2023

EisBaer Scada - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

IBM TXSeries for Multiplatforms, 8.1, 8.2, and 9.1, CICS TX Standard CICS TX Advanced 10.1 and 11.1 could allow a privil

The vulnerability allows an unprivileged(untrusted) third-party application to interact with a content-provider unsafely

Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. and e

The vulnerability allows an unprivileged (untrusted) third- party application to arbitrary modify the server settings of

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The WMS

The vulnerability allows an unprivileged user with access to the subnet of the TPC-110W device to gain a root shell on t

A vulnerability was reported in Elliptic Labs Virtual Lock Sensor for ThinkPad T14 Gen 3 that could allow an attacker wi

Grafana is an open-source platform for monitoring and observability. The WorldMap panel plugin, versions before 1.0.4

A first-factor authentication bypass vulnerability exists in the PingFederate with PingID Radius PCV when a MSCHAP authe

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mitchell Bennis Simple File List plugin <= 6.1.9 versi

The leakage of the client secret in Onigiriya-musubee Line 13.6.1 allows attackers to obtain the channel access token an

The leakage of the client secret in REGINA SWEETS&BAKERY Line 13.6.1 allows attackers to obtain the channel access token

The leakage of the client secret in Matsuya Line 13.6.1 allows attackers to obtain the channel access token and send cra

The leakage of the client secret in Fukunaga_memberscard Line 13.6.1 allows attackers to obtain the channel access token

The leakage of the client secret in Uomasa_Saiji_news Line 13.6.1 allows attackers to obtain the channel access token an

The leakage of the client secret in VISION MEAT WORKS TrackDiner10/10_mc Line v13.6.1 allows attackers to obtain the cha

The leakage of the client secret in TonTon-Tei Line v13.6.1 allows attackers to obtain the channel access token and send

The leakage of the client secret in Tokueimaru_waiting Line 13.6.1 allows attackers to obtain the channel access token a

ReDos in NPMJS Node Email Check v.1.0.4 allows an attacker to cause a denial of service via a crafted string to the scpS

PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authenti

PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java

A logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition. When a p

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in ver

XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. Prior t

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in ver

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with t

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in ver

XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. The cle

Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate Iden

The sisqualWFM 7.1.319.103 thru 7.1.319.111 for Android, has a host header injection vulnerability in its "/sisqualIdent

iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, on `pages/UI.php`,

iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, when displaying `pa

When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user

vCenter Server contains a partial information disclosure vulnerability. A malicious actor with non-administrative privil

vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious a

jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less.

Dromara Sureness before v1.0.8 was discovered to use a hardcoded key.

light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authen

A remote code execution issue exists in HPE OneView.

Pfsense CE version 2.6.0 is vulnerable to No rate limit which can lead to an attacker creating multiple malicious users

Missing authentication in the StudentPopupDetails_EmergencyContactDetails method in IDAttend’s IDWeb application

Missing authentication in the StudentPopupDetails_StudentDetails method in IDAttend’s IDWeb application 3.1.052 an

Missing authentication in the StudentPopupDetails_ContactDetails method in IDAttend’s IDWeb application 3.1.052 an

Unauthenticated SQL injection in the GetAssignmentsDue method in IDAttend’s IDWeb application 3.1.052 and earlier

Missing authentication in the DeleteAssignments method in IDAttend’s IDWeb application 3.1.052 and earlier allow

Unauthenticated SQL injection in the GetAssignmentsDue method in IDAttend’s IDWeb application 3.1.052 and earlier

Missing authentication in the GetAssignmentsDue method in IDAttend’s IDWeb application 3.1.052 and earlier allows e

Missing authentication in the GetStudentGroupStudents method in IDAttend’s IDWeb application 3.1.052 and earlier all

Missing authentication in the GetActiveToiletPasses method in IDAttend’s IDWeb application 3.1.052 and earlier allows