2023

Inappropriate implementation in DevTools in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a use

Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.3.

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in GitHub repo

Ethereum Name Service (ENS) is a distributed, open, and extensible naming system based on the Ethereum blockchain. Accor

protocol-http1 provides a low-level implementation of the HTTP/1 protocol. RFC 9112 Section 7.1 defined the format of ch

cypress-image-snapshot shows visual regressions in Cypress with jest-image-snapshot. Prior to version 8.0.2, it's possib

Zoho ManageEngine ADManager Plus through 7201 allow authenticated users to take over another user's account via sensitiv

A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authen

ECShop v4.1.16 contains an arbitrary file deletion vulnerability in the Admin Panel.

matrix-appservice-bridge provides an API for setting up bridges. Starting in version 4.0.0 and prior to versions 8.1.2 a

matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with

OpenRefine <= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which permits unauthorized users to ex

Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting (XSS) vulnerability.

MeterSphere is an open-source continuous testing platform. Prior to version 2.10.4 LTS, some interfaces of the Cloud ver

HedgeDoc is software for creating real-time collaborative markdown notes. Prior to version 1.9.9, the API of HedgeDoc 1

An issue was discovered in Zoho ManageEngine Network Configuration Manager 12.6.165. The WebSocket endpoint allows Cross

A heap out-of-bounds memory read flaw was found in the virtual nvme device in QEMU. The QEMU process does not validate a

VMware Horizon Server contains an information disclosure vulnerability. A malicious actor with network access may be abl

VMware Horizon Server contains a HTTP request smuggling vulnerability. A malicious actor with network access may be able

The WP Ultimate CSV Importer plugin for WordPress is vulnerable to privilege escalation in versions up to, and including

An issue has been discovered in GitLab EE affecting all versions starting from 14.1 before 16.0.8, all versions starting

Sulu is an open-source PHP content management system based on the Symfony framework. It allows over the Admin Login form

Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. A path

Predictable Exact Value from Previous Values vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT21 model

An issue in the delete function in the ActModelController class of jeesite v1.2.6 allows authenticated attackers to arbi

Cross Site Scripting (XSS) vulnerability in sourcecodester Lost and Found Information System 1.0 allows remote attackers

Cross Site Scripting (XSS) vulnerability in sourcecodester Toll Tax Management System 1.0 allows remote attackers to run

User enumeration is found in in PHPJabbers Cleaning Business Software 1.0. This issue occurs during password recovery, w

PHPJabbers Cleaning Business Software 1.0 is vulnerable to Cross Site Scripting (XSS) via the theme parameter of preview

There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Class Scheduli

A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundr

A security defect was discovered in Foundry Issues that enabled users to create convincing phishing links by editing the

The Foundry Magritte plugin rest-source was found to be vulnerable to an an XML external Entity attack (XXE).

The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint

A vulnerability in web-based management interface of Cisco SPA500 Series Analog Telephone Adapters (ATAs) could allow an

A vulnerability in the privilege management functionality of all Cisco BroadWorks server types could allow an authentica

A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthen

A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an

A vulnerability in the web-based management interface of Cisco Small Business SPA500 Series IP Phones could allow an una

Renault Zoe EV 2021 automotive infotainment system versions 283C35202R to 283C35519R (builds 11.10.2021 to 16.01.2023) a

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/customer-data-framework prior to 3.4.2.

NVIDIA Omniverse Workstation Launcher for Windows and Linux contains a vulnerability in the authentication flow, where

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.0.

A use-after-free vulnerability was found in the cxgb4 driver in the Linux kernel. The bug occurs when the cxgb4 device i

A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs during device in

A vulnerability was discovered in the odoh-rs rust crate that stems from faulty logic during the parsing of encrypted qu

The Wrangler command line tool  (<[email protected] or <[email protected]) was affected by a directory traversal vulnerabil

A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtio_crypto_h

WebBoss.io CMS v3.7.0.1 contains a stored cross-site scripting (XSS) vulnerability.

WebBoss.io CMS v3.7.0.1 contains a stored Cross-Site Scripting (XSS) vulnerability due to lack of input validation and o