YoudianCMS SQL Injection Vulnerability (CNVD-2022-59020)

YouDianCMS is a website CMS. A SQL injection vulnerability exists in YoudianCMS v9.5.0, which originates from the lack of validation of the MailSendID parameter at /App/Lib/Action/Admin/MailAction.class.php against external SQL input. This vulnerability can be exploited by attackers to execute...

WordPress Mobile browser color select plugin cross-site request forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

Online Ordering System SQL Injection Vulnerability (CNVD-2022-55718)

Online Ordering System is a multi-store ordering system that can be used by any small business. SQL statement validation, which can be exploited to execute illegal SQL commands to steal sensitive database data...

Mini-XML Denial of Service Vulnerability (CNVD-2022-68515)

Mini-XML is a small XML parser developed in C. A denial of service vulnerability exists in Mini-XML v3.2, which stems from the failure to validate input strings in mxmlLoadString and can be exploited by attackers to cause a denial of service...

Multi Store Inventory Management System授权问题漏洞

Multi Store Inventory Management System is a multi-store inventory management system. version 1.0 of Multi Store Inventory Management System is vulnerable to an authorization issue. An attacker can exploit this vulnerability to perform an account takeover via a specially crafted POST request...

NVIDIA vGPU Software Memory Misreference Vulnerability

NVIDIA vGPU Software is a management software from NVIDIA Corporation that provides GPU capabilities to virtual machines. The software supports multiple virtual machines accessing the host GPU, providing graphics performance and application compatibility for virtual machines. vGPU Software is...

InHand Networks InRouter302缓冲区溢出漏洞

InHand Networks InRouter Series is a series of routers from InHand Networks, U.S.A. A buffer overflow vulnerability exists in InHand Networks InRouter302 version V3.5.4, which stems from the httpd parsepingresult API function A boundary error occurs when handling untrusted input, which can be...

Foxit PDF Reader Doc Object Remote Code Execution Vulnerability (CNVD-2023-07905)

Foxit PDF Reader is a PDF reader from Foxit China.A remote code execution vulnerability exists in the Foxit PDF Reader Doc object, which can be exploited by attackers to execute code in the context of the current process...

Survey Sparrow Enterprise Survey Software Cross-Site Scripting Vulnerability

Survey Sparrow Enterprise Survey Software is an enterprise survey software from Survey Sparrow, Inc. A cross-site scripting vulnerability exists in Survey Sparrow Enterprise Survey Software version 2022, which stems from a lack of data validation filtering in the Signup parameter is missing a dat...

Microsoft Windows Digital Media Receiver Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in Microsoft Windows Digital Media Receiver, a desktop operating system from Microsoft Corporation. The vulnerability stems from improper handling of concurrent access when concurrent code needs mutually exclusive access to shared resources during th...

Siemens Simcenter Femap File Parsing Vulnerability (CNVD-2022-36399)

Siemens Simcenter Femap is an engineering simulation application from Siemens, Germany. It is used to create, edit and import/reuse mesh-based finite element analysis models of complex products or systems. Siemens Simcenter Femap is vulnerable to file parsing, which can be exploited by attackers ...

Unspecified vulnerability in Siemens SICAM P850 and SICAM P855 Devices (CNVD-2022-36397)

The SICAM P850 Multifunctional Measurement Device is used to collect, visualize, evaluate and transmit electrical measurement variables such as AC current, AC voltage, frequency, power, harmonics, etc. The SICAM P855 Multifunctional Device is used to collect, display and transmit measured...

PHProjekt MyProjects Cross-Site Scripting Vulnerability

PHProjekt MyProjects is a modular web application for project management written in PHP / MySql by PHProjekt. PHProjekt MyProjects version 1.3.0 contains a cross-site scripting vulnerability that can be exploited by attackers to execute JavaScript code on the client side...

WordPress Import WP plugin file upload vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Import WP plugin is vulnerable to a file upload vulnerability, which stems from the plugin'...

F5 BIG-IP Resource Management Error Vulnerability (CNVD-2022-74965)

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. F5 BIG-IP is vulnerable to resource management errors, which can be exploited by attackers to cause service degradation,...

WordPress AdRotate plugin cross-site scripting vulnerability (CNVD-2022-59803)

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plug-in. Cross-site scripting vulnerabilities exist in versions of WordPress AdRotate plugin prior to 5.8.23. The...

JetBrains IntelliJ IDEA has an unspecified vulnerability (CNVD-2022-55673)

JetBrains IntelliJ IDEA is a suite of integrated development environments for the Java language from Czech company Jetbrains. security vulnerability exists in versions of JetBrains IntelliJ IDEA prior to 2022.1, which stems from an insufficient notification mechanism for using Unicode...

