2023

An issue was found in Action Launcher v50.5 allows an attacker to escalate privilege via modification of the intent stri

Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Cross Site Request Forgery (CS

CKAN is an open-source data management system for powering data hubs and data portals. Prior to versions 2.9.9 and 2.10.

A remote attacker can trigger a denial of service in the socket.remoteAddress variable, by sending a crafted HTTP reques

RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process

RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process

An issue was discovered in Joomla! 4.2.0 through 4.3.1. The lack of rate limiting allowed brute force attacks against MF

PowerPath for Windows, versions 7.0, 7.1 & 7.2 contains Insecure File and Folder Permissions vulnerability. A regular u

RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process

RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process

Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22.

Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23.

Prestashop salesbooster <= 1.10.4 is vulnerable to Incorrect Access Control via modules/salesbooster/downloads/download.

Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar ima

Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user runn

The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing file operati

The WP Fastest Cache WordPress plugin before 1.1.5 does not have CSRF check in an AJAX action, and does not validate use

The Newsletter Popup WordPress plugin through 1.2 does not have CSRF checks in some places, which could allow attackers

The Elementor Website Builder WordPress plugin before 3.12.2 does not properly sanitize and escape the Replace URL param

Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and ch

Minecraft through 1.19 and 1.20 pre-releases before 7 (Java) allow arbitrary file overwrite, and possibly code execution

Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is

nFPM is an alternative to fpm. The file permissions on the checked-in files were not maintained. Hence, when nfpm packag

The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.13)C0

tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instanc

Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instea

An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. BrowseFiles.php allows a ?cmd=ssh

An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is authenticated SQL injection

A directory traversal vulnerability on Mercury MAC1200R devices allows attackers to read arbitrary files via a web-stati

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in MonitorClick Forms Ada – Form Builder plugin <= 1.0 versio

Yank Note (YN) 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via nodeRequire('child_pro

pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthenticat

FS S3900-24T4S devices allow authenticated attackers with guest access to escalate their privileges and reset the admin

Warpinator before 1.6.0 allows remote file deletion via directory traversal in top_dir_basenames.

An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. When a SVG file wi

Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require('child_process').

In ebankIT 6, the public endpoints /public/token/Email/generate and /public/token/SMS/generate allow generation of OTP m

Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Easy Google Maps plugin <= 1.11.7 versions.

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Product Vendors plugin <= 2.1.76 versions.

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Follow-Up Emails (AutomateWoo) plu

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in One Rank Math SEO PRO plugin <= 3.0.35 versions.

Unauth. Reflected (XSS) Cross-Site Scripting (XSS) vulnerability in EventPrime plugin <= 2.8.6 versions.

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Awesome Motive Duplicator Pro plugin <= 4.5.11 versions.

Improper Authorization in GitHub repository openemr/openemr prior to 7.0.1.

Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.

Code Injection in GitHub repository openemr/openemr prior to 7.0.1.

Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.1.

socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol

All versions of the package bwm-ng are vulnerable to Command Injection due to improper input sanitization in the 'check'

All versions of the package keep-module-latest are vulnerable to Command Injection due to missing input sanitization or