D-Link DSL-3782 Command Injection Vulnerability

The D-Link DSL-3782 is a wireless router from AUO D-Link of Taiwan, China. The D-Link DSL-3782 suffers from a command injection vulnerability that stems from the presence of a command injection point on the administration page. No detailed vulnerability details are provided at this time...

Adobe Acrobat and Adobe Reader Resource Management Error Vulnerability (CNVD-2022-56089)

Adobe Acrobat and Adobe Reader are the United States of America Odo than Adobe company's products. Adobe Acrobat is a set of PDF file editing and conversion tools. Adobe Reader is a set of PDF document reading software. Adobe Acrobat and Adobe Reader there are resource management error...

Foxit PDF Reader Resource Management Error Vulnerability (CNVD-2023-49833)

Foxit PDF Reader is China Foxit Foxit company a PDF reader. Foxit PDF Reader suffers from a resource management error vulnerability that stems from a specific flaw in the handling of Doc objects, which can be exploited by an attacker to execute code in the context of the current process...

Apache CloudStack XML External Entity Injection Vulnerability

Apache CloudStack is a suite of Infrastructure as a Service IaaS cloud computing platforms from the Apache Foundation in the United States. The platform is primarily used to deploy and manage large networks of virtual machines. An XML external entity injection vulnerability exists in Apache...

Pexip Infinity Input Validation Error Vulnerability (CNVD-2022-54740)

Pexip Infinity Pexip Video Conferencing Cloud Collaboration Platform is a video conferencing cloud collaboration platform from Pexip, a Norwegian company. Pexip Infinity is vulnerable to an input validation error that could be exploited by attackers to cause a denial of service...

SAP Business One License service API授权问题漏洞

SAP Business One License service API is a service of SAP Germany. It provides a unified service endpoint that can be used to access business data from source systems outside of the SAP Business One system via API calls.The SAP Business One License service API contains an authorization issue...

H3C SSL VPN Cross-Site Scripting Vulnerability

H3C SSL VPN is a secure session layer VPN from China's Xinhua San H3C. A cross-site scripting vulnerability exists in H3C SSL VPN 2022-07-10 and prior versions, which can be exploited by remote attackers to allow wnm/login/login.json svpnlang cross-site scripting attacks...

HUAWEI HarmonyOS Denial of Service Vulnerability (CNVD-2022-53574)

HUAWEI HarmonyOS is an operating system from the Chinese company Huawei HUAWEI. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in the HUAWEI HarmonyOS AI business component, which stems from the fact that hiaiserver does not do...

HUAWEI HarmonyOS Denial of Service Vulnerability (CNVD-2022-53575)

HUAWEI HarmonyOS is an operating system from the Chinese company Huawei HUAWEI. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in the HUAWEI HarmonyOS AI business component, which stems from the fact that hiaiserver does not do...

Siemens SIMATIC eaSie Input Validation Error Vulnerability

SIMATIC eaSie, the digital assistant for automation and process control technology in the Siemens Automation Concept "Total Integrated Automation", is vulnerable to an input validation error that could be exploited by remote attackers to trigger a denial of service on the affected system...

Siemens SIMATIC CP SRCS VPN Feature Command Injection Vulnerability

The SIMATIC CP 1242-7 and CP 1243-7 LTE communication processors connect SIMATIC S7-1200 controllers to a wide area network WAN. They provide integrated security features such as firewalls, virtual private networks VPNs, and support for other protocols with data encryption.The SIMATIC CP 1243-8 I...

Siemens Simcenter Femap Out-of-Bounds Write Vulnerability (CNVD-2022-51431)

An out-of-bounds write vulnerability exists in Siemens Simcenter Femap, an advanced simulation application for creating, editing, and inspecting finite element models of complex products or systems, which can be exploited by attackers to execute code in the context of the current process...

parse-url cross-site scripting vulnerability

parse-url is an advanced url parser with git url support. A cross-site scripting vulnerability exists in parse-url versions prior to 7.0.0, which stems from the ability to run malicious JS code using ASCII characters starting with and all special escape characters starting with Unicode, which can...

WordPress Ninja Forms Contact Form plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

IBM Spectrum Protect Server Information Disclosure Vulnerability (CNVD-2022-60413)

IBM Spectrum Protect is a suite of data protection platforms from IBM Corporation in the United States. The platform provides enterprises with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. IBM Spectrum Protect...

Jenkins Elasticsearch Query Plugin信息泄露漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.An information disclosure vulnerability...