Delta Electronics DIAEnergie SQL Injection Vulnerability (CNVD-2022-36030)

Delta Electronics DIAEnergie is an industrial energy management system for monitoring and analyzing energy consumption in real time, calculating energy consumption and load characteristics, optimizing equipment performance, improving production processes and maximizing energy efficiency. Delta...

Xiaomi MIUI has an unspecified vulnerability (CNVD-2022-81249)

Xiaomi MIUI is an Android-based smartphone operating system developed by Xiaomi Technology China, Inc. A security vulnerability exists in Xiaomi MIUI due to a lack of checksum when using incoming parameters from a three-party application, which could be exploited by attackers to induce users to...

WordPress plugin myCred information leakage vulnerability

WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blogging sites on servers with PHP and MySQL. an information disclosure vulnerability exists in versions of the WordPress plugin myCred prior to 2.4.3.1, which stems from the plugi...

FANUC ROBOGUIDE elevation of privilege vulnerability

FANUC ROBOGUIDE is a robot simulation software from FANUC, Japan. FANUC ROBOGUIDE v9.40083.00.05 and previous versions have an elevation of privilege vulnerability. The vulnerability stems from the fact that the affected product is vulnerable to misconfigured binaries, and an attacker with...

ZOHO ManageEngine OpManager SQL Injection Vulnerability (CNVD-2022-70603)

ZOHO ManageEngine OpManager is a comprehensive network monitoring software from ZOHO USA. A SQL injection vulnerability exists in versions prior to ZOHO ManageEngine OpManager 125588 and 125603, which stems from a problem in the inventory reporting module. An attacker could use this vulnerability...

WordPress plugin Fancy Product Designer cross-site request forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in the WordPress plugin Fancy Product Designer, which...

Hubzilla file inclusion vulnerability

Hubzilla is an open source platform for creating interconnected websites with a decentralized identity, communications and permissions framework built using common web server technology.Hubzilla version 7.2 previously contained a security vulnerability that could be exploited by remote attackers ...

Red Lion DA50N has an unspecified vulnerability (CNVD-2022-65326)

Red Lion DA50N is a series of secure edge network gateways from Red Lion, U.S.A. A security vulnerability exists in the Red Lion DA50N that could be exploited by an attacker to gain access to stored credentials and thereby gain access to protected resources...

Microsoft Windows Graphics Component Remote Code Execution Vulnerability (CNVD-2022-74593)

A remote code execution vulnerability exists in Microsoft Windows Graphics Components, which originates when a network system or product fails to properly filter external input data during the construction of code segments. elements during the construction of code segments from external input dat...

Microsoft Windows Fax Compose Form Remote Code Execution Vulnerability

Microsoft Windows Fax services is a feature component service of Microsoft Corporation USA used to specify fax settings, including how to send, receive, view and print. A remote code execution vulnerability exists in Microsoft Windows Fax Compose Form, which is used to specify fax settings,...

Multiple Adobe Products Information Disclosure Vulnerabilities (CNVD-2022-87161)

Adobe Acrobat is a set of PDF file editing and conversion tools. Adobe Reader is a set of PDF document reading software. Several Adobe products have information leakage vulnerabilities, remote attackers can use this vulnerability to obtain sensitive information...

AeroCMS Cross-Site Scripting Vulnerability

AeroCMS is a content management system from AeroCMS, Inc. A cross-site scripting vulnerability exists in AeroCMS v0.0.1, which can be exploited by attackers to execute arbitrary Web script or HTML by injecting a specially crafted payload into the post title text field...

HPE OneView Authentication Bypass Vulnerability

HPE OneView is a software from Hewlett Packard Enterprise HPE that facilitates automated device management for IT departments. versions prior to HPE OneView 6.6 contain an authentication bypass vulnerability that stems from insufficient program authentication strength and can be exploited by an...

Jenkins RocketChat Notifier Plugin Licensing Issue Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. Jenkins RocketChat Notifier Plugin 1.4.10 and earlier versions are vulnerable...

Wordpress Plugin All-in-one Floating Contact Form Cross-Site Scripting Vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. wordpress Plugin All-in-one Floating Contact Form...

Linux Kernel Buffer Overflow Vulnerability (CNVD-2022-79427)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. The Linux kernel suffers from a buffer overflow vulnerability that originates from not properly validating data boundaries when net/ipv4/esp4.c and net/ipv6/esp6.c perform...

Pascom Cloud Phone System Path Traversal Vulnerability

Pascom Cloud Phone System is a cloud phone system from Pascom. Used to provide integrated communication solutions for businesses and individuals, Pascom Cloud Phone System is vulnerable to a path traversal vulnerability that stems from a configuration error before nginx and the back-end server...

