2023

NNM failed to properly set ACLs on its installation directory, which could allow a low privileged user to run arbitrary

Under certain conditions, Nessus Network Monitor could allow a low privileged user to escalate privileges to NT AUTHORI

An issue was discovered when using Document Level Security and the SPO "Limited Access" functionality in Elastic Sharepo

The application interface allows users to perform certain actions via HTTP requests without performing any validity ch

The application suffers from improper access control when editing users. A user with read permissions can manipulate

NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that

The cookie session ID is of insufficient length and can be exploited by brute force, which may allow a remote attacker

The application suffers from a privilege escalation vulnerability. A user with read permissions can elevate privileg

A vulnerability was found in Shaanxi Chanming Education Technology Score Query System 5.0. It has been rated as critical

A vulnerability was found in GeoServer GeoWebCache up to 1.15.1. It has been declared as problematic. This vulnerability

A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been classified as critical. This

A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by t

Sourcecodester Free and Open Source inventory management system 1.0 is vulnerable to Cross Site Scripting (XSS) via the

Sourcecodester Free and Open Source inventory management system v1.0 is vulnerable to Incorrect Access Control. An arbit

ZITADEL is an identity infrastructure management system. ZITADEL users can upload their own avatar image using various i

browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based

ILIAS 7.25 (2023-09-12) allows any authenticated user to execute arbitrary operating system commands remotely, when a hi

The Learning Module in ILIAS 7.25 (2023-09-12 release) allows an attacker (with basic user privileges) to achieve a high

ILIAS (2013-09-12 release) contains a medium-criticality Directory Traversal local file inclusion vulnerability in the S

A vulnerability has been found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this vulnerability i

A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.10. Affected is an unknown funct

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WebDorado WDSocialWidgets plugin <= 1.0.15 versions.

Missing Encryption of Security Keys vulnerability in Silicon Labs Ember ZNet SDK on 32 bit, ARM (SecureVault High module

Missing Encryption of Security Keys vulnerability in Silicon Labs OpenThread SDK on 32 bit, ARM (SecureVault High module

A vulnerability, which was classified as critical, has been found in Tongda OA 2017 11.10. This issue affects the functi

A vulnerability classified as critical was found in Tongda OA 2017 11.10. This vulnerability affects unknown code of the

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Conversios Track Google Analytics 4, Facebook Pixel & Conv

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mammothology WP Full Stripe Free plugin <= 1.6.1 versi

Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Lavacode Lava Directory Manager plugin <= 1.1.34 versions.

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Arrow Plugins The Awesome Feed – Custom Feed plugin <= 2.2

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RedNao WooCommerce PDF Invoice Builder, Create invoices, p

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wpdevart Contact Form Builder, Contact Widget plugin <= 2.

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in TotalPress.Org Custom post types, Custom Fields & more

Incorrect LDAP ACLs in ucs-school-ldap-acls-master in UCS@school before 4.4v5-errata allow remote teachers, staff, and s

Cross-Site Request Forgery (CSRF) vulnerability in Mihai Iova WordPress Knowledge base & Documentation Plugin – WP Knowl

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Borbis Media FreshMail For WordPress plugin <= 2.3.2 versi

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Michael Simpson Add Shortcodes Actions And Filters plugin

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Vark Minimum Purchase for WooCommerce plugin <= 

The Assistant WordPress plugin before 1.4.4 does not validate a parameter before making a request to it via wp_remote_ge

Potential buffer overflow vulnerability at the following location in the Zephyr STM32 Crypto driver

The admin panel for Obl.ong before 1.1.2 allows authorization bypass because the email OTP feature accepts arbitrary num

An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message without manda

An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data, leading to a crash.

It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whe

An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the event of an error. Th

An issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into th

If Elastic Endpoint (v7.9.0 - v8.10.3) is configured to use a non-default option in which the logging level is explicitl

Catdoc v0.95 was discovered to contain a NULL pointer dereference via the component xls2csv at src/xlsparse.c.

Xolo CMS v0.11 was discovered to contain a reflected cross-site scripting (XSS) vulnerability.

Incorrect access control in writercms v1.1.0 allows attackers to directly obtain backend account passwords via unspecifi