Tuleap Cross-Site Scripting Vulnerability

Tuleap is an application lifecycle management system that facilitates agile software development, design projects, V-models, requirements management and IT service management.A cross-site scripting vulnerability exists in versions prior to Tuleap 13.9.99.111, which stems from a failure to properl...

WordPress MyCSS plugin cross-site request forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress MyCSS plugin 1.1 and earlier versions are vulnerable to cross-site request forgery, which stems fro...

74cmsSE SQL Injection Vulnerability

74cmsSE is a free open source professional recruitment system based on PHP MYSQL. 74cmsSE is vulnerable to SQL injection, which results from a lack of validation of externally entered SQL statements in the /home/resume/index keyword parameter. An attacker could use this vulnerability to execute...

Jfinal CMS SQL Injection Vulnerability (CNVD-2022-58382)

Jfinal CMS is a java development of powerful information consulting website , using a simple and powerful JFinal as the web framework , template engine with beetl, database with mysql, front-end bootstrap framework. Jfinal CMS version v5.1.0 has a SQL injection vulnerability that originates from...

Jenkins Stash Branch Parameter Plugin跨站脚本漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.A cross-site scripting vulnerability exis...

WordPress Allow svg files plugin file upload vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress plugin is an application plugin. WordPress Allow svg files plugin...

InvenTree CSV Injection Vulnerability

InvenTree is an open source inventory management system from InvenTree Open Source. Provides powerful low-level inventory control and parts tracking . A CSV injection vulnerability exists in InvenTree versions prior to 0.7.2, which stems from an application that does not filter the escaping of...

WordPress Plugin Keep Backup Daily Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress plugin Keep Backup Daily version 2.0.2 and prior versions, which stems from insufficient...

WordPress WPMK Ajax Finder plugin跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress WPMK Ajax Finder plugin 1.0.1 and earlier versions are vulnerable to cross-site request forgery,...

H3C Magic R100 Buffer Overflow Vulnerability (CNVD-2022-50710)

H3C Magic R100 is a router from H3C. H3C Magic R100 R100V100R005 version has a buffer overflow vulnerability, which originates from a buffer overflow issue in the UpdateSnat parameter of the /goform/aspForm page. No detailed vulnerability details are currently available...

HUAWEI HarmonyOS Buffer Overflow Vulnerability (CNVD-2022-66178)

HUAWEI HarmonyOS is an operating system from Huawei, China HUAWEI. HUAWEI HarmonyOS 2.0 is vulnerable to a buffer overflow vulnerability that can be exploited by attackers to cause availability impairment...

CSCMS Music Portal System SQL Injection Vulnerability (CNVD-2022-45398)

CSCMS Music Portal System is a diversified content management system of China Chong Sheng Network Technology CSCMS Company. CSCMS Music Portal System suffers from a SQL injection vulnerability that originates from the lack of validation of the id parameter of /admin.php/pic/admin/type/save for...

radare2 Denial of Service Vulnerability (CNVD-2022-68517)

radare2 is a set of libraries and tools for working with binary files. radare2 version 5.5.2 suffers from a denial of service vulnerability that stems from a NULL pointer dereference in the libr/bin/p/binsymbols.c binary symbols parser. An attacker could exploit this vulnerability to cause a deni...

WordPress Imagemap Selector plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress Imagemap Selector plugin, which stems from t...

ToolJet Information Disclosure Vulnerability

ToolJet is an extensible, low-code framework for building business applications from ToolJet. v0.5.0 to v1.2.2 of ToolJet is vulnerable to an information disclosure vulnerability that stems from a token leak in the application. An attacker could exploit the vulnerability to access a user's accoun...

HCL Technologies HCL Sametime File Upload Vulnerability

HCL Sametime, a conferencing solution from HCL Technologies, has a security vulnerability in HCL Technologies HCL Sametime version 11.6. The vulnerability stems from the fact that the user SID in the application can be modified, which can be exploited to modify the SID to enable arbitrary file...

Unspecified Vulnerability in Siemens Desigo PXC and DXR Devices (CNVD-2022-37375)

Desigo DXR2 controllers are programmable automation stations to support the standard control needs of end HVAC equipment and TRA Total Room Automation applications. the Desigo PXC3 series of automation stations can be used in buildings where functionality and flexibility are more demanding. Use...

TOTOLINK N600R Command Injection Vulnerability (CNVD-2022-53559)

TOTOLINK N600R is a wireless router from Taiwan-based TOTOLINK Electronics. TOTOLINK N600R has a command injection vulnerability, which originates from the "Main" function containing command injection, and can be exploited to execute arbitrary commands via the QUERYSTRING parameter...

