GPAC has an unspecified vulnerability (CNVD-2022-22300)

GPAC is an open-source multimedia framework. there is a security vulnerability in MP4Box before GPAC version 2.1.0-DEV, and no detailed vulnerability details are available...

Jenkins Extended Choice Parameter Plugin Cross-Site Scripting Vulnerability

Jenkins and Jenkins Plugin are both products of Jenkins. jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. The vulnerability stems from the plugin's failure to escape the value and description ...

Luocms SQL Injection Vulnerability (CNVD-2022-20130)

Luocms is an article management system. A SQL injection vulnerability exists in Luocms v2.0, which stems from a lack of validation of external input SQL statements in /admin/news/sortok.php. An attacker could use this vulnerability to execute illegal SQL commands to steal sensitive database data...

FreeTAKServer-UI SQL Injection Vulnerability

FreeTAKServer-UI is an open source FTS web interface from the FreeTAKTeam team.FreeTAKServer-UI is vulnerable to SQL injection, which stems from the API endpoint/AuthenticateUser containing SQL injection into the SQLite3 database, which can be exploited by an attacker to obtain the database All...

Microweber Cross-Site Scripting Vulnerability (CNVD-2022-18522)

Microweber is a drag-and-drop website builder and CMS based on the PHP Laravel framework.Microweber suffers from a cross-site scripting vulnerability that could be exploited by attackers to steal user information and phishing...

Siemens SINEC NMS Deserialization Vulnerability

Siemens SINEC NMS is a network management system NMS from Siemens Germany that can be used to centrally monitor, manage, and configure industrial networks with tens of thousands of devices, including safety-related areas, 24 hours a day, 7 days a week. The vulnerability could be exploited to...

WordPress Mortgage Calculators WP Cross-Site Scripting Vulnerability

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. WordPress Mortgage Calculators WP suffers from a cross-site scripting vulnerability, for which no detailed...

Espruino Buffer Overflow Vulnerability (CNVD-2022-20169)

Espruino is a JavaScript interpreter. It is designed for devices with only 128kB of flash memory and 8kB of RAM. espruino has a security vulnerability that stems from src/jsvar.c containing a stack buffer overflow. No details of the vulnerability are currently available...

WordPress Plugin Authorization Issue Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An authorization issue vulnerability exists in the Advanced Cron Manager WordPress plugin and the Advanced Cro...

MingSoft Mcms SQL Injection Vulnerability (CNVD-2022-18534)

MingSoft Mcms is China's MingFei MingSoft company's a complete open source J2ee system . A security vulnerability exists in MingSoft Mcms v5.2.5 that allows an attacker to perform a SQL injection attack via the search.do parameter in the file /web/MCmsAction.java. No details of the vulnerability...

Tenda Ax3 Command Injection Vulnerability (CNVD-2022-13933)

Tenda Ax3 is an Ax1800 Gigabit Port Dual Band Wifi 6 Wireless Router from Tenda China. A command injection vulnerability exists in Tenda AX3 v16.03.12.10CN, which can be exploited by an attacker to cause a denial of service DoS via the remoteIp parameter...

Adobe After Effects out-of-bounds write vulnerability (CNVD-2022-15926)

Adobe After Effects is a suite of visual effects and motion graphics software from Adobe. An out-of-bounds write vulnerability exists in Adobe After Effects 22.1.1 and prior and 18.4.3 and prior, which stems from the program not properly validating user input. An attacker could use this...

Atlassian Confluence Server权限提升漏洞

Atlassian Confluence Server is a server version of Atlassian Australia's suite of collaborative software with enterprise knowledge management capabilities and support for building enterprise WiKi. An elevation of privilege vulnerability exists in Atlassian Confluence Server, which stems from an...

WordPress Ibtana plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. cross-site scripting vulnerability exists in versions of WordPress Ibtana plugin prior to 1.1.4....

WordPress UpdraftPlus WordPress Backup plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. A cross-site scripting vulnerability exists in the WordPress UpdraftPlus Backup Plugin in versions prior to 1.16.69. The vulnerability stems from the failure to escape the updraftrestore parameter and c...

Reolink RLC-410W Access Control Error Vulnerability (CNVD-2022-10725)

Reolink Rlc-410W is a Wifi security camera from Reolink China. cgiserver.cgi cgicheckability in Reolink RLC-410W v3.0.0.13620121102 is vulnerable to an access control error, which can be exploited by an attacker by sending an HTTP request to trigger it, causing a denial of service...

Insyde InsydeH2O Buffer Overflow Vulnerability (CNVD-2022-10273)

Insyde InsydeH2O is a C source from Insyde Software Taiwan, China that implements the new technology "EFI/UEFI" specification, designed to replace the legacy BIOS Basic Input/Output System. Operating System H2O UEFI firmware has a buffer overflow vulnerability that can be exploited to write fixed...

