2023

All versions of the package n158 are vulnerable to Command Injection due to improper input sanitization in the 'module.e

ntpd-rs is an NTP implementation written in Rust. ntpd-rs does not validate the length of NTS cookies in received NTP pa

Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS allows users to uplo

Nextcloud server is an open source personal cloud implementation. Missing brute-force protection on the WebDAV endpoints

CloudExplorer Lite is an open source cloud management tool. In affected versions users can add themselves to any organiz

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based

CloudExplorer Lite is an open source cloud management platform. In CloudExplorer Lite prior to version 1.1.0 users organ

Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification. Referring to [GHSA-85

NextCloud Cookbook is a recipe library app. Prior to commit a46d9855 on the `master` branch and commit 489bb744 on the `

XSS vulnerability from InstantPlay in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API

InstantPlay which included vulnerable script which could execute javascript in Galaxy Store prior to version 4.5.49.8 al

Improper scheme validation from InstantPlay Deeplink in Galaxy Store prior to version 4.5.49.8 allows attackers to execu

A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's publ

Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthentic

Nextcloud server provides a home for data. A regression in the session handling between Nextcloud Server and the Nextclo

Bottles before 51.0 mishandles YAML load, which allows remote code execution via a crafted file.

A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another use

The hwPartsDFR module has a vulnerability in API calling verification. Successful exploitation of this vulnerability may

The SDK for the MediaPlaybackController module has improper permission verification. Successful exploitation of this vul

In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, th

The reminder module lacks an authentication mechanism for broadcasts received. Successful exploitation of this vulnerabi

Integer overflow vulnerability in some phones. Successful exploitation of this vulnerability may affect service confiden

The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability ma

The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability ma

The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability ma

The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability ma

The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability ma

The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability ma

Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via /eval/ajax.php?action=save_u

Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_task.php?id=.

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ArtistScope CopySafe Web Protection plugin <= 3.13 version

Directory traversal vulnerability in ESS REC Agent Server Edition series allows an authenticated attacker to view or alt

user_oidc app is an OpenID Connect user backend for Nextcloud. Authentication can be broken/bypassed in user_oidc app. I

c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a quer

In WFTPD 3.25, usernames and password hashes are stored in an openly viewable wftpd.ini configuration file within the WF

Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice all

The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that allows an attacker with lo

IceCMS v1.0.0 has Insecure Permissions. There is unauthorized access to the API, resulting in the disclosure of sensitiv

Those using HtmlUnit to browse untrusted webpages may be vulnerable to Denial of service attacks (DoS). If HtmlUnit is r

Missing access permissions checks in M-Files Client before 23.5.12598.0 (excluding 23.2 SR2 and newer) allows elevation

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Jason Crouse, VeronaLabs Slimstat Analytics plugin <= 5.0.

Wacom Tablet Driver installer prior to 6.4.2-1 (for macOS) contains an improper link resolution before file access vulne

Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in CBOT Chatbot a

Authorization Bypass Through User-Controlled Key vulnerability in CBOT Chatbot allows Authentication Abuse, Authenticati

ZLMediaKit 4.0 is vulnerable to Directory Traversal.

IC Realtime ICIP-P2012T 2.420 is vulnerable to Incorrect Access Control via an exposed HTTP channel using VLC network.

The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to PHP Object Injection in versi

Amazon Alexa software version 8960323972 on Echo Dot 2nd generation and 3rd generation devices potentially allows attack

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untr

A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2, 22.24.1500.0 could allow an una