experience Manager Cross-Site Scripting Vulnerability (CNVD-2022-66019)
Adobe Experience Manager AEM is a content management solution from Adobe that can be used to build websites, mobile applications and forms. The solution supports mobile content management, marketing and sales campaign management, and multi-site management, etc. Adobe Experience Manager is...
Tenda AC21 Buffer Overflow Vulnerability
Tenda AC21 is a wireless router from Tenda China. Tenda AC21 V16.03.08.15 is vulnerable to a buffer overflow vulnerability, which originates in the formfastsettingwifiset function of /bin/httpd for lack of length checking of input data, and can be exploited by an attacker to cause httpd to restar...
Microsoft Windows TCP/IP Remote Code Execution Vulnerability (CNVD-2022-63613)
The Microsoft Windows TCP/IP component is a Microsoft component that provides TCP/IP configuration capabilities for Windows. A security vulnerability exists in Microsoft Windows TCP/IP. No detailed vulnerability details are provided at this time...
Tenda AC1206 Buffer Overflow Vulnerability (CNVD-2022-78510)
Tenda AC1206 is a wireless through-the-wall king gigabit router from Tenda China. Tenda AC1206 version V15.03.06.23 is vulnerable to a buffer overflow vulnerability caused by incorrect boundary checking of the formSetClientState function. An attacker could exploit this vulnerability to overflow t...
Apache Hadoop Parameter Injection Vulnerability
Apache Hadoop is an open source distributed system infrastructure from the Apache Foundation. The product is capable of distributed processing of large amounts of data and is highly reliable, scalable, and fault-tolerant. Apache Hadoop has a security vulnerability that stems from its...
Pharmacy Management System getsalereport.php SQL Injection Vulnerability
Pharmacy Management System MPMS is a multi-lingual pharmacy management system by Mayuri K. Personal developer. version v1.0 of Pharmacy Management System is vulnerable to SQL injection, which stems from the startDate parameter in getsalereport.php parameter in getsalereport.php lacks validation f...
F5 BIG-IP TLS 1.3 iRule null pointer dereference vulnerability
F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A null pointer dereference vulnerability exists in the F5 BIG-IP TLS 1.3 iRule, which sources when a TLS 1.3 enabled LTM clie...
IBM Security Verify Information Queue Information Disclosure Vulnerability (CNVD-2022-55635)
IBM Security Verify Information Queue is an integration product from IBM of America, Inc. Leverages Kafka technology and a publish/subscribe model to integrate data between IBM Security products. IBM Security Verify Information Queue version 10.0.2 is vulnerable to an information disclosure...
OpenEMR Cross-Site Scripting Vulnerability (CNVD-2022-56131)
OpenEMR is an open source healthcare management system from the Openemr community. The system can be used for medical practice management, electronic medical records, prescription writing, and medical billing applications. openemr versions prior to 7.0.0 have a cross-site scripting vulnerability...
SAP NetWeaver Enterprise Portal Cross-Site Scripting Vulnerability (CNVD-2022-56941)
SAP NetWeaver Enterprise Portal is a web front-end component of SAP NetWeaver. A cross-site scripting vulnerability exists in SAP NetWeaver Enterprise Portal, which can be exploited by attackers to view or modify information...
Pexip Infinity Input Validation Error Vulnerability (CNVD-2022-54735)
Pexip Infinity Pexip Video Conferencing Cloud Collaboration Platform is a video conferencing cloud collaboration platform from Pexip, a Norwegian company. Pexip Infinity is vulnerable to an input validation error that could be exploited by a remote, unauthenticated attacker to cause a denial of...
Adobe InDesign Buffer Overflow Vulnerability (CNVD-2022-55646)
Adobe InDesign is a set of layout and editing applications from the American company Audobee Adobe. Adobe InDesign suffers from a buffer overflow vulnerability that stems from a lack of proper validation of user-supplied data, which can be exploited by an attacker to cause a read to exceed the en...
Samsung Knoxguard authorization error vulnerability
Samsung Knoxguard is an open source Android platform-based security solution from Samsung Samsung in South Korea that can enhance security across the board through a combination of physical means and software systems, while being perfectly compatible with the Android and Google ecosystems, bringi...
WordPress core plugin for kitestudio plugin跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The WordPress plugin is an application plugin. versions of the WordPress core plugin for kitestudio plugin prior to 2.3.1 are vulnerable to a...
