Jenkins Matrix Reloaded Plugin跨站脚本漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.A cross-site scripting vulnerability exist...

SourceCodester Online Railway Reservation System SQL注入漏洞（CNVD-2022-53357）

Sourcecodester Online Railway Reservation system is a web-based application that provides an online platform for rail or train station passengers or would-be passengers to view their schedules and reserve seats. Online Railway Reservation System v1.0 version contains a SQL injection vulnerability...

TrueConf Server Cross-Site Scripting Vulnerability (CNVD-2022-53540)

TrueConf Server is a self-hosted and secure video collaboration platform from the Russian company TrueConf. version 4.3.7 of TrueConf Server contains a cross-site scripting vulnerability that could be exploited by remote attackers to perform basic cross-site scripting Reflected attacks...

GPAC Denial of Service Vulnerability (CNVD-2022-59868)

GPAC is a multimedia framework. a denial of service vulnerability exists in GPAC version 1.0.1, which originates from the GetHintFormat function. An attacker could exploit this vulnerability to cause a denial of service via a specially crafted file in the MP4Box command...

Samsung Members dynamic receiver code issue vulnerability

Samsung Members is a community platform app from Samsung, a South Korean company. a code issue vulnerability exists in versions prior to Samsung Members 4.2.005. The vulnerability stems from the fact that dynamic receivers in Samsung Members are not properly protected and can be exploited by...

Haraj Cross-Site Scripting Vulnerability (CNVD-2022-66491)

A cross-site scripting vulnerability exists in Haraj v3.7, a buying and selling platform from Haraj Saudi Arabia. The vulnerability stems from a stored cross-site scripting XSS vulnerability contained in the Post Ads component. An attacker could exploit this vulnerability to conduct cross-site...

Cisco Catalyst 2940 Series Cross-Site Scripting Vulnerability

Cisco Catalyst is a series of switches from Cisco, Inc. A cross-site scripting vulnerability exists in the Cisco Catalyst 2940 Series, which stems from a failure to properly process user input and generate an error page that could be exploited by an attacker to execute arbitrary scripts on the we...

WordPress Export All URLs plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Export All URLs plugin 4.1 and earlier versions are vulnerable to cross-site scripting. An attacker...

WordPress OnePress Social Locker plugin cross-site request forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

Samsung Pass licensing issue vulnerability

Samsung Pass is a secure and easy way to log in to websites and applications on cell phones using biometric technology from Samsung of South Korea.An authorization issue vulnerability exists in versions prior to Samsung Pass 4.0.00.33, which stems from improper authorization. An attacker could us...

LibreHealth EHR Cross-Site Scripting Vulnerability (CNVD-2022-62206)

LibreHealth EHR is a clinically-focused electronic health record EHR system designed to be easy to use out of the box and customizable for use in a variety of healthcare settings. The navigation.php page lacks filtering and escaping for parameters. An attacker could exploit this vulnerability to...

WordPress Files Download Delay plugin跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Files Download Delay plugin versions prior to 1.0.7 are vulnerable to cross-site request...

H3C Magic R100 Buffer Overflow Vulnerability (CNVD-2022-50710)

H3C Magic R100 is a router from H3C. H3C Magic R100 R100V100R005 version has a buffer overflow vulnerability, which originates from a buffer overflow issue in the UpdateSnat parameter of the /goform/aspForm page. No detailed vulnerability details are currently available...

Envoy code issue vulnerability

Envoy is an open source distributed proxy server. versions prior to Envoy 1.22.1 have a code issue vulnerability that could be exploited by an attacker to crash Envoy via null pointer dereference on an upstream server controlled by the vulnerability...

Swftools Null Pointer Dereference Vulnerability (CNVD-2022-62214)

Swftools is a set of utilities for working with Adobe Flash files SWF files. A null pointer dereference vulnerability exists in Swftools 2020-12-22 and earlier versions, which stems from the presence of a NULL pointer dereference in the function main located in swfdump.c. The vulnerability can be...

Swftools out-of-bounds write vulnerability (CNVD-2022-62215)

Swftools is a set of utilities for working with Adobe Flash files SWF files. An out-of-bounds write vulnerability exists in Swftools 2020-12-22 and prior versions, which stems from a heap buffer overflow in the function swfGetD64 located in rfxswf.c. The vulnerability is caused by a heap buffer...

Online Fire Reporting System SQL注入漏洞

Online Fire Reporting System is an online fire reporting system from Carlo Montero's personal developer. version v1.0 of Online Fire Reporting System is vulnerable to SQL injection, which originates from /ofrs/classes/Master.php?f= deleteteam lacks validation of external input SQL statements, whi...

