vendor: Siemens

status: affected

version: All versions < V13.2.0.7

product: Solid Edge SE2021

version: All versions < SE2021MP9

product: Solid Edge SE2022

version: All versions < SE2022MP1

product: Teamcenter Visualization V13.1

version: All versions < V13.1.0.9

product: Teamcenter Visualization V13.2

product: Teamcenter Visualization V13.3

version: All versions < V13.3.0.1

ecosystem: software/application

metric_type: Primary

severity: high

severity: medium

part: a

vendor: siemens

quality: metadata-backed

recipe_kind: composed

status: Modified

summary: A vulnerability has been identified in JT2Go (All versions < V13.2.0.7), Solid Edge SE2021 (All versions < SE2021MP9), Solid Edge SE2022 (All versions < SE2022MP1), Teamcenter Visualization V13.1 (All versions < V13.1.0.9), Teamcenter Visualization V13.2 (All versions < V13.2.0.7), Teamcenter Visualization V13.3 (All versions < V13.3.0.1). The plmxmlAdapterSE70.dll contains an out of bounds write past the fixed-length heap-based buffer while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15053)

title: Siemens Jt2Go security vulnerability


version: All versions < V13.2.0.5

product: Teamcenter Visualization

summary: A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The DL180pdfl.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14974)


default_status: unknown

product: JT Open

version: All versions < V11.1.1.0

product: JT Utilities

version: All versions < V13.1.1.0

product: Solid Edge

version: All versions < V2023

metric_type: Secondary

summary: A vulnerability has been identified in JT Open (All versions < V11.1.1.0), JT Utilities (All versions < V13.1.1.0), Solid Edge (All versions < V2023). The Jt1001.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15058, ZDI-CAN-19076, ZDI-CAN-19077)

title: Siemens Jt Open Toolkit security vulnerability


summary: A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable to use of uninitialized memory while parsing user supplied TIFF files. This could allow an attacker to cause a denial-of-service condition.


summary: A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.


summary: A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted TIFF files. This could allow an attacker to execute code in the context of the current process.


title: A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5)


archetype: generic

summary: A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll contains an off-by-one error in the heap while parsing specially crafted TIFF files. This could allow an attacker to cause a denial-of-service condition.


summary: A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Jt1001.dll is vulnerable to an out of bounds read past the end of an allocated buffer while parsing specially crafted JT files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-15101)


summary: A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Jt1001.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing specially crafted JT files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-15102)


summary: A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The DL180pdfl.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15103)


summary: A vulnerability has been identified in JT Open (All versions < V11.1.1.0), JT Utilities (All versions < V13.1.1.0), Solid Edge (All versions < V2023). The Jt1001.dll contains a use-after-free vulnerability that could be triggered while parsing specially crafted JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-15057, ZDI-CAN-19081)


summary: A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The VCRUNTIME140.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing specially crafted CGM files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-15109)


summary: A vulnerability has been identified in JT2Go (All versions < V13.2.0.7), Solid Edge SE2021 (All versions < SE2021MP9), Solid Edge SE2022 (All versions < SE2022MP1), Teamcenter Visualization V13.1 (All versions < V13.1.0.9), Teamcenter Visualization V13.2 (All versions < V13.2.0.7), Teamcenter Visualization V13.3 (All versions < V13.3.0.1). The plmxmlAdapterSE70.dll library is vulnerable to memory corruption condition while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-15110)

title: Siemens Jt2Go security vulnerability


summary: A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Image.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing specially crafted TIF files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-15111)


summary: A vulnerability has been identified in JT2Go (All versions < V13.2.0.7), Solid Edge SE2021 (All versions < SE2021MP9), Solid Edge SE2022 (All versions < SE2022MP1), Teamcenter Visualization V13.1 (All versions < V13.1.0.9), Teamcenter Visualization V13.2 (All versions < V13.2.0.7), Teamcenter Visualization V13.3 (All versions < V13.3.0.1). The plmxmlAdapterSE70.dll library is vulnerable to memory corruption condition while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-15112)

title: Siemens Jt2Go security vulnerability


vendor: Trend Micro

vendor: trendmicro

summary: An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to but not identical to CVE-2021-44020 and 44021.

title: Trendmicro Worry-Free Business Security security vulnerability


summary: An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to but not identical to CVE-2021-44019 and 44021.


summary: An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to but not identical to CVE-2021-44019 and 44020.


product: Trend Micro Apex One

severity: low

summary: A reachable assertion vulnerability in Trend Micro Apex One could allow an attacker to crash the program on affected installations, leading to a denial-of-service (DoS). Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

title: Trendmicro Apex One security vulnerability


product: Trend Micro Security (Consumer)

summary: A link following denial-of-service (DoS) vulnerability in the Trend Micro Security (Consumer) 2021 familiy of products could allow an attacker to abuse the PC Health Checkup feature of the product to create symlinks that would allow modification of files which could lead to a denial-of-service.

title: Trendmicro Antivirus+ Security 2021 security vulnerability


version: 10.0 SP1, Services (SaaS)

summary: A link following denial-of-service vulnerability in Trend Micro Apex One (on-prem and SaaS) and Trend Micro Worry-Free Business Security (10.0 SP1 and Services) could allow a local attacker to overwrite arbitrary files in the context of SYSTEM. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.


product: webmail

vendor: roundcube

part: o

product: fedora

vendor: fedoraproject

vendor: debian

summary: Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when displaying a MIME type warning message.

title: Roundcube Webmail security vulnerability


business_risk: Critical, network-reachable SQL injection in Roundcube with a CVSS 3.1 score of 9.8; the CVE is listed in CISA's Known Exploited Vulnerabilities Catalog, so exposed instances should be prioritized for remediation. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2021-44026?utm_source=openai))

claim: CVE-2021-44026 affects Roundcube Webmail.

claim: Roundcube versions before 1.3.17 and 1.4.x versions before 1.4.12 are affected.

claim: The vulnerability is a potential SQL injection via search or search_params; the CVSS vector records a network attack path requiring no privileges.

kind: exposure

claim: The upstream security releases 1.3.17 and 1.4.12 contain the relevant security fixes, and Roundcube states the fixes are included in 1.5.0.

claim: Roundcube recommends updating productive installations to the security releases; Debian also documents distribution-specific fixed package versions.

kind: remediation

claim: A safe version-based verification is to confirm the deployed upstream or distribution package is at or beyond the applicable documented fixed version.

kind: verification

exposure_conditions: Roundcube Webmail is deployed and processes requests involving the search or search_params functionality. ([security-tracker.debian.org](https://security-tracker.debian.org/tracker/CVE-2021-44026))

exposure_conditions: The deployed version is before 1.3.17, or is in the 1.4.x branch before 1.4.12. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2021-44026?utm_source=openai))

exposure_conditions: Network-accessible deployments warrant priority because the recorded attack vector is network-based and requires no privileges. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2021-44026?utm_source=openai))

remediation_steps: Upgrade Roundcube 1.3 installations to 1.3.17 or later, or upgrade Roundcube 1.4 installations to 1.4.12 or later. ([roundcube.net](https://roundcube.net/news/2021/11/12/security-updates-1.4.12-and-1.3.17-released))

remediation_steps: Roundcube states that the relevant security fixes are also included in version 1.5.0; use the vendor-supported upgrade path for newer branches. ([roundcube.net](https://roundcube.net/news/2021/11/12/security-updates-1.4.12-and-1.3.17-released))

remediation_steps: For distribution packages, apply the operating system vendor's fixed package rather than relying only on the upstream application version. Debian records fixed packages including 1.3.17+dfsg.1-1~deb10u1 for buster and 1.4.12+dfsg.1-1~deb11u1 for bullseye. ([security-tracker.debian.org](https://security-tracker.debian.org/tracker/CVE-2021-44026))

remediation_steps: Prioritize internet-facing or otherwise externally reachable Roundcube installations because the CVE is cataloged as known exploited. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2021-44026?utm_source=openai))

status: complete

uncertainty: The evidence establishes upstream Roundcube fixed versions and several Debian package fixes, but it does not establish fixed package versions for every operating system listed in the supplied record, including Fedora.

