Esri ArcGIS Server Cross-Site Scripting Vulnerability (CNVD-2025-05063)

Esri ArcGIS Server is Esri's Web-oriented enterprise software platform for providing geolocation services. A cross-site scripting vulnerability exists in Esri ArcGIS Server versions 10.9.1 through 11.3, which can be exploited by an attacker to create a specially crafted link that, when clicked, m...

Esri ArcGIS Server Access Control Error Vulnerability

Esri ArcGIS Server is Esri's Web-oriented enterprise software platform for providing geolocation services. An Access Control Error vulnerability exists in Esri ArcGIS Server versions 10.9.1 through 11.3, which stems from improper access control and can be exploited by a remote, low-privilege...

TOTOLINK EX1800T Buffer Overflow Vulnerability

The TOTOLINK EX1800T is a Wi-Fi range extender from China's Gion Electronics TOTOLINK. The Totolink EX1800T suffers from a buffer overflow vulnerability that stems from the loginAuth function failing to properly validate the length and size of input data, which can be exploited by an attacker to...

Esri ArcGIS Server Cross-Site Scripting Vulnerability (CNVD-2025-05080)

Esri ArcGIS Server is Esri's Web-oriented enterprise software platform for providing geolocation services. A cross-site scripting vulnerability exists in Esri ArcGIS Server versions 10.9.1 through 11.3 that stems from the application's lack of effective filtering and escaping of user-supplied dat...

Esri ArcGIS Server File Inclusion Vulnerability

Esri ArcGIS Server is Esri's Web-oriented enterprise software platform for providing geolocation services. A file inclusion vulnerability exists in Esri ArcGIS Server versions 10.9.1 through 11.3, which can be exploited by a remote, unauthenticated attacker to read internal files due to a failure...

Esri ArcGIS Server Cross-Site Scripting Vulnerability (CNVD-2025-05075)

Esri ArcGIS Server is Esri's Web-oriented enterprise software platform for providing geolocation services. A cross-site scripting vulnerability exists in Esri ArcGIS Server versions 10.9.1 through 11.3, which can be exploited by an attacker to create a specially crafted link that, when clicked, m...

Adobe Experience Manager cross-site scripting vulnerability (CNVD-2025-06308)

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

Esri ArcGIS Server SQL Injection Vulnerability (CNVD-2025-05054)

Esri ArcGIS Server is Esri's Web-oriented enterprise software platform for providing geolocation services. Esri ArcGIS Server suffers from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements. An attacker could use this...

Esri ArcGIS Server Cross-Site Scripting Vulnerability (CNVD-2025-05059)

Esri ArcGIS Server is Esri's Web-oriented enterprise software platform for providing geolocation services. A cross-site scripting vulnerability exists in Esri ArcGIS Server versions 10.9.1 through 11.3, which can be exploited by an attacker to create a specially crafted link that, when clicked, m...

Tenda AC8 Buffer Overflow Vulnerability (CNVD-2025-09221)

Tenda AC8 is a wireless router from Tenda, a Chinese company. Tenda AC8 suffers from a buffer overflow vulnerability, which originates from the urls parameter of the getparentControllistInfo function, which contains a buffer overflow vulnerability that can be exploited by an attacker to cause a...

IBM Cloud Pak for Data Cross-Site Scripting Vulnerability

IBM Cloud Pak for Data is a cloud-native solution from International Business Machines IBM that allows customers to use data and analyze it quickly and efficiently. A cross-site scripting vulnerability exists in IBM Cloud Pak for Data versions 4.0.0 through 4.8.5 and 5.0.0, which stems from...

GPT Academic Backlink Vulnerability

GPT Academic is an interface that provides pragmatic interactions for LLM large language models such as GPT/GLM. GPT Academic suffers from a back-linking vulnerability that stems from not properly handling soft links, which can be exploited by an attacker to cause arbitrary file reads...

Esri ArcGIS Server Cross-Site Scripting Vulnerability (CNVD-2025-05078)

Esri ArcGIS Server is Esri's Web-oriented enterprise software platform for providing geolocation services. A cross-site scripting vulnerability exists in Esri ArcGIS Server versions 10.9.1 through 11.3, which can be exploited by an attacker to create a specially crafted link that, when clicked, m...

Esri ArcGIS Server Cross-Site Scripting Vulnerability (CNVD-2025-05071)

Esri ArcGIS Server is Esri's Web-oriented enterprise software platform for providing geolocation services. A cross-site scripting vulnerability exists in Esri ArcGIS Server versions 10.9.1 through 11.3, which can be exploited by an attacker to create a specially crafted link that, when clicked, m...

Esri ArcGIS Server Cross-Site Scripting Vulnerability (CNVD-2025-05062)

Esri ArcGIS Server is Esri's Web-oriented enterprise software platform for providing geolocation services. A cross-site scripting vulnerability exists in Esri ArcGIS Server versions 10.9.1 through 11.3, which can be exploited by an attacker to create a specially crafted link that, when clicked, m...