Rescue Dispatch Management System SQL注入漏洞（CNVD-2022-53917）

Rescue Dispatch Management System is a rescue dispatch management system from Carlo Montero's personal developer. v1.0 of Rescue Dispatch Management System is vulnerable to SQL injection, which originates from /rdms/admin/ incidentreports/viewreport.php?id=The page lacks validation for external...

Online Fire Reporting System SQL Injection Vulnerability (CNVD-2022-55738)

Online Fire Reporting System is an online fire reporting system from Carlo Montero's personal developer. version v1.0 of Online Fire Reporting System is vulnerable to SQL injection, which originates from /ofrs/admin/?page=reports& date=Lack of validation of external input SQL statements, an...

LibreHealth EHR Cross-Site Scripting Vulnerability (CNVD-2022-65030)

LibreHealth EHR is a clinically-focused electronic health record HER system designed to be both easy to use out of the box and customizable for use in a variety of healthcare settings. libreHealth EHR 2.0.0 is vulnerable to a cross-site scripting vulnerability for which no detailed vulnerability...

Elitecms SQL Injection Vulnerability (CNVD-2022-57759)

Elitecms is a Web content management from elitecms India. elitecms version 1.01 has a SQL injection vulnerability that originates from the lack of validation of external input SQL statements on the /admin/addpost.php page, which can be exploited by attackers to execute illegal SQL commands to ste...

bbs-go cross-site scripting vulnerability

bbs-go is an open source community system built using the Go language. bbs-go 3.3.0 and earlier versions have a cross-site scripting vulnerability that stems from the lack of filtering and escaping of user data in the v-html tag of vue used by the application. An attacker could use this...

Illumina Local Run Manager Code Injection Vulnerability

Illumina Local Run Manager is an integrated solution from Illumina, Inc. Illumina Local Run Manager is vulnerable to code injection, which could be exploited by attackers to remotely upload and execute code at the operating system level...

Docker Desktop Access Control Error Vulnerability

Docker Desktop is a container-based desktop software for lightweight deployment of applications from Docker, Inc. The product provides a desktop environment that supports creating a container lightweight virtual machine and deploying and running applications on Linux/Windows/Mac OS systems, as we...

Multi Store Inventory Management System授权问题漏洞

Multi Store Inventory Management System is a multi-store inventory management system. version 1.0 of Multi Store Inventory Management System is vulnerable to an authorization issue. An attacker can exploit this vulnerability to perform an account takeover via a specially crafted POST request...

Aruba ClearPass Policy Manager Remote Authentication Bypass Vulnerability (CNVD-2022-64234)

Aruba ClearPass Policy Manager is an application from Aruba, Inc. that provides a secure access management system for wireless networks. a remote authentication bypass vulnerability exists in Aruba ClearPass Policy Manager, which can be exploited by attackers to bypass authentication leading to...

InHand Networks InRouter302缓冲区溢出漏洞

InHand Networks InRouter Series is a series of routers from InHand Networks, U.S.A. A buffer overflow vulnerability exists in InHand Networks InRouter302 version V3.5.4, which stems from the httpd parsepingresult API function A boundary error occurs when handling untrusted input, which can be...

InHand Networks InRouter302跨站脚本漏洞

InHand Networks InRouter Series is a series of routers from InHand Networks, U.S.A. A cross-site scripting vulnerability exists in InHand Networks InRouter302 V3.5.4, which can be exploited by attackers to cause arbitrary Javascript code...

Survey Sparrow Enterprise Survey Software Cross-Site Scripting Vulnerability

Survey Sparrow Enterprise Survey Software is an enterprise survey software from Survey Sparrow, Inc. A cross-site scripting vulnerability exists in Survey Sparrow Enterprise Survey Software version 2022, which stems from a lack of data validation filtering in the Signup parameter is missing a dat...

Microsoft Windows WLAN AutoConfig Service Denial of Service Vulnerability

Microsoft Windows WLAN AutoConfig Service is a wireless network card configuration service for Microsoft Windows Vista and above. Denial of Service vulnerability. The vulnerability stems from a failure to properly handle incoming error messages, and can be exploited to cause a denial of service o...

WordPress RSVPMaker plugin SQL injection vulnerability (CNVD-2022-67547)

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. RSVPMaker is an event scheduling and RSVP tracking plugin used in WordPress RSVPMaker plugin 9.2.6 and earlier versions are vulnerable to SQL injection, which stems from a lack of SQL escaping of data. ...

Unspecified vulnerability in Siemens SICAM P850 and SICAM P855 Devices (CNVD-2022-36397)

The SICAM P850 Multifunctional Measurement Device is used to collect, visualize, evaluate and transmit electrical measurement variables such as AC current, AC voltage, frequency, power, harmonics, etc. The SICAM P855 Multifunctional Device is used to collect, display and transmit measured...

