Red Hat Undertow Environment Issues Vulnerabilities

Red Hat Undertow is a U.S. Red Hat Red Hat, a Java-based embedded Web server, is the default Web server Wildfly Java application server. An environment issue vulnerability exists in versions prior to Red Hat Undertow 2.1.1.Final. An attacker could exploit this vulnerability to cause HTTP requests...

Roundcube Webmail Parameter Injection Vulnerability

Roundcube Webmail is an open source browser-based IMAP client that supports address book management, message searching, spell checking and more. A security vulnerability exists in the rcubeimage.php file in Roundcube Webmail versions prior to 1.4.4. An attacker can exploit the vulnerability to...

Codiad Web IDE Code Injection Vulnerability

Codiad Web IDE is Codiad project a set of Web-based IDE Integrated Development Environment. A code injection vulnerability exists in Codiad Web IDE 2.8.4 and earlier versions, which can be exploited by an attacker to inject PHP code...

IBM Spectrum Protect Plus Command Injection Vulnerability (CNVD-2020-14213)

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A command injection vulnerability exists in...

WordPress Cross-Site Scripting Vulnerability (CNVD-2020-02548)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress versions prior to 5.3.1. The vulnerability stems from...

Lenovo Power Management Driver Denial of Service Vulnerability

Lenovo Power Management is a system designed by Lenovo specifically for notebook computers to manage notebook power. It provides control of the performance and power consumption of various components of the laptop through a combination of software and hardware. A denial of service vulnerability...

Red Hat Undertow Log Message Disclosure Vulnerability

Red Hat Undertow is a U.S. Red Hat Red Hat, a Java-based embedded Web server, is the default Web server Wildfly Java application server. A log information disclosure vulnerability exists in the DEBUG logging in Red Hat Undertow versions prior to 2.0.20. The vulnerability stems from the abnormal...

LibTomCrypt Memory Corruption Vulnerability

LibTomCrypt is a fairly comprehensive modular portable encryption toolkit. LibTomCrypt 1.18.2 and earlier versions suffer from a memory corruption vulnerability that stems from the derdecodeutf8string function in derdecodeutf8string.c failing to correctly detect certain invalid UTF-8 sequences,...

Foxit Reader Text removeField Remote Code Execution Vulnerability Vulnerability

Foxit Reader is a Chinese Foxit Foxit company's a PDF document reader. A remote code execution vulnerability exists in Foxit Reader Text removeField. The vulnerability stems from a failure to verify the existence of an object before performing an operation on it. A remote attacker can exploit thi...

Dell OpenManage Network Manager Improper Access Control Vulnerability

Dell OpenManage Network Manager OMNM manages the entire lifecycle of heterogeneous network environments including Dell EMC, Cisco, HP, Arista, Juniper, Aruba, Brocade, SonicWALL, and more. An improper access control vulnerability exists in Dell OpenManage Network Manager, which can be exploited b...

Apache HTTP Server Response Splitting Vulnerability (CNVD-2018-15542)

Apache HTTP Server is the United States Apache Apache Software Foundation, an open source web server. The server is fast, reliable and can be expanded through a simple API. A response splitting vulnerability exists in Apache HTTP Server versions 2.4.1 through 2.4.23 and 2.2.0 through 2.2.31. An...

Redis Lua Subsystem Buffer Overflow Vulnerability

Redis is the United States Redis Labs, Inc. sponsored by a set of open source written in ANSI C, support for the network , memory-based can also be persistent log-type , key-value Key-Value storage database , and provides a variety of languages API. Lua subsystem is one of the subsystems that...

LilyPond Parameter Injection Vulnerability

LilyPond is a set of open source audio editing software. lilypond-invoke-editor is one of the tools used to invoke the editor. A security vulnerability exists in lilypond-invoke-editor in LilyPond version 2.19.80, which stems from the program failing to validate strings before launching a program...

bibutils null pointer dereference vulnerability (CNVD-2018-09313)

bibutils is a document format conversion tool. A security vulnerability exists in the 'addsn' function in the fields.c file of the libbibcore.a file in bibutils 6.2 and earlier. A remote attacker can exploit this vulnerability to cause a denial of service null pointer backreference and applicatio...

Buffer Overflow Vulnerability in Multiple WECON Products

WECON LeviStudio HMI Editor and PI Studio HMI Project Programmer are both HMI programming software from WECON Technologies, China. A buffer overflow vulnerability exists in WECON LeviStudio HMI Editor and PI Studio HMI Project Programmer versions prior to November 11, 2017 . A remote attacker can...

Apache Tika Command Injection Vulnerability

Apache Tika can leverage existing parsing libraries to detect and extract metadata and structured content from documents in different formats e.g., HTML, PDF, Doc. A command injection vulnerability exists in Apache Tika versions 1.7 through 1.17. An attacker can send a specially crafted header to...