Esri ArcGIS Server Cross-Site Scripting Vulnerability (CNVD-2025-05060)

Esri ArcGIS Server is Esri's Web-oriented enterprise software platform for providing geolocation services. A cross-site scripting vulnerability exists in Esri ArcGIS Server versions 10.9.1 through 11.3, which can be exploited by an attacker to create a specially crafted link that, when clicked, m...

IBM Cognos Controller Weak Password Vulnerability

IBM Cognos Controller is a corporate performance management CPM software for financial consolidation, reporting and analysis. A weak password vulnerability exists in IBM Cognos Controller versions 11.0.0 through 11.1.0, which stems from the fact that the system does not require users to set stron...

Esri ArcGIS Server Path Traversal Vulnerability

Esri ArcGIS Server is Esri's Web-oriented enterprise software platform for providing geolocation services. A path traversal vulnerability exists in Esri ArcGIS Server versions 10.9.1 through 11.3, which stems from the program failing to properly filter for special elements in the path of a resour...

Esri ArcGIS Server Cross-Site Scripting Vulnerability (CNVD-2025-05061)

Esri ArcGIS Server is Esri's Web-oriented enterprise software platform for providing geolocation services. A cross-site scripting vulnerability exists in Esri ArcGIS Server versions 10.9.1 through 11.3, which can be exploited by an attacker to create a specially crafted link that, when clicked, m...

Tenda AC8 Buffer Overflow Vulnerability (CNVD-2025-09220)

Tenda AC8 is a wireless router from Tenda, a Chinese company. A buffer overflow vulnerability exists in the Tenda AC8, which can be exploited by an attacker to cause a program crash or even arbitrary code execution...

GNU GRUB2 Buffer Overflow Vulnerability

GNU GRUB2 is an open source bootloader used to load the operating system kernel when the computer boots. GNU GRUB2 suffers from a buffer overflow vulnerability that originates from an integer overflow when reading data from the squash4 file system. An attacker can exploit this vulnerability to...

News Portal login.php File SQL Injection Vulnerability

News Portal is a news portal. News Portal suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the login.php file. An attacker can exploit this vulnerability to execute illegal SQL commands to steal sensitive database data...

Weak Password Vulnerability in Kingh5stream of Beijing Asian Control Technology Development Co.

Beijing Asian Control Technology Development Co., Ltd. is a high-tech enterprise of industrial automation and informatization software platform, focusing on independent research and development, marketing and service of domestic industrial software. A weak password vulnerability exists in Beijing...

Unauthorized Access Vulnerability in Cultural AI Management System of Sichuan Cultural Big Data Co.

Sichuan Cultural Big Data Limited Liability Company is mainly engaged in big data services, data processing and storage support services, Internet data services, cloud computing equipment technology services, artificial intelligence basic resources and technology platforms, artificial intelligenc...

Linux kernel scsi: libfc memory misreference vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a memory misreference vulnerability that originates from a mix-up in the instructions responsible for freeing memory in scsi: libfc. An attacker could...

Linux kernel suffers from a memory leak vulnerability (CNVD-2025-05995)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a memory leak vulnerability that stems from apple-aic not handling node reference counting correctly during initialization, which can be exploited by ...

Cisco OpenH264 Competitive Conditions Vulnerability

Cisco OpenH264 is an open source H.264 codec from Cisco USA. Cisco OpenH264 suffers from a competitive condition vulnerability that can lead to a heap overflow and remote code execution. No details of the vulnerability are provided at this time...

Linux kernel pm runtime resume memory misreference vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a memory misreference vulnerability that originates from the use of freed memory during pm runtime resume. An attacker could exploit this vulnerabilit...

Linux kernel memory misreference vulnerability (CNVD-2025-04672)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a driver uninstallation without logging off the platform device, which can be exploited by an attacker to...

Linux kernel panfrost module memory misreference vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a memory misreference vulnerability that originates from the panfrost module's job structure referencing panfrostpriv to obtain the MMU environment,...

Linux kernel tcmu_try_get_data_page memory misreference vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a memory misreference vulnerability that stems from tcmutrygetdatapage not properly obtaining a reference count, which can be exploited by an attacker...

Linux kernel get_initial_state memory misreference vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a memory misreference vulnerability that stems from the use of a skb in getinitialstate after it has been released, which can be exploited by an...

Linux kernel vesafb driver memory misreference vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a memory misreference vulnerability that originates from a confusion in the instruction responsible for freeing memory in the vesafb driver. An attack...

Linux kernel macsec memory misreference vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a memory misreference vulnerability that stems from a macsec device not obtaining a reference to realdev, which can be exploited by an attacker to cau...

Logic Flaw Vulnerability in Dongsheng Booking Platform of Qingdao Dongsheng Weiye Software Co.