Cyclos 4 PRO Cross-Site Scripting Vulnerability

Cyclos 4 PRO is a web server. A cross-site scripting vulnerability exists in Cyclos 4 PRO version 4.14.7 and earlier, which can be exploited by remote attackers to inject arbitrary web scripts or HTML via the groupId parameter...

Xiaomi MIUI has an unspecified vulnerability (CNVD-2022-81249)

Xiaomi MIUI is an Android-based smartphone operating system developed by Xiaomi Technology China, Inc. A security vulnerability exists in Xiaomi MIUI due to a lack of checksum when using incoming parameters from a three-party application, which could be exploited by attackers to induce users to...

WordPress plugin RRatingg SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WordPress plugin is an application plugin. WordPress...

Amazon AWS VPN Client Information Disclosure Vulnerability

Amazon AWS VPN Client is a fully managed remote access VPN solution from Amazon.com. Amazon AWS VPN Client for Windows version 2.0.0 is vulnerable to an information disclosure vulnerability that could be exploited by an attacker to disclose a user's Net-NTLMv2 hash to an external server...

ThoughtWorks GoCD Cross-Site Scripting Vulnerability

ThoughtWorks GoCD is a free and open source CI/CD server from ThoughtWorks, Inc. A cross-site scripting vulnerability exists in versions of ThoughtWorks GoCD prior to 21.3.0, which can be exploited by an attacker controlling a GoCD agent to plant malicious JavaScript into a failed job report...

Microsoft Windows Cluster Shared Volume (CSV) 拒绝服务漏洞

Microsoft Windows Cluster Shared Volume is a feature of Microsoft Corporation USA. A denial of service vulnerability exists in Microsoft Windows Cluster Shared Volume CSV, which can be exploited by attackers to cause a denial of service condition...

Jenkins promoted builds Plugin input validation error vulnerability

Jenkins is a Jenkins open source application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.The Jenkins promoted builds Plugin is vulnerable to an input validation error that could be exploited by an attacker to...

Samsung SMR Heap Buffer Overflow Vulnerability

Samsung SMR is a system patch package from South Korea's Samsung Samsung. Samsung SMR contains a heap buffer overflow vulnerability that can be exploited by attackers to execute code...

HPE OneView Information Disclosure Vulnerability

HPE OneView is a software from Hewlett Packard Enterprise HPE that facilitates automated device management for IT departments. HPE OneView versions prior to 6.6 contain an information disclosure vulnerability that stems from a configuration or other error in the operation of the network system or...

ZoneMinder Cross-Site Scripting Vulnerability (CNVD-2022-57822)

ZoneMinder is an open source video surveillance software system. The system supports IP, USB and analog cameras, etc. A cross-site scripting vulnerability exists in ZoneMinder 1.32.3 and earlier versions, which stems from the events.php file displaying the 'limit' parameter value without arbitrar...

ClassApps SelectSurvey.NET SQL Injection Vulnerability

Net is a survey software from ClassApps, Inc. built using Microsoft's cutting-edge . A SQL injection vulnerability exists in the ID parameter of the UploadedImageDisplay.aspx endpoint, which can be exploited by an unauthenticated attacker to retrieve data from the application's back-end database...

WordPress Optimole plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WordPress plugin is a WordPress open source application plugin. WordPress plugin Optimole version 3.3.2 has a cross-site scripting vulnerability that stems from the failure of image optimization and...

BigAnt Software BigAnt Server Weak Password Vulnerability

BigAnt Software BigAnt Server is a server from BigAnt Studios Australia. BigAnt Software BigAnt Server v5.6.06 suffers from a security vulnerability, no details of the vulnerability are provided at this time...

GPAC gf_utf8_wcslen function denial of service vulnerability

GPAC is an open source multimedia framework. a denial of service vulnerability exists in GPAC version 1.0.1, which stems from a NULL pointer dereference in gfutf8wcslen . An attacker could exploit this vulnerability to cause a denial of service of the program...

Luocms arbitrary file writing vulnerability

Luocms v2.0 is an article management system. Luocms v2.0 is vulnerable to an arbitrary file-writing vulnerability that results from insufficient validation of filecontent submissions and filenamede filenames, which can be exploited to write arbitrary shell files via /admin/templates/templatemanag...

Gitea Authorization Error Vulnerability

Gitea is a project to set up a self-hosted Git service. Gitea suffers from an authorization error vulnerability that stems from PAM authentication when building and configuring Gitea, which skips checking authorization altogether and can be exploited by attackers to log into expired accounts and...