uncertainty: The sources identify the vulnerable functionality as search or search_params but do not provide a universally safe, non-invasive runtime test for confirming exploitability.

uncertainty: Current upstream releases may be newer than the minimum fixed versions; this enrichment uses the concrete versions documented for this CVE rather than asserting a current release recommendation.

verification_steps: Confirm the deployed upstream Roundcube version is not before 1.3.17 and is not an affected 1.4.x version before 1.4.12. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2021-44026?utm_source=openai))

verification_steps: For packaged deployments, confirm the installed package meets the applicable distribution-specific fixed version recorded by the vendor or distribution security advisory. ([security-tracker.debian.org](https://security-tracker.debian.org/tracker/CVE-2021-44026))

verification_steps: After the upgrade, confirm the application reports the expected patched version and that normal search functionality remains available; do not conduct SQL-injection testing against production systems.

known_ransomware_campaign_use: Unknown

product: Roundcube Webmail

required_action: Apply updates per vendor instructions.

vendor_project: Roundcube

vulnerability_name: Roundcube Webmail SQL Injection Vulnerability

severity: critical

status: Analyzed

summary: Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.


archetype: xxe

vendor: quest

summary: XXE can occur in Quest KACE Desktop Authority before 11.2 because the log4net configuration file might be controlled by an attacker, a related issue to CVE-2018-1285.

title: Quest Kace Desktop Authority security vulnerability


summary: An issue was discovered in Quest KACE Desktop Authority before 11.2. This vulnerability allows attackers to execute remote code through a deserialization exploitation in the RadAsyncUpload function of ASP.NET AJAX. An attacker can leverage this vulnerability when the encryption keys are known (due to the presence of CVE-2017-11317, CVE-2017-11357, or other means). A default setting for the type whitelisting feature in more current versions of ASP.NET AJAX prevents exploitation.


summary: Quest KACE Desktop Authority before 11.2 allows XSS because it does not prevent untrusted HTML from reaching the jQuery.htmlPrefilter method of jQuery.


summary: An issue was discovered in Quest KACE Desktop Authority before 11.2. /dacomponentui/profiles/profileitems/outlooksettings/Insertimage.aspx contains a vulnerability that could allow pre-authentication remote code execution. An attacker could upload a .ASP file to reside at /images/{GUID}/{filename}.


ecosystem: javascript/npm

vendor: tp-link

summary: TP-Link Omada SDN Software Controller before 5.0.15 does not check if the authentication method specified in a connection request is allowed. An attacker can bypass the captive portal authentication process by using the downgraded "no authentication" method, and access the protected network. For example, the attacker can simply set window.authType=0 in client-side JavaScript.

title: Tp-Link Omada Software Controller security vulnerability


vendor: ionic

summary: In Ionic Identity Vault before 5.0.5, the protection mechanism for invalid unlock attempts can be bypassed.


vendor: wolterskluwer

summary: Wolters Kluwer TeamMate AM 12.4 Update 1 mishandles attachment uploads, such that an authenticated user may download and execute malicious files.

title: Wolterskluwer Teammate Audit Management security vulnerability


vendor: teampasswordmanager

summary: Team Password Manager (aka TeamPasswordManager) before 10.135.236 has a CSRF vulnerability during import.


summary: Team Password Manager (aka TeamPasswordManager) before 10.135.236 allows password-reset poisoning.


product: quagga

vendor: quagga

summary: An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update.


product: Apache Traffic Server

vendor: Apache Software Foundation

vendor: apache

summary: Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.3 and 9.0.0 to 9.1.1.


archetype: ssrf

product: assistant

vendor: uipath

summary: UiPath Assistant 21.4.4 will load and execute attacker controlled data from the file path supplied to the --dev-widget argument of the URI handler for uipath-assistant://. This allows an attacker to execute code on a victim's machine or capture NTLM credentials by supplying a networked or WebDAV file path.

title: Uipath Assistant security vulnerability


summary: An issue was discovered in UiPath Assistant 21.4.4. User-controlled data supplied to the --process-start argument of the URI handler for uipath-assistant:// is not correctly encoded, resulting in attacker-controlled content being injected into the error message displayed (when the injected content does not match an existing process). A determined attacker could leverage this to execute JavaScript in the context of the Electron application.


summary: An issue was discovered in UiPath App Studio 21.4.4. There is a persistent XSS vulnerability in the file-upload functionality for uploading icons when attempting to create new Apps. An attacker with minimal privileges in the application can build their own App and upload a malicious file containing an XSS payload, by uploading an arbitrary file and modifying the MIME type in a subsequent HTTP request. This then allows the file to be stored and retrieved from the server by other users in the same organization.


vendor: opendesign

summary: An out-of-bounds write vulnerability exists when reading a JPG file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists with parsing JPG files. Crafted data in a JPG (4 extraneous bytes before the marker 0xca) can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.


summary: An out-of-bounds write vulnerability exists when reading a DGN file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DGN files. Crafted data in a DGN file and lack of proper validation for the XFAT sectors count can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.


summary: An out-of-bounds write vulnerability exists when reading U3D files in Open Design Alliance PRC SDK before 2022.11. An unchecked return value of a function (verifying input data from a U3D file) leads to an out-of-bounds write. An attacker can leverage this vulnerability to execute code in the context of the current process.


summary: A use-after-free vulnerability exists when reading a DWF/DWFX file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists with parsing DWF/DWFX files. Crafted data in a DWF/DWFX file and lack of proper validation of input data can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.


summary: An out-of-bounds write vulnerability exists when reading a TIF file using Open Design Alliance (ODA) Drawings Explorer before 2022.11. The specific issue exists after loading TIF files. Crafted data in a TIF file can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.


vendor: cyberark

summary: CyberArk Endpoint Privilege Manager (EPM) through 11.5.3.328 before 2021-12-20 allows a local user to gain elevated privileges via a Trojan horse Procmon64.exe in the user's Temp directory.

title: Cyberark Endpoint Privilege Manager security vulnerability


product: CA Network Flow Analysis (NFA)

vendor: broadcom

summary: CA Network Flow Analysis (NFA) 21.2.1 and earlier contain a SQL injection vulnerability in the NFA web application, due to insufficient input validation, that could potentially allow an authenticated user to access sensitive data.

title: Broadcom Ca Network Flow Analysis security vulnerability


product: QuTScloud

vendor: QNAP Systems Inc.

version: unspecified

version_type: custom

product: QuTS hero

product: QTS

product: qts

vendor: qnap

summary: A command injection vulnerability has been reported to affect QNAP NAS running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero and QTS: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1986 build 20220324 and later QTS 5.0.0.1986 build 20220324 and later


summary: An improper link resolution before file access ('Link Following') vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, and QTS. If exploited, this vulnerability allows remote attackers to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero, and QTS: QuTScloud c5.0.1.1998 and later QuTS hero h4.5.4.1971 build 20220310 and later QuTS hero h5.0.0.1986 build 20220324 and later QTS 4.3.4.1976 build 20220303 and later QTS 4.3.3.1945 build 20220303 and later QTS 4.2.6 build 20220304 and later QTS 4.3.6.1965 build 20220302 and later QTS 5.0.0.1986 build 20220324 and later QTS 4.5.4.1991 build 20220329 and later

title: Qnap Qts security vulnerability


summary: A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QTS, QuTS hero and QuTScloud. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QTS, QuTS hero and QuTScloud: QTS 4.5.4.1991 build 20220329 and later QTS 5.0.0.1986 build 20220324 and later QuTS hero h5.0.0.1986 build 20220324 and later QuTS hero h4.5.4.1971 build 20220310 and later QuTScloud c5.0.1.1949 and later


summary: An open redirect vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows attackers to redirect users to an untrusted page that contains malware. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero and QTS: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1949 build 20220215 and later QuTS hero h4.5.4.1951 build 20220218 and later QTS 5.0.0.1986 build 20220324 and later QTS 4.5.4.1991 build 20220329 and later


product: Video Station

summary: An missing authorization vulnerability has been reported to affect QNAP device running Video Station. If exploited, this vulnerability allows remote attackers to access data or perform actions that they should not be allowed to perform. We have already fixed this vulnerability in the following versions of Video Station: Video Station 5.5.9 ( 2022/02/16 ) and later


summary: An improper authentication vulnerability has been reported to affect QNAP device running Video Station. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions of Video Station: Video Station 5.5.9 and later Video Station 5.3.13 and later Video Station 5.1.8 and later


product: Photo Station

summary: An improper authentication vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station 6.0.20 ( 2022/02/15 ) and later Photo Station 5.7.16 ( 2022/02/11 ) and later Photo Station 5.4.13 ( 2022/02/11 ) and later


product: crushftp

vendor: crushftp

summary: An issue was discovered in CrushFTP 9. The creation of a new user through the /WebInterface/UserManager/ interface allows an attacker, with access to the administration panel, to perform Stored Cross-Site Scripting (XSS). The payload can be executed in multiple scenarios, for example when the user's page appears in the Most Visited section of the page.