Microsoft Azure Site Recovery Elevation of Privilege Vulnerability (CNVD-2022-56592)
Microsoft Azure Site Recovery is a site recovery DRaaS from Microsoft Corporation USA. Microsoft Azure Site Recovery has an elevation of privilege vulnerability, and no details of the vulnerability are available...
WordPress Maintenance Mode
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Maintenance Mode...
Microsoft Azure Site Recovery Elevation of Privilege Vulnerability (CNVD-2022-56584)
Microsoft Azure Site Recovery is a site recovery DRaaS from Microsoft Corporation USA. Microsoft Azure Site Recovery has an elevation of privilege vulnerability, and no details of the vulnerability are available...
IBM CICS TX Advanced HTML Injection Vulnerability
IBM CICS TX Standard and Advanced is a comprehensive, single transaction runtime package from IBM USA. It can provide a cloud-native deployment model for standalone applications. An HTML injection vulnerability exists in IBM CICS TX Standard and Advanced version 11.1. The vulnerability stems from...
IBM Security Verify Access Cross-Site Scripting Vulnerability (CNVD-2022-87651)
IBM Security Verify Access ISAM is a service from IBM USA that improves user access security. The service enables secure and simple access to platforms such as Web, mobile, IoT and cloud technologies through the use of risk-based access, single sign-on, integrated access management controls,...
TOTOLINK T6 FUN_00412ef4 function stack overflow vulnerability
TOTOLINK T6 is a wireless dual-band router from China Gion Electronics TOTOLINK.A stack overflow vulnerability exists in TOTOLINK T6 V4.1.9cu.5179B20201015 version, which stems from the desc parameter in the FUN00412ef4 function not checking its length for input data. A remote attacker can exploi...
Tenda M3 formMasterMng function stack overflow vulnerability
Tenda M3 is an access control from Tenda, a Chinese company. Tenda M3 V1.0.0.12 version has a stack overflow vulnerability, which stems from the formMasterMng function url parameter not checking its length for input data. An attacker could exploit this vulnerability to cause a denial of service...
Jenkins build-metrics Plugin跨站脚本漏洞
Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. Jenkins Plugin is an application that provides hundreds of plug-ins to support building, deploying, and automating any project. Jenkins build-metrics Plugin version 1.3 contains a cross-site scripting...
Jenkins XebiaLabs XL Release Plugin Licensing Issue Vulnerability
Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project. jenkins Plugin is an application. jenkins XebiaLabs XL Release Plugin...
Jenkins Matrix Reloaded Plugin跨站脚本漏洞
Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.A cross-site scripting vulnerability exist...
SourceCodester Online Railway Reservation System SQL注入漏洞（CNVD-2022-53357）
Sourcecodester Online Railway Reservation system is a web-based application that provides an online platform for rail or train station passengers or would-be passengers to view their schedules and reserve seats. Online Railway Reservation System v1.0 version contains a SQL injection vulnerability...
TrueConf Server Cross-Site Scripting Vulnerability (CNVD-2022-53540)
TrueConf Server is a self-hosted and secure video collaboration platform from the Russian company TrueConf. version 4.3.7 of TrueConf Server contains a cross-site scripting vulnerability that could be exploited by remote attackers to perform basic cross-site scripting Reflected attacks...
GPAC Denial of Service Vulnerability (CNVD-2022-59868)
GPAC is a multimedia framework. a denial of service vulnerability exists in GPAC version 1.0.1, which originates from the GetHintFormat function. An attacker could exploit this vulnerability to cause a denial of service via a specially crafted file in the MP4Box command...
Haraj Cross-Site Scripting Vulnerability (CNVD-2022-66491)
A cross-site scripting vulnerability exists in Haraj v3.7, a buying and selling platform from Haraj Saudi Arabia. The vulnerability stems from a stored cross-site scripting XSS vulnerability contained in the Post Ads component. An attacker could exploit this vulnerability to conduct cross-site...
Cisco Catalyst 2940 Series Cross-Site Scripting Vulnerability
Cisco Catalyst is a series of switches from Cisco, Inc. A cross-site scripting vulnerability exists in the Cisco Catalyst 2940 Series, which stems from a failure to properly process user input and generate an error page that could be exploited by an attacker to execute arbitrary scripts on the we...