Jupyter Notebook JavaScript Malicious Fake File Vulnerability

Jupyter Notebook is a suite of open source web applications for creating and sharing code and illustrative text documents. A security vulnerability exists in Jupyter Notebook versions prior to 5.4.1. An attacker can exploit this vulnerability to execute JavaScript code in a notepad context with t...

Primetek Primefaces Remote Code Execution Vulnerability

Primetek Primefaces is an open source use in the Java EE system UI library . A remote code execution vulnerability exists in version 5.x of Primetek Primefaces. A remote attacker could exploit this vulnerability to execute code...

LilyPond lilypond-invoke-editor injection vulnerability

LilyPond is a set of open source audio editing software. lilypond-invoke-editor is one of the tools used to invoke the editor. A security vulnerability exists in lilypond-invoke-editor in LilyPond version 2.19.80, which stems from a failure to detect strings before starting the program. A remote...

Apache CXF Fediz Spring plugin cross-site request forgery vulnerability

Apache CXF is the United States Apache Apache Software Foundation of an open source Web services framework. The framework supports a variety of Web services standards , a variety of front-end programming APIs , etc. Apache CXF Fediz is one of the sub-projects , mainly used to provide authenticati...

LibRaw Buffer Overflow Vulnerability (CNVD-2017-33276)

LibRaw is a C++ library developed by the LibRaw team for processing RAW CRW/CR2, NEF, RAF, DNG and others format images. A xtransinterpolate stack buffer overflow vulnerability in the internal/dcrawcommon.cpp file in versions of LibRaw prior to 0.18.3. A remote attacker can exploit this...

HP Integrated Lights-out 4 Remote Code Execution Vulnerability

HP Integrated Lights-Out 4 iLO 4 is an embedded server management technology from Hewlett-Packard HP in the United States that monitors and maintains server operations, remote control of servers, and more through an integrated remote management port. A security vulnerability exists in versions of...

CloudBees Jenkins Blue Ocean Plugin Security Bypass Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . A...

Apache HTTP Server Denial of Service Vulnerability (CNVD-2017-13906)

Apache HTTP Server is the United States Apache Apache Software Foundation, an open source web server. The server is fast, reliable and can be expanded through a simple API. A denial of service vulnerability exists in Apache HTTP Server versions prior to 2.4.26. An attacker can exploit this...

Irssi Denial of Service Vulnerability (CNVD-2017-14157)

Irssi is a free, open source IRC client for use in Linux and Unix operating systems. A denial of service vulnerability exists in Irssi versions prior to 1.0.3. A remote attacker could exploit this vulnerability to cause a denial of service null pointer backreference and server crash...

WinPLC Stack Buffer Overflow Vulnerability

WinPLC is a free set of applications for controlling the VellemanK8000 computer interface board. A stack buffer overflow vulnerability exists in WinPLC 5.0.45.5921 and earlier versions. A remote attacker can exploit this vulnerability to execute code with the help of specially crafted packets...

Sophos Web Appliance Command Injection Vulnerability

Sophos Web Appliance is a web security gateway solution. An input validation vulnerability in the MgrReport.php file in the web management interface of the Sophos Web Appliance could be exploited by an attacker to submit a special request to inject a system command and execute it...

Phoenix Contact ILC Information Disclosure Vulnerability

Phoenix Contact ProConOs and MultiProg are programmable logic controllers PLCs for use in industrial PCs from the Phoenix Contact group. An information disclosure vulnerability exists in Phoenix Contact ILC PLCs due to sensitive information being stored in clear text. An attacker could exploit th...

BMC Server Automation Authentication Bypass Vulnerability

BMC Server Automation is a suite of platforms for managing, controlling, and enforcing configuration changes in data centers from BMC Software, USA. An authentication bypass vulnerability exists in BMC Server Automation version 8.7 Patch 2 and earlier. An attacker could exploit this vulnerability...

Moxa EDR-G903 Memory Disclosure Vulnerability

Moxa EDR-G903 is a suite of Moxa's all-in-one firewall/VPN security router products. A security vulnerability exists in Moxa EDR-G903 V3.4.11 and earlier versions. A remote attacker can exploit the vulnerability to cause a memory leak...

Exim Configuration File Path Elevation of Privilege Vulnerability

Exim is an open source messaging agent MTA developed by the University of Cambridge in the UK that runs on Unix systems and is responsible for routing, forwarding and delivering mail. A security vulnerability exists in Exim that stems from an error in the program's handling of environment variabl...