title: An issue was discovered in CrushFTP 9


business_risk: No additional source-verified CVE-specific business impact was established.

uncertainty: The supplied product list is truncated, so it does not establish the complete set of affected build identifiers.

uncertainty: The vendor advisories provide fixed-version thresholds for the three named products but do not establish a current supported release for every deployment branch.

uncertainty: A version check confirms the installed build but does not by itself determine whether an instance was previously compromised.

uncertainty: The advisories describe observed exploitation but do not provide instance-specific evidence of compromise.

uncertainty: The model did not return a fully sourced exposure, remediation, and verification set; consult the linked NVD and vendor sources before acting.

product: ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus

vendor_project: Zoho

vulnerability_name: Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability

vendor: zohocorp

summary: Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.


vendor: unicorn-engine

summary: An issue was discovered in split_region in uc.c in Unicorn Engine before 2.0.0-rc5. It allows local attackers to escape the sandbox. An attacker must first obtain the ability to execute crafted code in the target sandbox in order to exploit this vulnerability. The specific flaw exists within the virtual memory manager. The issue results from the faulty comparison of GVA and GPA while calling uc_mem_map_ptr to free part of a claimed memory block. An attacker can leverage this vulnerability to escape the sandbox and execute arbitrary code on the host machine.


product: wazuh

vendor: wazuh

summary: In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl command line, potentially resulting in remote code execution.

title: Wazuh security vulnerability


ecosystem: operating-system

vendor: sercomm

summary: A Command Injection vulnerability in httpd web server (setup.cgi) in SerComm h500s, FW: lowi-h500s-v3.4.22 allows logged in administrators to arbitrary OS commands as root in the device via the connection_type parameter of the statussupport_diagnostic_tracing.json endpoint.

title: Sercomm H500S Firmware security vulnerability


summary: A buffer overflow vulnerability exists in the AMF of open5gs 2.1.4. When the length of MSIN in Supi exceeds 24 characters, it leads to AMF denial of service.


product: textpattern

vendor: textpattern

summary: textpattern 4.8.7 is vulnerable to Cross Site Scripting (XSS) via /textpattern/index.php,Body. A remote and unauthenticated attacker can use XSS to trigger remote code execution by uploading a webshell. To do so they must first steal the CSRF token before submitting a file upload request.


summary: A Remote Code Execution (RCE) vulnerability exists in Sourcecodester Attendance and Payroll System v1.0 which allows an unauthenticated remote attacker to upload a maliciously crafted PHP via photo upload.

title: Attendance And Payroll System Project Attendance And Payroll System security vulnerability


summary: An SQL Injection vulnerability exists in Sourcecodester Attendance and Payroll System v1.0 which allows a remote attacker to bypass authentication via unsanitized login parameters.


summary: An SQL Injection vulnerability exists in Sourcecodester Online Reviewer System 1.0 via the password parameter.


summary: A Cross-Site Scripting (XSS) vulnerability exists in Courcecodester Multi Restaurant Table Reservation System 1.0 in register.php via the (1) fullname, (2) phone, and (3) address parameters.

title: Multi Restaurant Table Reservation System Project Multi Restaurant Tabl… security vulnerability


vendor: code-projects

summary: An SQL Injection vulnerability exists in code-projects Pharmacy Management 1.0 via the username parameter in the administer login form.


product: zrlog

vendor: zrlog

summary: A Remote Command Execution vulnerability on the background in zrlog 2.2.2, at the upload avatar function, could bypass the original limit, upload the JSP file to get a WebShell

title: Zrlog security vulnerability


summary: ZrLog 2.2.2 has a remote command execution vulnerability at plugin download function, it could execute any JAR file


summary: A SQL injection vulnerability exists in ProjectWorlds Hospital Management System in php 1.0 on login page that allows a remote attacker to compromise Application SQL database.

title: Hospital Management System Project Hospital Management System security vulnerability


vendor: egavilanmedia

summary: EGavilan Media User-Registration-and-Login-System-With-Admin-Panel 1.0 is vulnerable to SQL Injection via profile_action - update_user. This allows a remote attacker to compromise Application SQL database.


summary: EGavilan Media Contact-Form-With-Messages-Entry-Management 1.0 is vulnerable to SQL Injection via Addmessage.php. This allows a remote attacker to compromise Application SQL database.


summary: EGavilan Media Expense-Management-System 1.0 is vulnerable to SQL Injection via /expense_action.php. This allows a remote attacker to compromise Application SQL database.


summary: A null pointer dereference in src/amf/namf-handler.c in Open5GS 2.3.6 and earlier allows remote attackers to Denial of Service via a crafted sbi request to amf.

title: Open5Gs security vulnerability


summary: A buffer overflow in lib/sbi/message.c in Open5GS 2.3.6 and earlier allows remote attackers to Denial of Service via a crafted sbi request.


product: s-cart

vendor: s-cart

summary: A Directory Traversal vulnerability exists in S-Cart 6.7 via download in sc-admin/backup.


summary: Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Stock Management System in PHP/OOP 1.0, which allows remote malicious users to execute arbitrary remote code execution via create user function.

title: Stock Management System Project Stock Management System security vulnerability


vendor: anchorcms

summary: Cross Site Scripting (XSS) vulnerability exits in Anchor CMS <=0.12.7 in posts.php. Attackers can use the posts column to upload the title and content containing malicious code to achieve the purpose of obtaining the administrator cookie, thereby achieving other malicious operations.


vendor: thedaylightstudio

summary: A Cross Site Request Forgery (CSRF) vulnerability exists in TheDayLightStudio Fuel CMS 1.5.0 via a POST call to /fuel/sitevariables/delete/4.

title: Thedaylightstudio Fuel Cms security vulnerability


product: spip

vendor: spip

summary: SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability. To exploit the vulnerability, a visitor must browse to a malicious SVG file. The vulnerability allows an authenticated attacker to inject malicious code running on the client side into web pages visited by other users (stored XSS).


summary: SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vulnerable fields. An editor is able to modify his personal information. If the editor has an article written and available, when a user goes to the public site and wants to read the author's information, the malicious code will be executed. The "Who are you" and "Website Name" fields are vulnerable.

title: Spip security vulnerability


summary: SPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF) vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrire/balise/formulaire_.php. To exploit the vulnerability, a visitor must visit a malicious website which redirects to the SPIP website. It is also possible to combine XSS vulnerabilities in SPIP 4.0.0 to exploit it. The vulnerability allows an authenticated attacker to execute malicious code without the knowledge of the user on the website (CSRF).

title: Spip security vulnerability


summary: SPIP 4.0.0 is affected by a remote command execution vulnerability. To exploit the vulnerability, an attacker must craft a malicious picture with a double extension, upload it and then click on it to execute it.


