2023

Home assistant is an open source home automation. The audit team’s analyses confirmed that the `redirect_uri` and `clien

The leakage of the client secret in Kaibutsunosato v13.6.1 allows attackers to obtain the channel access token and send

The Home Assistant Companion for iOS and macOS app up to version 2023.4 are vulnerable to Client-Side Request Forgery. A

Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary co

Cross-site scripting (XSS) vulnerability in evolution v.3.2.3 allows a local attacker to execute arbitrary code via a cr

Home assistant is an open source home automation. In affected versions the `hassio.addon_stdin` is vulnerable to a parti

Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is

Home assistant is an open source home automation. Home Assistant server does not set any HTTP security headers, includin

Home assistant is an open source home automation. Whilst auditing the frontend code to identify hidden parameters, Cure5

Home assistant is an open source home automation. The Home Assistant login page allows users to use their local Home Ass

TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s Notif

TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyM

ArchiveBox is an open source self-hosted web archiving system. Any users who are using the `wget` extractor and view the

Yamcs 5.8.6 allows XSS (issue 2 of 2). It comes with a Bucket as its primary storage mechanism. Buckets allow for the up

Yamcs 5.8.6 allows XSS (issue 1 of 2). It comes with a Bucket as its primary storage mechanism. Buckets allow for the up

Inadequate encryption strength in mycli 1.27.0 allows attackers to view sensitive information via /mycli/config.py

Multiple Cross-Site Scripting (XSS) vulnerabilities in installation of Subrion CMS v.4.2.1 allows a local attacker to ex

Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a cra

Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary co

Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary co

Cross-site scripting (XSS) vulnerability in evolution evo v.3.2.3 allows a local attacker to execute arbitrary code via

Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for

Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for

Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for

An issue discovered in IXP Data EasyInstall 6.6.14907.0 allows attackers to gain escalated privileges via static Cryptog

An issue discovered in IXP EasyInstall 6.6.14884.0 allows attackers to run arbitrary commands, gain escalated privilege,

An issue found in IXP Data Easy Install v.6.6.14884.0 allows a local attacker to gain privileges via a static XOR key.

An issue discovered in IXP Data Easy Install v.6.6.14884.0 allows local attackers to gain escalated privileges via weak

An issue found in IXP Data Easy Install v.6.6.14884.0 allows an attacker to escalate privileges via lack of permissions

In the module "Carousels Pack - Instagram, Products, Brands, Supplier" (hicarouselspack) for PrestaShop up to version 1.

In Weintek's cMT3000 HMI Web CGI device, the cgi-bin codesys.cgi contains a stack-based buffer overflow, which

In Weintek's cMT3000 HMI Web CGI device, an anonymous attacker can execute arbitrary commands after login to th

In Weintek's cMT3000 HMI Web CGI device, the cgi-bin command_wb.cgi contains a stack-based buffer overflow, which

An issue was discovered in TrEEConfigDriver in Insyde InsydeH2O with kernel 5.0 through 5.5. It can report false TPM PCR

An issue found in IXP Data Easy Install 6.6.148840 allows a remote attacker to escalate privileges via insecure PRNG.

TinyLab linux-lab v1.1-rc1 and cloud-labv0.8-rc2, v1.1-rc1 are vulnerable to insecure permissions. The default configura

A vulnerability in the web-based interface of the RUCKUS Cloudpath product on version 5.12 build 5538 or before to could

Leantime is an open source project management system. A 'userId' variable in `app/domain/files/repositories/class.files.

ydb-go-sdk is a pure Go native and database/sql driver for the YDB platform. Since ydb-go-sdk v3.48.6 if you use a custo

Directus is a real-time API and App dashboard for managing SQL database content. In affected versions any Directus insta

Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for

In the module "Creative Popup" (creativepopup) up to version 1.6.9 from WebshopWorks for PrestaShop, a guest can perform

DM Concept configurator before v4.9.4 was discovered to contain a SQL injection vulnerability via the component Configur

The affected product is vulnerable to an exposure of sensitive information to an unauthorized actor vulnera

The affected product is vulnerable to a cross-site request forgery vulnerability, which may allow an attacker to pe

The affected product is vulnerable to an improper authentication vulnerability, which may allow an attacker to

The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which

The affected product is vulnerable to a cross-site scripting vulnerability, which could allow an attacker to access the

Santesoft Sante FFT Imaging lacks proper validation of user-supplied data when parsing DICOM files. This could lead

Sante DICOM Viewer Pro lacks proper validation of user-supplied data when parsing DICOM files. This could lead to an