Siemens Teamcenter Visualization and Solid Edge Out-of-Bounds Reading Vulnerability

Siemens Teamcenter Visualization is a software that provides team collaboration capabilities for designing 2D and 3D scenes. Siemens Solid Edge is a 3D CAD software from Siemens, a German company. Solid Edge has an out-of-bounds read vulnerability that can be exploited by attackers to execute cod...

Oracle MySQL Input Validation Error Vulnerability (CNVD-2022-09138)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. An input validation error vulnerability exists in MySQL Cluster, which stems from incorrect input validation by the Cluster: General component in MyS...

Jerryscript jmem-heap.c Denial of Service Vulnerability

JerryScript is a lightweight JavaScript engine JerryScript project . A denial of service vulnerability exists in Jerryscript version 3.0.0, which originates from an assertion at /jerry-core/jmem/jmem-heap.c, and can be exploited by an attacker to trigger a denial of service...

Oracle MySQL Cluster Buffer Overflow Vulnerability (CNVD-2022-07922)

Oracle MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database developed by Oracle Corporation. Oracle MySQL Cluster is vulnerable to a buffer overflow vulnerability that could be exploited by an attacker to read the contents of memory or crash the application...

Oracle MySQL Cluster Information Disclosure Vulnerability (CNVD-2022-18210)

MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database designed to guarantee 99.999% availability. An information disclosure vulnerability exists in Oracle MySQL Cluster, which can be exploited by an attacker to cause a read beyond the end of an array...

JerryScript has an unspecified vulnerability (CNVD-2022-07240)

JerryScript, a lightweight JavaScript engine from the JerryScript project, is vulnerable in JerryScript 3.0.0, which originates in /base/ecma-helpers.cecmagetlexenvtype An assertion ecmaislexicalenvironment objectp fails at /base/ecma-helpers.c ecmagetlexenvtype. No detailed vulnerability details...

JerryScript has an unspecified vulnerability (CNVD-2022-07242)

JerryScript, a lightweight JavaScript engine from the JerryScript project, has a security vulnerability in JerryScript 3.0.0, which stems from /parser/js/js-scanner.cscannerscan statementend has an assertion contextp-stacktopuint8 == SCANSTACKTRYSTATEMENT || contextp-stacktopuint8 ==...

Teedy Cross-Site Scripting Vulnerability

Teedy is a French open source, lightweight document management system for individuals and businesses. Teedy suffers from a cross-site scripting vulnerability in versions v1.5 through v1.9 that stems from a lack of checksum filtering of user-supplied data and output. An attacker can exploit this...

soketi denial of service vulnerability

soketi is a C application ported to Node.js. soketi suffers from a denial of service vulnerability that stems from not properly handling incoming error messages, which can be exploited by attackers to cause a denial of service in the application...

Google Android Elevation of Privilege Vulnerability (CNVD-2022-16342)

Google Android is a Linux-based open-source operating system from the U.S. company Google. Google Android elevation of privilege vulnerability can be exploited by attackers to elevate privileges...

Linux kernel has unspecified vulnerabilities (CNVD-2022-06900)

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. Linux kernel has a security vulnerability that can be exploited by an attacker to trigger a memory corruption in the Linux kernel via RCU file reference GC to trigger a denial of service and possibly run...

Google Chrome Access Control Error Vulnerability (CNVD-2022-16301)

Google Chrome is a Web browser from Google, Inc. An access control error vulnerability exists in Google Chrome, which stems from a faulty implementation of Google Chrome's password and could be exploited to create a specially designed Web page that could trick victims into accessing it and...

Spinnaker Path Traversal Vulnerability

Spinnaker is a continuous delivery platform. Used to release software changes with high speed and confidence. Spinnaker suffers from a path traversal vulnerability that arises from a networked system or product that fails to properly filter for specific elements in a resource or file path. An...

Django path traversal vulnerability (CNVD-2022-31938)

Django is the Django Foundation's set of Python-based language open source Web application framework . The framework includes an object-oriented mapper, view system, template system, etc. Django version 2.2 before 2.2.26, 3.2.11 before 3.2.2, and 4.0.1 before 4.0.0 contains a path traversal...

Adobe Dimension out-of-bounds read vulnerability

Adobe Dimension is a set of 2D and 3D composite design tools from Adobe, Inc. An out-of-bounds read vulnerability exists in Adobe Dimension, which can be exploited by attackers to cause sensitive memory leaks...

GPAC Denial of Service Vulnerability (CNVD-2022-03628)

GPAC is an open source multimedia framework. gfdumpsetup function in GPAC version 1.0.1 has a denial of service vulnerability that stems from certain security-related information being missed and can be exploited by an attacker to cause a denial of service...

automox Alive Automox Agent Denial of Service Vulnerability

automox Alive Automox Agent is an agent software from the Automox Alive community. The automox Alive Automox Agent before 32 version denial of service vulnerability, which stems from the agent incorrectly setting permissions to temporary directories. An attacker could exploit this vulnerability t...