vendor: hiby

summary: Hiby Music Hiby OS R3 Pro 1.5 and 1.6 is vulnerable to Directory Traversal. The HTTP Server does not have enough input data sanitization when shown data from SD Card, an attacker can navigate through the device's File System over HTTP.


vendor: dlink

summary: In DLink DAP-1360 F1 firmware version <=v6.10 in the "webupg" binary, an attacker can use the "file" parameter to execute arbitrary system commands when the parameter is "name=deleteFile" after being authorized.

title: Dlink Dap-1360F1 Firmware security vulnerability


summary: A command injection vulnerability in the function formImportOMCIShell of C-DATA ONU4FERW V2.1.13_X139 allows attackers to execute arbitrary commands via a crafted file.

title: C-Data Onu4Ferw Project C-Data Onu4Ferw Firmware security vulnerability


product: pagekit

vendor: pagekit

summary: pagekit all versions, as of 15-10-2021, is vulnerable to SQL Injection via Comment listing.


product: resin

vendor: caucho

summary: There is a Directory traversal vulnerability in Caucho Resin, as distributed in Resin 4.0.52 - 4.0.56, which allows remote attackers to read files in arbitrary directories via a ; in a pathname within an HTTP request.

title: Caucho Resin security vulnerability


product: sentinel

vendor: hashicorp

summary: Sentinel 1.8.2 is vulnerable to Server-side request forgery (SSRF).


product: Apache JSPWiki

vendor: Apache Software Foundation

version: Apache JSPWiki

product: jspwiki

vendor: apache

summary: Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later.

title: Apache Jspwiki security vulnerability


product: Samba

version: All versions of Samba prior to 4.15.5

product: samba

vendor: samba

product: storage

vendor: redhat

product: fedora

vendor: fedoraproject

summary: All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed.

title: Samba security vulnerability


vendor: Samba

vendor: debian

vendor: canonical

vendor: synology

summary: The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver." Samba versions prior to 4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via specially crafted extended file attributes. A remote attacker with write access to extended file attributes can execute arbitrary code with the privileges of smbd, typically root.

title: Samba security vulnerability


product: isync

summary: A flaw was found in mbsync in isync 1.4.0 through 1.4.3. Due to an unchecked condition, a malicious or compromised IMAP server could use a crafted mail message that lacks headers (i.e., one that starts with an empty line) to provoke a heap overflow, which could conceivably be exploited for remote code execution.


product: asterix

vendor: crocontrol

summary: Croatia Control Asterix 2.8.1 has a heap-based buffer over-read, with additional details to be disclosed at a later date.


product: Apache NiFi

version: Apache NiFi

product: nifi

summary: In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.

title: Apache Nifi security vulnerability


vendor: claris

summary: An XML External Entity issue in Claris FileMaker Pro and Server (including WebDirect) before 19.4.1 allows a remote attacker to disclose local files via a crafted XML/Excel document and perform server-side request forgery attacks.

title: Claris Filemaker Pro security vulnerability


vendor: gl-inet

summary: GL.iNet GL-AR150 2.x before 3.x devices, configured as repeaters, allow cgi-bin/router_cgi?action=scanwifi XSS when an attacker creates an SSID with an XSS payload as the name.

title: Gl-Inet Gl-Ar150 Firmware security vulnerability


product: op-tee

vendor: trustedfirmware

summary: An issue was discovered in Trusted Firmware OP-TEE Trusted OS through 3.15.0. The OPTEE-OS CSU driver for NXP i.MX6UL SoC devices lacks security access configuration for wakeup-related registers, resulting in TrustZone bypass because the NonSecure World can perform arbitrary memory read/write operations on Secure World memory. This involves a v cycle.


product: tusdotnet

vendor: transloadit

summary: The client in tusdotnet through 2.5.0 relies on SHA-1 to prevent spoofing of file content.


ecosystem: windows/system

vendor: reprisesoftware

summary: An issue was discovered in Reprise RLM 14.2. As the session cookies are small, an attacker can hijack any existing sessions by bruteforcing the 4 hex-character session cookie on the Windows version (the Linux version appears to have 8 characters). An attacker can obtain the static part of the cookie (cookie name) by first making a request to any page on the application (e.g., /goforms/menu) and saving the name of the cookie sent with the response. The attacker can then use the name of the cookie and try to request that same page, setting a random value for the cookie. If any user has an active session, the page should return with the authorized content, when a valid cookie value is hit.


summary: An issue was discovered in Reprise RLM 14.2. Because /goform/change_password_process does not verify authentication or authorization, an unauthenticated user can change the password of any existing user. This allows an attacker to change the password of any known user, thereby preventing valid users from accessing the system and granting the attacker full access to that user's account.


summary: An issue was discovered in Reprise RLM 14.2. When editing the license file, it is possible for an admin user to enable an option to run arbitrary executables, as demonstrated by an ISV demo "C:\Windows\System32\calc.exe" entry. An attacker can exploit this to run a malicious binary on startup, or when triggering the Reread/Restart Servers function on the webserver. (Exploitation does not require CVE-2018-15573, because the license file is meant to be changed in the application.)


summary: An issue was discovered in Reprise RLM 14.2. By using an admin account, an attacker can write a payload to /goform/edit_opt, which will then be triggered when running the diagnostics (via /goform/diagnostics_doit), resulting in a buffer overflow.


summary: An issue was discovered in /goform/login_process in Reprise RLM 14.2. When an attacker attempts to login, the response if a username is valid includes Login Failed, but does not include this string if the username is invalid. This allows an attacker to enumerate valid users.


vendor: ASUS

vendor: asus

summary: ASUS RT-AX56U Wi-Fi Router is vulnerable to stack-based buffer overflow due to improper validation for httpd parameter length. An authenticated local area network attacker can launch arbitrary code execution to control the system or disrupt service.


product: GCB Doctor

summary: 4MOSAn GCB Doctor’s file upload function has improper user privilege control. A remote attacker can upload arbitrary files including webshell files without authentication and execute arbitrary code in order to perform arbitrary system operations or deny of service attack.


vendor: cth

summary: Carinal Tien Hospital Health Report System’s login page has improper authentication, a remote attacker can acquire another general user’s privilege by modifying the cookie parameter without authentication. The attacker can then perform limited operations on the system or modify data, making the service partially unavailable to the user.

title: Cth Carinal Tien Hospital Health Report System security vulnerability


product: MOTP(Mobile One Time Password)

vendor: Changing

less_than: unspecified

version: next of 3.5

product: motp

vendor: changingtec

summary: Changing MOTP (Mobile One Time Password) system’s specific function parameter has insufficient validation for user input. A attacker in local area network can perform SQL injection attack to read, modify or delete backend database without authentication.


vendor: chinasea

summary: Chain Sea ai chatbot system’s specific file download function has path traversal vulnerability. The function has improper filtering of special characters in URL parameters, which allows a remote attacker to download arbitrary system files without authentication.


summary: Chain Sea ai chatbot backend has improper filtering of special characters in URL parameters, which allows a remote attacker to perform JavaScript injection for XSS (reflected Cross-site scripting) attack without authentication.

title: Chinasea Qb Smart Service Robot security vulnerability


summary: Chain Sea ai chatbot system’s file upload function has insufficient filtering for special characters in URLs, which allows a remote attacker to by-pass file type validation, upload malicious script and execute arbitrary code without authentication, in order to take control of the system or terminate service.


product: POWER METER SICAM Q100

vendor: Siemens

version: All versions < V2.41

vendor: siemens

summary: A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.41), POWER METER SICAM Q100 (All versions < V2.41), POWER METER SICAM Q100 (All versions < V2.41), POWER METER SICAM Q100 (All versions < V2.41). The affected firmware contains a buffer overflow vulnerability in the web application that could allow a remote attacker with engineer or admin priviliges to potentially perform remote code execution.

title: Siemens 7Kg9501-0Aa01-2Aa1 Firmware security vulnerability


product: Fortinet FortiTokenAndroid

vendor: Fortinet

version: FortiTokenAndroid 5.1.0 and below

vendor: fortinet

summary: An improper access control vulnerability [CWE-284 ] in FortiToken Mobile (Android) external push notification 5.1.0 and below may allow a remote attacker having already obtained a user's password to access the protected system during the 2FA procedure, even though the deny button is clicked by the legitimate user.