PHProjekt MyProjects Cross-Site Scripting Vulnerability

PHProjekt MyProjects is a modular web application for project management written in PHP / MySql by PHProjekt. PHProjekt MyProjects version 1.3.0 contains a cross-site scripting vulnerability that can be exploited by attackers to execute JavaScript code on the client side...

Royal Event Management System SQL Injection Vulnerability

Royal Event Management System is an event management system. version v1.0 of Royal Event Management System is vulnerable to SQL injection, which stems from the lack of validation of external input SQL statements in the todate parameter. An attacker could use this vulnerability to execute illegal...

Cyclos 4 PRO Cross-Site Scripting Vulnerability

Cyclos 4 PRO is a web server. A cross-site scripting vulnerability exists in Cyclos 4 PRO version 4.14.7 and earlier, which can be exploited by remote attackers to inject arbitrary web scripts or HTML via the groupId parameter...

F5 BIG-IP Cross-Site Scripting Vulnerability (CNVD-2022-77529)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing, etc. A cross-site scripting vulnerability exists in F5 BIG-IP, which can be exploited by attackers to execute JavaScript in the context of the...

F5 BIG-IP APM Cross-Site Scripting Vulnerability (CNVD-2022-77527)

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A cross-site scripting vulnerability exists in F5 BIG-IP APM, which can be exploited by attackers to execute JavaScript in th...

Xiaomi MIUI has an unspecified vulnerability (CNVD-2022-81249)

Xiaomi MIUI is an Android-based smartphone operating system developed by Xiaomi Technology China, Inc. A security vulnerability exists in Xiaomi MIUI due to a lack of checksum when using incoming parameters from a three-party application, which could be exploited by attackers to induce users to...

WordPress plugin ThirstyAffiliates Affiliate Link Manager licensing issue vulnerability (CNVD-2023-06534)

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress plugin ThirstyAffiliates Affiliate Link Manager 3.10.5 previously had a security...

WordPress plugin 3xSocializer SQL injection vulnerability

WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up a personal blog site on a server with PHP and MySQL. WordPress plugin 3xSocializer 0.98.22 and previous versions have a SQL injection vulnerability, which can be exploited by attackers to...

Social Codia SMS Arbitrary File Upload Vulnerability

Social Codia SMS is an inventory management system from Social Codia India. v1.0 of Social Codia SMS is vulnerable to arbitrary file uploads, which can be exploited by attackers to execute arbitrary code via crafted PHP files...

Microsoft Windows Remote Desktop Protocol Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Microsoft Windows Remote Desktop Protocol RDP, an application used by Microsoft to connect to remote Windows desktops. The vulnerability stems from the failure of a networked system or product to properly filter special elements of code segments...

WordPress eRoom–Zoom Meetings＆Webinar plugin跨站请求伪造漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress eRoom-Zoom Meetings & Webinar plugin 1.3.7 an...

Siemens SCALANCE X-300 Switch Family Devices存在未明漏洞

SCALANCE X switches are used to connect industrial components such as programmable logic controllers PLCs or human-machine interfaces HMIs.SIPLUS extreme is designed for reliable operation under extreme conditions.A security vulnerability exists in Siemens SCALANCE X-300 Switch Family Devices tha...

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CNVD-2022-60118)

Microsoft Edge is a web browser that comes with versions of Windows 10 and later, and an elevation of privilege vulnerability exists in Microsoft Edge Chromium-based. An attacker could exploit this vulnerability to elevate privileges...

Totolink a3100r Trust Management Issue Vulnerability

TotoLink A3100R is a series of wireless routers from TotoLink, a Taiwan-based company. TotoLink A3100R version V5.9c.4577 is vulnerable to a trust management issue, which stems from the fact that the telnet password is hard-coded and pre-populated in the official firmware, and an attacker connect...

Firmware Analysis and Comparison Tool跨站请求伪造漏洞

Firmware Analysis and Comparison Tool FACT is a firmware analysis and comparison tool. firmware Analysis and Comparison Tool version v3.2 contains a cross-site request forgery vulnerability that stems from a WEB application that does not adequately validate that the request is from a trusted user...

Vulnerability of authorization issues in Joomla!

Joomla! is a set of forum components used in the Joomla! content management system. versions 2.5.0 through 3.10.6 and 4.0.0 through 4.1.0 contain an authorization issue vulnerability that originates from a lack of authentication measures or insufficient authentication strength in the web system o...

Jenkins Proxmox Plugin Licensing Issue Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.Jenkins Proxmox Plugin 0.7.0 and earlier...

Jenkins Job and Node ownership Plugin跨站请求伪造漏洞

Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Job and Node ownership Plugin 0.13.0 and earlier versions are vulnerable to cross-site request forgery, which can be exploited by...