ARRIS TR3300 Command Injection Vulnerability (CNVD-2022-68528)

ARRIS TR3300 is an 802.11ac Wi-Fi router from ARRIS U.S.A. A command injection vulnerability exists in ARRIS TR3300, which stems from the pppoeusername, pppoepasswd, and pppoeservicename parameters in the pppoe function failing to properly filter the construct command special characters, commands...

IBM Spectrum Protect Plus和IBM Spectrum Copy Data Management拒绝服务漏洞

IBM Spectrum Protect Plus and IBM Spectrum Copy Data Management are both products of IBM Corporation, U.S.A. IBM Spectrum Protect Plus is a data protection platform. The platform provides enterprises with a single point of control and management and supports backup and recovery for virtual,...

GPAC Buffer Overflow Vulnerability (CNVD-2022-22316)

GPAC is an open source multimedia framework. GPAC 1.0.1 has a security vulnerability, and no details of the vulnerability are currently available...

WordPress Zero Spam plugin SQL injection vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WordPress Zero Spam plugin is a WordPress open source application plugin. SQL injection vulnerability exists in versions of WordPress Zero Spam plugin prior to 5.2.11. The vulnerability stems from t...

SAP Financial Consolidation Access Control Error Vulnerability

SAP Financial Consolidation is a financial statement solution from SAP Germany. The SAP Financial Consolidation access control error vulnerability, which stems from the program's failure to perform the authorization checks required to update home page messages, could be exploited to cause an...

Authentication Error Vulnerability in Various Schneider Electric Products

The Schneider Electric APC Smart-UPS SMC Series, among others, is a product of Schneider Electric, a French company. The Schneider Electric APC Smart-UPS SMT Series is a line interactive power protection for servers, point-of-sale, routers, switches, hubs and other network equipment. The Schneide...

Elasticsearch Kibana authorization issue vulnerability

Elasticsearch Kibana is an open source, browser-based analysis and search Elasticsearch dashboard tool from the Dutch company Elasticsearch.Elasticsearch Kibana is vulnerable to an authorization issue that could be exploited by an attacker to create new alert rules or override existing rules...

Liferay Portal Information Disclosure Vulnerability (CNVD-2022-19509)

Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB and JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay Portal has an information disclosure vulnerability that can be exploited by...

Apache JSPWiki Cross-Site Scripting Vulnerability (CNVD-2022-17019)

JSPWiki is an open source JSP-based Wiki system from Apache, based on the file system, with permissions management and search capabilities.Apache JSPWiki versions prior to 2.11.2 have a cross-site scripting vulnerability in the user preferences screen. An attacker could use this vulnerability to...

Linux kernel has unspecified vulnerabilities (CNVD-2022-17770)

Linux kernel is the kernel used by the Linux Foundation's open source operating system, Linux. Linux kernel is vulnerable to a security flaw that could be exploited by an attacker to inject data into a victim's TCP session or terminate that session...

TOTOLink T6 Command Injection Vulnerability (CNVD-2022-17105)

TOTOLink T6 is a wireless dual-band router from TotoLink, China.TOTOLink T6 V5.9c.4085B20190428 is vulnerable to command injection, which can be exploited by attackers to execute arbitrary commands via the QUERYSTRING parameter...

D-Link Dir-823-Pro Command Injection Vulnerability (CNVD-2022-15175)

D-Link Dir-823-Pro is a dual-band smart wireless router from China Youxun D-Link. D-Link DIR-823-Pro v1.0.2 is vulnerable to command injection, which can be exploited by attackers to execute arbitrary commands via the sambaname parameter...

Unspecified vulnerability in livehelperchat (CNVD-2022-13348)

livehelperchat is available through live helper chat and can be used to provide live support on the website for free. A security vulnerability exists in versions prior to livehelperchat 3.92v that stems from a user control key authorization bypass. No details of the vulnerability are provided at...

Cisco Email Security Appliance Resource Management Error Vulnerability (CNVD-2022-13368)

The Cisco Email Security Appliance ESA is an email security appliance from Cisco, U.S.A. A resource management error vulnerability exists in the Cisco Email Security Appliance DNS Verification, which could be exploited by an attacker to cause the appliance to be inaccessible from the management...

Atlassian Jira Service Management Server Licensing Issue Vulnerability

Atlassian Jira Service is a server-based version of Atlassian Australia's IT service desk and request tracking system, which is used to receive, track and manage requests from team clients. An authorization issue vulnerability exists in Atlassian Jira Service Management Server, which stems from...

Atlassian Jira Server ViewInstrumentation.jspa Cross-site Request Forgery Vulnerability

Atlassian Jira Service is the server version of an IT service desk and request tracking system from Atlassian Australia. The Atlassian Jira Server is vulnerable to cross-site request forgery, which stems from an application/secure/admin/ViewInstrumentation.jspa endpoint that does not adequately...