title: Fortinet Fortitoken Mobile security vulnerability


product: Fortinet FortiClientLinux

version: FortiClientLinux version 6.0.8 and below, 6.2.9 and below, 6.4.7 and below, 7.0.2 and below

product: forticlient

summary: An incorrect permission assignment for critical resource vulnerability [CWE-732] in FortiClient for Linux version 6.0.8 and below, 6.2.9 and below, 6.4.7 and below, 7.0.2 and below may allow an unauthenticated attacker to access sensitive information in log files and directories via symbolic links.

title: Fortinet Forticlient security vulnerability


product: Fortinet FortiOS

version: FortiOS before 7.0.3

product: FortiOS

vendor_project: Fortinet

vulnerability_name: Fortinet FortiOS Arbitrary File Download

product: fortios

summary: A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages.


product: Fortinet FortiClientWindows

summary: A improper initialization in Fortinet FortiClient (Windows) version 6.0.10 and below, version 6.2.9 and below, version 6.4.7 and below, version 7.0.3 and below allows attacker to gain administrative privileges via placing a malicious executable inside the FortiClient installer's directory.


product: Fortinet FortiProxy, FortiOS

version: FortiOS before 7.0.4; FortiProxy before 2.0.8

product: fortiproxy

summary: A stack-based buffer overflow vulnerability [CWE-121] in the command line interpreter of FortiOS before 7.0.4 and FortiProxy before 2.0.8 may allow an authenticated attacker to execute unauthorized code or commands via specially crafted command line arguments.

title: Fortinet Fortiproxy security vulnerability


summary: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiOS version 6.0.0 through 6.0.14, FortiOS version 6.2.0 through 6.2.10, FortiOS version 6.4.0 through 6.4.8, FortiOS version 7.0.0 through 7.0.3 allows attacker to execute privileged commands on a linked FortiSwitch via diagnostic CLI commands.

title: Fortinet Fortios security vulnerability


default_status: unaffected

product: FortiClientEMS

version_type: semver

summary: An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClientEMS versions 7.0.0 through 7.0.4, 7.0.6 through 7.0.7, in all 6.4 and 6.2 version management interface may allow an unauthenticated attacker to gain information on environment variables such as the EMS installation path.

title: Fortinet Forticlient Endpoint Management Server security vulnerability


product: Experience Manager

vendor: Adobe

vendor: adobe

summary: AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

title: Adobe Experience Manager security vulnerability


summary: AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a reflected Cross-Site Scripting (XSS) vulnerability via the itemResourceType parameter. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser


product: Dimension

product: dimension

summary: Adobe Dimension versions 3.4.3 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious GIF file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.

title: Adobe Dimension security vulnerability


summary: Adobe Dimension versions 3.4.3 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious GIF file.

title: Adobe Dimension security vulnerability


summary: Adobe Dimension versions 3.4.3 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious SVG file.

title: Adobe Dimension security vulnerability


summary: Adobe Dimension versions 3.4.3 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious TIF file.

title: Adobe Dimension security vulnerability


product: Bridge

product: bridge

summary: Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious RGB file.

title: Adobe Bridge security vulnerability


summary: Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious SGI file.

title: Adobe Bridge security vulnerability


default_status: affected

product: After Effects

summary: Adobe After Effects versions 22.0 (and earlier) and 18.4.2 (and earlier) are affected by an out-of-bounds read vulnerability which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

title: Adobe After Effects security vulnerability


product: Student Information Management System

vendor: UBIT Information Technologies

vendor: ubit

summary: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in UBIT Information Technologies Student Information Management System. This issue affects Student Information Management System: before 20211126.

title: Ubit Student Information Management System security vulnerability


product: Acronis Cyber Protect 15

vendor: Acronis

vendor: acronis

summary: DLL hijacking could lead to local privilege escalation. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035


product: Acronis Agent

product: Acronis Cyber Protect Home Office

product: agent

summary: DLL hijacking could lead to denial of service. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035, Acronis Agent (Windows) before build 27305, Acronis Cyber Protect Home Office (Windows) before build 39612


platforms: Windows Linux

summary: Self cross-site scripting (XSS) was possible on devices page. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 28035


summary: Cross-site scripting (XSS) was possible in notification pop-ups. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 28035


summary: Stored cross-site scripting (XSS) was possible in activity details. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 28035


summary: Stored cross-site scripting (XSS) was possible in protection plan details. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 28035


product: Acronis True Image 2021

summary: Local privilege escalation via named pipe due to improper access control checks. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035, Acronis Agent (Windows) before build 27147, Acronis Cyber Protect Home Office (Windows) before build 39612, Acronis True Image 2021 (Windows) before build 39287


summary: Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39612, Acronis True Image 2021 (Windows) before build 39287


summary: Local privilege escalation due to DLL hijacking vulnerability in Acronis Media Builder service. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39612, Acronis True Image 2021 (Windows) before build 39287


notes: https://www.acclaimsystems.com/#contact ; https://www.tnatc.org/#contact ; https://nvd.nist.gov/vuln/detail/CVE-2021-44207

product: USAHERDS

required_action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Please contact the product developer for support and vulnerability mitigation.

vendor_project: Acclaim Systems

vulnerability_name: Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability

product: usaherds

vendor: acclaimsystems

summary: Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.


vendor: open-xchange

summary: OX App Suite through 7.10.5 allows XSS via an unknown system message in Chat.


summary: OX App Suite through 7.10.5 allows XSS via an HTML 5 element such as AUDIO.


summary: OX App Suite through 7.10.5 allows XSS via NIFF (Notation Interchange File Format) data.


summary: OX App Suite through 7.10.5 allows XSS via the class attribute of an element in an HTML e-mail signature.


summary: OX App Suite through 7.10.5 allows XSS via a trailing control character such as the SCRIPT\t substring.


summary: OX App Suite through 7.10.5 allows XSS via uuencoding in a multipart/alternative message.


product: cfengine

summary: Northern.tech CFEngine Enterprise 3.15.4 before 3.15.5 has Insecure Permissions that may allow unauthorized local users to have an unspecified impact.

title: Northern.Tech Cfengine security vulnerability


summary: Northern.tech CFEngine Enterprise before 3.15.5 and 3.18.x before 3.18.1 has Insecure Permissions that may allow unauthorized local users to access the Apache and Mission Portal log files.


product: codechecker

vendor: ericsson

summary: In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API.

title: Ericsson Codechecker security vulnerability


product: gin-vue-admin

summary: Gin-Vue-Admin before 2.4.6 mishandles a SQL database.


product: SIMATIC eaSie Core Package

version: All versions < V22.00

summary: A vulnerability has been identified in SIMATIC eaSie Core Package (All versions < V22.00). The affected systems do not properly validate input that is sent to the underlying message passing framework. This could allow an remote attacker to trigger a denial of service of the affected system.


summary: A vulnerability has been identified in SIMATIC eaSie Core Package (All versions < V22.00). The underlying MQTT service of affected systems does not perform authentication in the default configuration. This could allow an unauthenticated remote attacker to send arbitrary messages to the service and thereby issue arbitrary requests in the affected system.


ecosystem: php/wordpress

product: wordpress

vendor: wordpress

summary: WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress installations that use any plugin for which the slug satisfies the naming constraints of the WordPress.org Plugin Directory but is not yet present in that directory.


product: Apache HTTP Server

vendor: Apache Software Foundation

less_than: Apache HTTP Server 2.4*

vendor: apache

product: fedora

vendor: fedoraproject

vendor: debian

vendor: tenable

vendor: oracle

summary: A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).

