2023

The "OX Chat" web service did not specify a media-type when processing responses by external resources. Malicious script

Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handler

The "upsell" widget for the portal allows to specify a product description. This description taken from a user-controlla

The users clientID at "application passwords" was not sanitized or escaped before being added to DOM. Malicious script c

Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets proce

Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With existing sanitizati

Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when access

External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, inv

The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not

The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via th

An issue has been discovered in GitLab affecting all versions before 16.0.8, all versions starting from 16.1 before 16.1

An issue has been discovered in GitLab CE/EE affecting all versions starting before 16.0.8, all versions starting from 1

An issue has been discovered in GitLab EE affecting all versions from 15.11 prior to 16.2.2 which allows an attacker to

In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enu

In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoin

An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 16.0.8, all versions starting

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.1.3, all versions start

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 16.0.8, all versions start

An information disclosure in the web interface of Brocade Fabric OS versions before Brocade Fabric OS v9.2.0 and v9.1.1c

An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting fr

An issue in the delete function in the MenuController class of jeesite v1.2.6 allows authenticated attackers to arbitrar

Cross Site Scripting vulnerability in e107 v.2.3.2 allows a remote attacker to execute arbitrary code via the descriptio

A reflected cross-site scripting (XSS) vulnerability exists in Brocade Webtools PortSetting.html of Brocade Fabric OS v

A buffer overflow vulnerability in “diagstatus” command in Brocade Fabric OS before Brocade Fabric v9.2.0 and v9.1.1c co

A buffer overflow vulnerability in “secpolicydelete” command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v

Brocade Fabric OS before Brocade Fabric OS v9.1.1c, v9.2.0 contains a vulnerability in the command line that could allow

An issue has been discovered in GitLab affecting all versions starting from 15.9 before 16.0.8, all versions starting fr

An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.0.8, all versions starting fr

Insufficient validation of untrusted input in Themes in Google Chrome prior to 115.0.5790.98 allowed a remote attacker t

Insufficient validation of untrusted input in Chromad in Google Chrome on ChromeOS prior to 115.0.5790.131 allowed a rem

Inappropriate implementation in Autofill in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to obfuscate

Inappropriate implementation in Notifications in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to spoof

Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 115.0.5790.98 allowed a remote attacker

Inappropriate implementation in Web API Permission Prompts in Google Chrome prior to 115.0.5790.98 allowed a remote atta

Inappropriate implementation in Picture In Picture in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to

Inappropriate implementation in WebApp Installs in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to pot

Cross Site Scripting vulnerability in Faculty Evaulation System using PHP/MySQLi v.1.0 allows an attacker to execute arb

PHPJabbers Catering System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /

There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Time Slots Boo

There is a Cross Site Scripting (XSS) vulnerability in "cid" parameter of preview.php in PHPJabbers Time Slots Booking C

The Brocade Fabric OS Commands “configupload” and “configdownload” before Brocade Fabric OS v9.1.1c, v8.2.3d, v9.2.0

Brocade Fabric OS before Brocade Fabric OS 9.1.1c, 9.2.0 contains a vulnerability when using various commands such as “c

A potential power side-channel vulnerability in AMD processors may allow an authenticated attacker to monitor the CPU po

An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript. This issue may allow a local

A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This issue may allow a

The Barebones CMS v2.0.2 is vulnerable to Stored Cross-Site Scripting (XSS) when an authenticated user interacts with ce

When opening appref-ms files, Firefox did not warn the user that these files may contain malicious code. *This bug only

A website could have obscured the full screen notification by using a URL with a scheme handled by an external program,

The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, any files in that d

Race conditions in reference counting code were found through code inspection. These could have resulted in potentially