Adobe Premiere Rush Privilege Escalation Vulnerability

Adobe Premiere Rush is a set of cross-platform video editing software from the U.S. company Audobee Adobe. A security vulnerability exists in Adobe Premiere Rush, which can be exploited by attackers for elevation of privilege...

Linux kernel has unspecified vulnerabilities (CNVD-2022-21492)

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. Linux kernel has a security vulnerability that can be exploited by local users to gain unauthorized access to certain data...

Open-xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2021-90762)

Open-xchange OX App Suite is a web-based cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. A cross-site scripting vulnerability exists in Open-xchange OX App Suite, which can be exploited...

Google Chrome service workers security bypass vulnerability

Google Chrome is a web browser from Google, Inc. A security vulnerability exists in Google chrome, which is caused by improper design or implementation during the development of code for a web system or product. A remote attacker could exploit the vulnerability to bypass security restrictions...

Binatone Motorola-branded Camera Information Disclosure Vulnerability

Binatone Motorola-branded Camera is a Binatone licensed Motorola-branded product camera from Binatone Inc. The Binatone Motorola-branded Camera is vulnerable to information disclosure, which could be exploited by an attacker to download an encrypted log file containing sensitive information such ...

WordPress Wow Forms plugin SQL injection vulnerability (CNVD-2021-99632)

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in the WordPress Wow Forms plugin in version 3.1.3 and earlier, which stems fr...

ServiceTonic Arbitrary File Upload Vulnerability

ServiceTonic is an ITIL-compliant service desk and enterprise service software. serviceTonic versions prior to 9.0.35937 have an arbitrary file upload vulnerability in the service import feature. An attacker could exploit the vulnerability to execute JSP code by uploading a zip file that extracts...

D-Link DIR-823G Command Injection Vulnerability (CNVD-2021-85891)

The D-Link DIR-823G is an AC1200M dual-band gigabit wireless router.A command injection vulnerability exists in the HNAP1 protocol of the D-Link DIR-823G version 1.0.2B05. The vulnerability can be exploited to execute arbitrary web scripts via shell meta characters in the PrivateLogin field of th...

DAQFactory Plaintext Transfer Vulnerability

DAQFactory is a software and application development platform that provides a variety of tools that allow you to easily create HMI/SCADA applications. A plaintext transfer vulnerability exists in DAQFactory 18.1 Build 2347 and earlier versions. The vulnerability stems from cookie information bein...

Atlassian Jira Access Control Error Vulnerability (CNVD-2022-05447)

Atlassian Jira is a defect tracking management system from Atlassian Australia. Atlassian Jira is vulnerable due to an access control error in the product's /secure/admin/ConfigureBatching!default.jspa file, which fails to properly handle user permissions. An attacker could use an unauthorized us...

Google Android System Denial of Service Vulnerability (CNVD-2021-101429)

Android is a Linux-based open source operating system developed by Google Inc. and the Open Handheld Alliance OHA. a denial-of-service vulnerability exists in the System component of Google Android versions 9, 10 and 11, which could be exploited by attackers to cause a denial of service...

News Portal Project SQL Injection Vulnerability (CNVD-2021-102010)

News Portal Project is an open source news portal project . News Portal Project in version 3.1, there is a SQL injection vulnerability , the vulnerability stems from the application's category, subcategory, sucatdescription, username parameters lack of validation of external input SQL statements...

Google Chrome under-validation vulnerability for untrusted inputs

Chrome, a simple and efficient web browsing tool developed by Google, is vulnerable to insufficient validation of untrusted input in Intents in versions prior to Google Chrome 95.0.4638.69. A remote attacker could exploit this vulnerability to arbitrarily browse malicious URLs via crafted HTML...

Nextcloud file traversal vulnerability

Nextcloud is an open source set of self-hosted file synchronization and sharing communication applications platform from Germany-based Nextcloud. nextcloud has a file traversal vulnerability in versions prior to 20.0.13, 21.0.5, and 22.2.0, which stems from a lack of authentication, access contro...

Adobe Premiere Elements null pointer dereference vulnerability (CNVD-2021-91993)

Adobe Premiere Elements is a video editing software application from Adobe. Adobe Premiere Elements 2021 build 19.0 and earlier versions are vulnerable to a null pointer dereference. An attacker could exploit this vulnerability to cause a denial of service for the application...

ZTE MF971R Stack Buffer Overflow Vulnerability (CNVD-2021-92824)

The ZTE MF971R is a Cat 6 LTE mobile Wi-Fi router with download speeds up to 300mbps and upload speeds up to 50mbps.The ZTE MF971R is vulnerable to a stack buffer overflow vulnerability. An attacker can exploit this vulnerability to execute arbitrary code...