title: Apache Http Server security vulnerability


product: keepalived

vendor: keepalived

summary: In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situations in which an unrelated D-Bus system service has a settable (writable) property

title: Keepalived security vulnerability


product: synapse

vendor: razer

summary: Razer Synapse before 3.7.0228.022817 allows privilege escalation because it relies on %PROGRAMDATA%\Razer\Synapse3\Service\bin even if %PROGRAMDATA%\Razer has been created by any unprivileged user before Synapse is installed. The unprivileged user may have placed Trojan horse DLLs there.

title: Razer Synapse security vulnerability


product: mailman

vendor: gnu

summary: In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.

title: Gnu Mailman security vulnerability


product: Apache Log4j2

status: unaffected

ecosystem: java/maven

known_ransomware_campaign_use: Known

required_action: For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.

vendor_project: Apache

vulnerability_name: Apache Log4j2 Remote Code Execution Vulnerability

author: Stephen M Abbott

content_markdown:
The Log4j 2.x logger interpolated `${jndi:ldap://...}` strings
when logging arbitrary content. An attacker who could get a
string into a log statement (almost any user-controlled
field — User-Agent, search query, username) could trigger an
LDAP/RMI lookup, fetch a remote class, and execute it. The
naive fix (upgrade to 2.15.0) had a follow-up CVE because the
fix was incomplete. The durable baseline that also closes the
related follow-up vulnerabilities is Log4j 2.17.1+ on Java 8,
2.12.4 on Java 7, or 2.3.2 on Java 6. Removing a lookup class
from an older JAR is temporary containment, not a post-upgrade
requirement.

CISA added CVE-2021-44228 to the Known Exploited Vulnerabilities catalog on
**2021-12-10** (required action due **2021-12-24**) and currently records known
ransomware campaign use. Rechecked against the live
[Apache Log4j security page](https://logging.apache.org/log4j/2.x/security.html)
and the CISA KEV JSON on 2026-08-21. Apache's per-CVE floors for this family
are now `2.15.0` / `2.12.2` / `2.3.1` (44228), `2.16.0` / `2.12.3` / `2.3.1`
(45046), and `2.17.0` / `2.12.3` / `2.3.1` (45105 and 44832). This recipe still
targets `2.17.1+` / `2.12.4` / `2.3.2` as the conservative family floor that
includes later maintenance releases after those follow-ups.

## Affected versions

- **Log4j-core** 2.0-beta9 through 2.14.1 — vulnerable.
- **Log4j-core** 2.15.0 — incomplete fix (CVE-2021-45046).
- **Log4j-core** 2.16.0 — DoS via uncontrolled recursion
  (CVE-2021-45105).
- **Log4j-core** 2.17.0 — JDBC Appender RCE under specific
  config (CVE-2021-44832).
- **Log4j-core** 2.17.1+ (or 2.12.4 / 2.3.2 for older Java
  versions) — the durable fix.

`log4j-api` alone is not vulnerable; the bug is in
`log4j-core`'s pattern-substitution code path.

## Indicator-of-exposure

Having `log4j-core` in the classpath is the necessary
condition. Sufficient exposure also requires:

- A vulnerable version (per the above).
- A code path that logs untrusted input. In a typical web
  application, almost every code path qualifies — request
  headers, paths, bodies are routinely logged.

If the only logging in the application is a fixed string with
no user-controlled fields and no exception traces (rare),
exposure may be limited. Don't rely on that for triage; the
attacker's job is to find one untrusted input that makes it
to a log line.

## Remediation strategy

The durable fix is:

1. **Upgrade** `log4j-core` to 2.17.1+ (or 2.12.4 / 2.3.2 on
   older Java versions).
2. **Keep `log4j-api` and `log4j-core` on the same patched
   release** and rebuild every shaded, vendored, containerized,
   and runtime-bundled copy.
3. **Audit for `log4j-1.x`**. The 1.x branch has different
   CVEs (CVE-2019-17571, CVE-2022-23305) and is end-of-life.

If an affected artifact cannot be upgraded immediately, removing
`JndiLookup.class` from that specific legacy JAR can reduce exposure while a
replacement is prepared. Treat it as time-bounded containment with an owner,
expiry, isolation, and egress restrictions. The historical
`formatMsgNoLookups` setting was incomplete for some lookup paths and has no
useful role after message lookups were removed in modern patched releases; it
is not evidence that remediation is complete.

## When to use it

Use this recipe when a Java, Scala, Kotlin, Clojure, Spark, Hadoop, Solr,
Elasticsearch, vendor appliance, container image, or shaded/uber-JAR may include
`log4j-core` 2.x in the vulnerable ranges or Log4j 1.x legacy appenders. It is
most important when untrusted request fields, headers, exception messages,
tenant data, job metadata, or message payloads reach application logs.

Use it to inventory direct, transitive, shaded, vendored, and runtime-bundled
Log4j copies, upgrade them on the correct Java line, contain any blocked legacy
artifact, and prove JNDI lookup behavior is neutralized. Do not use it to batch unrelated
dependency upgrades into the same PR.

## Inputs

- Maven, Gradle, SBT, Bazel, Pants, Ivy, lockfiles, dependency reports, SBOMs,
  container images, shaded JARs, vendor bundles, deployment manifests, JVM
  startup config, Helm values, Dockerfiles, and service launchers.
- Resolved `log4j-core`, `log4j-api`, Log4j 1.x, reload4j, bridge, appender,
  and transitive dependency versions for every module and artifact.
- Logging paths that can receive untrusted input: request headers, paths,
  bodies, usernames, search queries, exception messages, job names, queue
  payloads, tenant metadata, and audit events.
- Mitigation and verification evidence: resolved patched versions, rebuilt
  artifacts, SCA/SBOM scans, behavior tests, network egress policy, and runtime
  startup logs. Record `JndiLookup.class` removal only for a legacy artifact
  that is temporarily blocked from upgrade.
- Java runtime constraints, vendored/signed artifact ownership, module owners,
  rollout windows, rollback plan, and scanner suppression requirements.

## The prompt

~~~markdown
You are remediating Log4Shell (CVE-2021-44228 / 45046 / 45105
/ 44832) in this repository. Output a PR (or set of PRs, one
per Maven module) or a TRIAGE.md.

## Step 0 — Inventory

1. Locate every `log4j-core` dependency in the dependency
   graph: `pom.xml`, `build.gradle`, `build.sbt`, the lockfile
   if any, and shaded/uber-JAR contents.
2. Record the current version of each. Note any vendored or
   shaded copies.
3. List Log4j 1.x usages separately — they need a different
   fix path (replace with reload4j or upgrade to 2.x).

## Step 1 — Apply the upgrade

For each `log4j-core` reference:

1. Bump the version to 2.17.1+ (or 2.12.4 on Java 7, 2.3.2 on
   Java 6). Match the major-runtime constraint of the project.
2. Bump `log4j-api` to the same version. Mismatch breaks at
   runtime.
3. Run the project's test suite. If tests fail because of
   genuinely-changed behaviour (rare in 2.14 → 2.17), document
   the change in the PR.

## Step 2 — Contain any blocked legacy artifact

1. Do not use `formatMsgNoLookups` as proof of remediation. If
   the setting already exists, record it as legacy configuration;
   remove it only when the owning deployment can test that change.
2. For any affected vendored / shaded JAR that cannot be upgraded
   immediately, remove `JndiLookup.class` from the JAR:
   `zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class`.
3. Give the containment an owner and expiry, restrict network
   egress, and verify with `unzip -l log4j-core-*.jar | grep
   JndiLookup` showing no entry. Continue tracking the artifact
   until it is replaced with a patched build.

## Step 3 — Verify

1. Re-run the SBOM / SCA scan against the post-upgrade
   artifact. CVE-2021-44228, -45046, -45105, and -44832 must
   all show as "fixed" or "not present."
2. Run a behaviour test: a log statement that includes
   `${jndi:ldap://example.invalid/x}` must log the literal
   string, not trigger an LDAP request.
3. Inspect the final application, shaded JARs, container layers,
   and runtime startup evidence to confirm that every loaded
   `log4j-core` copy is patched or explicitly covered by the
   temporary containment above.

## Step 4 — Open the PR

- Branch: `remediate/cve-2021-44228-log4shell`.
- Title: `[Security][CVE-2021-44228] upgrade log4j-core to 2.17.1+`.
- Body must include:
  - CVE summary and link to the advisory.
  - Per-module list of versions bumped.
  - Rebuilt shaded, vendored, and containerized artifact versions.
  - Any temporary class-removal containment, its owner, and expiry.
  - SCA scan output before/after.
  - Behaviour-test result.
  - Rollback plan.
- Label: `sec-auto-remediation`.

## Stop conditions

- A vendored / shaded JAR cannot be safely modified
  (signed, license-restricted). Triage with a note about the
  vendor.
- The application uses Log4j 1.x and replacement requires API
  changes. Triage; the right path is a separate
  Log4j-1-to-2-or-reload4j migration.
- Tests fail in a way that suggests a real behaviour change in
  Log4j 2.17.1+ — read the release notes and document.

## Scope

- Do not bundle other CVE bumps in this PR.
- Do not modify application logging configuration beyond what
  the recipe requires.
- Do not remove `JndiManager` or other classes. Removing
  `JndiLookup.class` is only a temporary containment path for an
  affected artifact that cannot yet be upgraded.
~~~