Apport/Abrt Local Privilege Vulnerability

Apport is the crash report service on ubuntu, that is, when a program crashes the pop-up program that sends an error report. ABRT is an automated bug detection and reporting tool. Apport/Abrt is vulnerable to a local privilege exploit. An attacker can exploit the vulnerability to gain root...

Oracle MySQL Server JSON Component Denial of Service Vulnerability

Oracle MySQL Server is an open source relational database management system that provides data storage, querying and management capabilities. A denial of service vulnerability exists in Oracle MySQL Server. The vulnerability stems from a failure of the Server: JSON component to properly handle...

OpenClaw Information Disclosure Vulnerability (CNVD-2026-13370)

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from an information disclosure vulnerability. The vulnerability stems from the fact that skills.status may return raw parsed configuration values for the skills.config path via configChecks, which can be...

Microsoft Excel Resource Management Error Vulnerability

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. A security vulnerability exists in Microsoft Excel, which can be exploited by an attacker to remotely execute code...

Intel 800 Series Ethernet Integer Overflow Vulnerability

Intel 800 Series Ethernet is a new generation of high-speed Ethernet technology from Intel that supports 25GbE and 100GbE speeds and is backward compatible with 10GbE. Intel 800 Series Ethernet suffers from an integer overflow vulnerability that stems from an integer overflow or wrap-around error...

WordPress Inset plugin file inclusion vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A file inclusion vulnerability exists in the WordPress Inset plugin that stems from not doing effective filtering of local file resource calls, which can be exploited by an...

ChuanhuChatGPT Cross-Site Scripting Vulnerability

ChuanhuChatGPT is an application that provides a lightweight and easy-to-use web GUI and many additional features for a wide range of LLMs such as ChatGPT. ChuanhuChatGPT suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping o...

MonetDB Server SQL Injection Vulnerability

MonetDB is MonetDB open source an open source column-oriented relational database management system . A SQL injection vulnerability exists in the expref component of MonetDB version 11.49.1, which can be exploited by an attacker to cause a denial of service via a specially crafted SQL statement...

Huawei HarmonyOS Competitive Conditions Issue Vulnerability (CNVD-2025-07613)

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS suffers from a Competitive Condition Issue vulnerability that stems from a multiple concurrency issue that affects availability. An attacker...

Mozilla Firefox Security Bypass Vulnerability (CNVD-2024-48566)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security bypass vulnerability exists in Mozilla Firefox, which can be exploited by an attacker to view saved passwords without performing the required device PIN authentication...

Unspecified vulnerability in Linux kernel (CNVD-2024-46431)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel has a security vulnerability that stems from the presence of an IO mapping flag issue. No details of the vulnerability are provided at this time...

NetIQ Advanced Authentication Brute Force Vulnerability

NetIQ Advanced Authentication is an application from NetIQ UK. It provides a more secure way to protect your sensitive information by moving away from usernames and passwords. A brute force vulnerability exists in NetIQ Advanced Authentication versions prior to 6.3.5.1, which stems from not...

Microweber add_tagging_tagged.php file cross-site scripting vulnerability

Microweber is Microweber open source can provide drag and drop functionality of the online store management system . The system includes adding products , images and other modules. microweber version 2.0.16 cross-site scripting vulnerability , the vulnerability stems from...

Triangle MicroWorks SCADA Data Gateway Remote Code Execution Vulnerability

Triangle MicroWorks SCADA Data Gateway is a SCADA data gateway product from Triangle MicroWorks, Inc. A remote code execution vulnerability exists in Triangle MicroWorks SCADA Data Gateway, which can be exploited by an attacker to execute arbitrary code in the root context...

Apache Airflow code execution vulnerability (CNVD-2024-33592)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow suffers from a code execution vulnerability that can be exploited by...

Remote Code Execution Vulnerability in D-Link DIR-2150 (CNVD-2024-33401)

The D-Link DIR-2150 is a wireless router from China-based AUO D-Link. A remote code execution vulnerability exists in the D-Link DIR-2150, which can be exploited by an attacker to execute arbitrary code...

Unspecified Vulnerability in Nextcloud (CNVD-2024-29655)

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. Nextcloud Photos suffers from a security vulnerability that stems from the ability for users to delete photos from registered users' albums. No details of the...

Google Android elevation of privilege vulnerability (CNVD-2024-41856)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that originates from the ability to access clipboard messages without displaying a toast message in multiple methods in the NotificationManagerService.java...

Foxit PDF Reader Code Execution Vulnerability (CNVD-2024-20601)

Foxit PDF Reader is China Foxit Foxit company a PDF reader. Foxit PDF Reader has a code execution vulnerability that stems from a post-release reuse problem when dealing with Doc objects, which can be exploited by an attacker to execute arbitrary code in the context of the current process...