Qingdao Dongsheng Weiye Software Co., Ltd. is a company whose main business includes computer software development, network engineering design, web page design, integrated wiring, software technology services, installation and maintenance of electronic equipment and technical services, logistics...

Linux kernel sysfs trigger memory misreference vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a memory misreference vulnerability that stems from a confusion in the instructions responsible for freeing memory when the sysfs trigger is removed. ...

SQL Injection Vulnerability in NetDrive Unified Communication Platform of Beijing NetDrive Network Technology Co.

Ltd. is a leading global provider of cloud video solutions and services. A SQL injection vulnerability exists in the NetDrive Unified Communications Platform of Beijing NetDrive Network Technology Co., Ltd, which can be exploited by attackers to obtain sensitive information from the database...

SQL Injection Vulnerability in Founder Unlimited Media News Editorial System of Beijing Beifang Founder Electronics Co.

Beijing Beifang Founder Electronics Co., Ltd. is a leading technology and service provider in the fields of printing, media, publishing, and font libraries. A SQL injection vulnerability exists in Beijing Founder Electronics Co., Ltd.'s Founder Unlimited All-Media News Gathering and Editing Syste...

IBM EntireX Path Traversal Vulnerability

IBM EntireX is a cross-platform application integration middleware developed by IBM to support data communication and transaction processing between heterogeneous systems. A path traversal vulnerability exists in IBM EntireX, which can be exploited by an attacker to view arbitrary files on a syst...

emlog file upload vulnerability (CNVD-2025-04611)

emlog is a PHP and MySQL based CMS builder. A file upload vulnerability exists in emlog version v2.5.3, which stems from a lack of validation of uploaded files by the adminplugin.php component. An attacker can exploit this vulnerability to upload malicious files and remotely execute arbitrary cod...

IBM EntireX Denial of Service Vulnerability

IBM EntireX is a cross-platform middleware developed by IBM for high-performance data communication and transaction processing between heterogeneous systems. A denial of service vulnerability exists in IBM EntireX regular expressions, which is caused by a complexity flaw in the regular expression...

SQL Injection Vulnerability in KDDI Smart Cloud Platform of KDDI (Beijing) Co.

Ltd. is a company mainly engaged in technology development, technology promotion, technology transfer, technology consulting and technical services. Ltd. SQL injection vulnerability exists in KDDI Smart Cloud Platform, which can be exploited by attackers to obtain sensitive information from the...

Command Injection Vulnerability in Cisco Application Policy Infrastructure Controller CLI

Cisco Application Policy Infrastructure Controller is a software for Cisco ACI switching matrix automation and management from Cisco. A command injection vulnerability exists in the Cisco Application Policy Infrastructure Controller CLI, which can be exploited by an attacker to submit a special...

OneBlog Template Injection Vulnerability

OneBlog is a Java blog. OneBlog suffers from a template injection vulnerability, no details of the vulnerability are provided at this time...

Cisco Application Policy Infrastructure Controller Cross-Site Scripting Vulnerability

Cisco Application Policy Infrastructure Controller is a software for Cisco ACI switching matrix automation and management from Cisco. The Cisco Application Policy Infrastructure Controller suffers from a cross-site scripting vulnerability that can be exploited by an attacker to inject malicious...

Geovision GV-ASWeb Code Injection Vulnerability

Geovision GV-ASWeb is a Web-based software from Geovision China for remote access and configuration of GV-ASManager's database. A code injection vulnerability exists in Geovision GV-ASWeb, which can be exploited by an attacker to execute arbitrary commands on the system...

Ollama Unauthorized Access Vulnerability

Ollama is an open source Large Language Model LLM runtime environment and toolset designed to help developers easily deploy, manage, and use models e.g., DeepSeek, etc.. Ollama suffers from an unauthorized access vulnerability, which is due to the fact that Ollama is not set up with authenticatio...

FFmpeg Buffer Overflow Vulnerability

FFmpeg is a complete solution for recording, converting and streaming audio and video from the FFmpeg team. A buffer overflow vulnerability exists in FFmpeg version 7.1 and earlier versions, which originates from the ffaacsearchfortns function in the libavcodec/aacenctns.c file of the AAC Encoder...

Command Execution Vulnerability in Operation and Maintenance Management Audit System of Shanghai Shangxun Information Technology Co.

hereinafter referred to as "SinoCom-ArtM" is one of the leading providers of data, intelligent security operation and maintenance, mobile security, security services and other fields in China. A command execution vulnerability exists in the Operations and Maintenance Management and Audit System o...

Tale Blog Cross-Site Scripting Vulnerability

Tale Blog is a Java blog. A cross-site scripting vulnerability exists in Tale Blog version 2.0.5 and earlier versions, which stems from the lack of effective filtering and escaping of user-supplied data in the logourl parameter of the OptionsService function of...