## Verification — what the reviewer looks for

- Both `log4j-core` and `log4j-api` are at the same patched
  version.
- Every packaged and runtime-loaded `log4j-core` copy is on the
  correct patched line; `formatMsgNoLookups` is not accepted as
  evidence in place of the upgrade.
- For a blocked legacy vendored JAR, the `JndiLookup.class` entry
  is gone, the containment is verified with `unzip -l`, and an
  owner and replacement deadline are recorded.
- The behaviour test in the PR exercised the actual logger
  path the application uses (not a synthetic logger).
- The PR did not silently bump unrelated dependencies.

## Watch for

- **Shaded uber-JARs.** Some applications shade Log4j into a
  bigger JAR. Bumping the dependency upstream isn't enough;
  the shaded copy needs the patched version baked in.
- **Java 6 / Java 7 targets.** The patch backports for those
  runtimes are 2.3.2 and 2.12.4. Do not silently bump to
  2.17.1 on a Java 7 build.
- **`log4j-1.x`.** A different bug surface
  (CVE-2019-17571 deserialization, CVE-2022-23305 SQL
  appender). The fix is migration to 2.x or reload4j; the
  recipe above does not cover it.
- **JNDI is broader than Log4j.** A Log4j-clean codebase can
  still have JNDI-injection bugs in other libraries (Spring,
  H2 Console, JNDI lookups in custom code). This recipe
  doesn't catch those.
- **Legacy flags are not the fix.** `formatMsgNoLookups=true`
  was an incomplete mitigation on older releases, and modern
  patched releases removed message-lookup behavior. Require a
  patched artifact rather than preserving the flag as
  post-upgrade defense-in-depth.

## Output contract

Return one of:

- A reviewer-ready PR/change request that inventories every Log4j copy, upgrades
  `log4j-core` and `log4j-api` to the correct patched line, rebuilds shaded and
  vendored artifacts, adds a behavior test, refreshes SCA/SBOM evidence, and
  documents rollback. If a legacy artifact cannot yet be replaced, record its
  temporary `JndiLookup.class` containment, owner, expiry, and egress boundary.
- `TRIAGE.md` when a vendored/signed artifact cannot be safely modified, Log4j
  1.x migration requires a broader API change, Java runtime constraints block
  the patched line, or ownership is outside the repository.

The output must list each module/artifact, before/after versions, Java runtime
constraint, shaded or vendored JAR handling, behavior-test result, SCA/SBOM
scan status, rollback plan, and any Log4j 1.x follow-up. It must not rely on
`formatMsgNoLookups`, silently bump unrelated
dependencies, remove unrelated JNDI classes, or suppress scanner findings
without evidence.

## References

- NVD: <https://nvd.nist.gov/vuln/detail/CVE-2021-44228>
- GitHub Advisory: <https://github.com/advisories/GHSA-jfh8-c2jp-5v3q>
- Apache Log4j security page: <https://logging.apache.org/log4j/2.x/security.html>
- CISA KEV catalog entry: <https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44228>

## Related recipes

- [Vulnerable Dependency Remediation]({{< relref "/security-remediation/vulnerable-dependencies" >}})
  — the generic workflow this recipe specialises.
- [Classic Vulnerable Defaults → Java ObjectInputStream]({{< relref "/recipes/general/classic-vulnerable-defaults/java-deserialization" >}})
  — adjacent Java deserialization risks.

description: CVE-2021-44228 Log4Shell RCE: upgrade log4j-core to 2.17.1+ (2.12.4 on Java 7 or 2.3.2 on Java 6); use legacy mitigations only until patched.

maturity: stable

model: Opus 4.7

title: CVE-2021-44228 — Log4Shell

vendor: siemens

quality: curated

recipe_kind: markdown-override

summary: Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.


vendor: portswigger

summary: PortSwigger Burp Suite Enterprise Edition before 2021.11 on Windows has weak file permissions for the embedded H2 database, which might lead to privilege escalation. This issue can be exploited by an adversary who has already compromised a valid Windows account on the server via separate means. In this scenario, the compromised account may have inherited read access to sensitive configuration, database, and log files.

title: Portswigger Burp Suite security vulnerability


product: SAP ABAP Server & ABAP Platform (Translation Tools)

vendor: SAP SE

vendor: sap

summary: Internally used text extraction reports allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.


product: SAF-T Framework

version: < SAP_FIN 617

version: < SAP_APPL 600

version: < S4CORE 102

summary: SAF-T Framework Transaction SAFTN_G allows an attacker to exploit insufficient validation of path information provided by normal user, leading to full server directory access. The attacker can see the whole filesystem structure but cannot overwrite, delete, or corrupt arbitrary files on the server.

title: Sap Saf-T Framework security vulnerability


product: SAP GRC Access Control

summary: SAP GRC Access Control - versions V1100_700, V1100_731, V1200_750, does not perform necessary authorization checks for an authenticated user, which could lead to escalation of privileges.

title: Sap Access Control security vulnerability


product: SAP Business One

summary: SAP Business One - version 10.0, extended log stores information that can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

title: Sap Business One security vulnerability


product: SAP NetWeaver AS ABAP

summary: Two methods of a utility class in SAP NetWeaver AS ABAP - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allow an attacker with high privileges and has direct access to SAP System, to inject code when executing with a certain transaction class builder. This could allow execution of arbitrary commands on the operating system, that could highly impact the Confidentiality, Integrity and Availability of the system.

title: Sap Netweaver Application Server Abap security vulnerability


product: ayacms

summary: AyaCMS 3.1.2 is vulnerable to Remote Code Execution (RCE) via /aya/module/admin/ust_tab_e.inc.php,


summary: An SQL Injection vulnerabiity exists in Sourcecodester Logistic Hub Parcel's Management System 1.0 via the username parameter in login.php.


summary: An SQL Injection vulnerability exists in Courcecodester COVID 19 Testing Management System (CTMS) 1.0 via the (1) username and (2) contactno parameters.

title: Covid 19 Testing Management System Project Covid 19 Testing Management… security vulnerability


vendor: totolink

summary: Totolink devices A3100R v4.1.2cu.5050_B20200504, A830R v5.9c.4729_B20191112, and A720R v4.1.5cu.470_B20200911 were discovered to contain a stack overflow in the function setNoticeCfg. This vulnerability allows attackers to cause a Denial of Service (DoS) via the IpTo parameter.

title: Totolink A720R Firmware security vulnerability


summary: Totolink devices A3100R v4.1.2cu.5050_B20200504, A830R v5.9c.4729_B20191112, and A720R v4.1.5cu.470_B20200911 were discovered to contain command injection vulnerability in the function setNoticeCfg. This vulnerability allows attackers to execute arbitrary commands via the IpFrom parameter.


summary: Online Motorcycle (Bike) Rental System 1.0 is vulnerable to a Blind Time-Based SQL Injection attack within the login portal. This can lead attackers to remotely dump MySQL database credentials.


ecosystem: python/pypi

product: motioneye

product: motioneyeos

summary: Authenticated remote code execution in MotionEye <= 0.42.1 and MotioneEyeOS <= 20200606 allows a remote attacker to upload a configuration backup file containing a malicious python pickle file which will execute arbitrary code on the server.

title: Motioneye Project Motioneye security vulnerability


vendor: wavlink

summary: A vulnerability is in the 'wx.html' page of the WAVLINK AC1200, version WAVLINK-A42W-1.27.6-20180418, which can allow a remote attacker to access this page without any authentication. When an unauthorized user accesses this page directly, it connects to this device as a friend of the device owner.

title: Wavlink Wl-Wn531G3 Firmware security vulnerability


summary: A vulnerability is in the 'live_mfg.html' page of the WAVLINK AC1200, version WAVLINK-A42W-1.27.6-20180418, which can allow a remote attacker to access this page without any authentication. When processed, it exposes some key information of the manager of router.


vendor: netgear

summary: A vulnerability is in the 'BRS_top.html' page of the Netgear W104, version WAC104-V1.0.4.13, which can allow a remote attacker to access this page without any authentication. When processed, it exposes firmware version information for the device.

title: Netgear Wac104 Firmware security vulnerability


summary: A vulnerability is in the 'MNU_top.htm' page of the Netgear W104, version WAC104-V1.0.4.13, which can allow a remote attacker to access this page without any authentication. When processed, it exposes some key information for the device.

title: Netgear Mbr1517 Firmware security vulnerability


product: testrail

vendor: gurock

summary: Gurock TestRail before 7.2.4 mishandles HTML escaping.


vendor: gunet

summary: GUnet Open eClass (aka openeclass) before 3.12.2 allows XSS via the modules/auth/formuser.php auth parameter.


product: wavpack

vendor: wavpack

summary: An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.


summary: e2guardian v5.4.x <= v5.4.3r is affected by missing SSL certificate validation in the SSL MITM engine. In standalone mode (i.e., acting as a proxy or a transparent proxy), with SSL MITM enabled, e2guardian, if built with OpenSSL v1.1.x, did not validate hostnames in certificates of the web servers that it connected to, and thus was itself vulnerable to MITM attacks.


product: librenms

vendor: librenms

summary: Librenms 21.11.0 is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/common/alert-log.inc.php.


summary: Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php.


summary: Librenms 21.11.0 is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/forms/poller-groups.inc.php.


summary: attendance management system 1.0 is affected by a SQL injection vulnerability in admin/incFunctions.php through the makeSafe function.


product: shieldstore

summary: A buffer overflow in the component /Enclave.cpp of Electronics and Telecommunications Research Institute ShieldStore commit 58d455617f99705f0ffd8a27616abdf77bdc1bdc allows attackers to cause an information leak via a crafted structure from an untrusted operating system.

title: Shieldstore Project Shieldstore security vulnerability


vendor: naviwebs

summary: A reflected cross-site scripting (XSS) vulnerability in \lib\packages\themes\themes.php of Navigate CMS v2.9.4 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.

title: Naviwebs Navigate Cms security vulnerability


product: baicloud-cms

summary: BaiCloud-cms v2.5.7 was discovered to contain multiple SQL injection vulnerabilities via the tongji and baidu_map parameters in /user/ztconfig.php.

title: Baicloud-Cms Project Baicloud-Cms security vulnerability


summary: An issue was discovered in Firmware Analysis and Comparison Tool v3.2. With administrator privileges, the attacker could perform stored XSS attacks by inserting JavaScript and HTML code in user creation functionality.


summary: An issue was discovered in Firmware Analysis and Comparison Tool v3.2. Logged in administrators could be targeted by a CSRF attack through visiting a crafted web page.


vendor: phpgurukul

summary: In Bus Pass Management System v1.0, Directory Listing/Browsing is enabled on the web server which allows an attacker to view the sensitive files of the application, for example: Any file which contains sensitive information of the user or server.

title: Phpgurukul Bus Pass Management System security vulnerability


summary: In Bus Pass Management System v1.0, parameters 'pagedes' and `About Us` are affected with a Stored Cross-site scripting vulnerability.


summary: Mini-Inventory-and-Sales-Management-System is affected by Cross Site Request Forgery (CSRF), where an attacker can update/delete items in the inventory. The attacker must be logged into the application create a malicious file for updating the inventory details and items.

title: Mini-Inventory-And-Sales-Management-System Project Mini-Inventory-And-S… security vulnerability


vendor: arm

summary: ARM astcenc 3.2.0 is vulnerable to Buffer Overflow in function encode_ise().


product: ok-file-formats

summary: David Brackeen ok-file-formats 97f78ca is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used, a heap-buffer-overflow occurs in function ok_jpg_convert_YCbCr_to_RGB() in "/ok_jpg.c:513" .


summary: David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used, a heap-buffer-overflow occurs in function ok_png_transform_scanline() in "/ok_png.c:533".


summary: David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used, a heap-buffer-overflow occurred in function ok_png_transform_scanline() in "/ok_png.c:712".


summary: David Brackeen ok-file-formats dev version is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used, a heap-buffer-overflow occurred in function ok_jpg_generate_huffman_table() in "/ok_jpg.c:403".


summary: David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow via function ok_png_transform_scanline() in "/ok_png.c:494".


summary: David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used, a heap-buffer-overflow occurred in function ok_png_read_data() in "/ok_png.c".


vendor: wvti

summary: Beijing Wisdom Vision Technology Industry Co., Ltd One Card Integrated Management System 3.0 is vulnerable to SQL Injection.


product: tuzicms

vendor: yejiao

summary: SQL Injection vulnerability exists in TuziCMS v2.0.6 in App\Manage\Controller\GuestbookController.class.php.


summary: SQL Injection vulnerability exists in TuziCMS v2.0.6 via the id parameer in App\Manage\Controller\AdvertController.class.php.


summary: SQL Injection vulnerability exists in TuziCMS v2.0.6 via the id parameter in App\Manage\Controller\DownloadController.class.php.


product: thinkphp

vendor: thinkphp

summary: SQL Injection vulnerability exists in ThinkPHP5 5.0.x <=5.1.22 via the parseOrder function in Builder.php.


summary: An arbitrary file read vulnerability exists in NavigateCMS 2.9 via /navigate/navigate_download.php id parameter.


vendor: tendacn

summary: A Stack-based Buffer Overflow vulnerability exists in the Tenda AC15 V15.03.05.18_multi device via the list parameter in a post request in goform/SetIpMacBind.

title: Tendacn Ac15 Firmware security vulnerability


vendor: Reolink

vendor: reolink

summary: Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. An attacker can send an HTTP request to trigger this vulnerability.

title: Reolink Rlc-410W Firmware security vulnerability


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetRec param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetCrop param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetNorm param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. Set3G param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetCloudSchedule param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetPush param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetWifi param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetDevName param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetUpnp param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetNetPort param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetNtp param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetFtp param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetEmail param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetLocalLink param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetAutoFocus param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetMask param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetIsp param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetImage param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetEnc param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetAutoMaint param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetTime param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetPowerLed param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot.SetIrLights param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetAutoUpgrade param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetPtzTattern param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetPtzSerial param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetPtzPatrol param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetPtzPreset param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. Login param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. GetAbility param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. Format param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. GetEnc param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. GetImage param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. GetIsp param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. GetMask param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. Preview param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. rtmp=start param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. rtmp=stop param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. GetPtzPreset param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. GetPtzPatrol param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. PtzCtrl param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. GetPtzSerial param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. GetPtzTattern param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. GetZoomFocus param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. StartZoomFocus param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. GetAutoFocus param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. TestEmail param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. TestFtp param is not object. An attacker can send an HTTP request to trigger this vulnerability.


summary: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. TestWifi param is not object. An attacker can send an HTTP request to trigger this vulnerability.