2023

Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the admin search find API h

H2O is an HTTP server. In versions 2.3.0-beta2 and prior, when the reverse proxy handler tries to processes a certain ty

IBM Watson Machine Learning on Cloud Pak for Data 4.0 and 4.5 is vulnerable to server-side request forgery (SSRF). This

IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of serv

SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.21.

Unquoted service Path or Element vulnerability in 42Gears Surelock Windows SureLock Service (NixService.Exe) on Windows

The sensitive information exposure vulnerability in the CGI “Export_Log” and the binary “zcmd” in Zyxel DX5401-B0 firmwa

An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. Password reset links are sent by email. A link

SUNNET CTMS has vulnerability of path traversal within its file uploading function. An authenticated remote attacker wit

An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppUp

An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppUp

An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppDM

An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The decry

Incorrect access control in the runReport function of MyQ Solution Print Server before 8.2 Patch 32 and Central Server b

ESPv2 is a service proxy that provides API management capabilities using Google Service Infrastructure. ESPv2 2.20.0 thr

Payload is a free and open source headless content management system. In versions prior to 1.7.0, if a user has access t

Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine

Insecure Permission vulnerability found in Wondershare Dr.Fone v.12.9.6 allows a remote attacker to escalate privileges

Buffer Overflow vulnerability found in ByronKnoll Cmix v.19 allows an attacker to execute arbitrary code and cause a den

HCL Workload Automation 9.4, 9.5, and 10.1 are vulnerable to an XML External Entity Injection (XXE) attack when processi

Sangoma FreePBX 1805 through 2302 (when obtained as a ,.ISO file) places AMPDBUSER, AMPDBPASS, AMPMGRUSER, and AMPMGRPAS

Denial of service due to unauthenticated API endpoint. The following products are affected: Acronis Agent (Windows, macO

libming 0.4.8 0.4.8 is vulnerable to Buffer Overflow. In getInt() in decompile.c unknown type may lead to denial of serv

Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to arbitrarily reset passwords via a

Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading a

CLTPHP <=6.0 is vulnerable to Improper Input Validation via application/admin/controller/Template.php.

CLTPHP <=6.0 is vulnerable to Unrestricted Upload of File with Dangerous Type.

Medicine Tracker System in PHP 1.0.0 is vulnerable to SQL Injection.

In some situations, the Image module does not correctly check access to image files not stored in the standard public fi

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to impro

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to remote code exec

IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX runtim

IBM Spectrum Scale (IBM Spectrum Scale Container Native Storage Access 5.1.2.1 through 5.1.6.0) could allow programs ru

IBM Cloud Pak for Data 4.5 and 4.6 could allow a privileged user to upload malicious files of dangerous types that can

blackbox_exporter v0.23.0 was discovered to contain an access control issue in its probe interface. This vulnerability a

Dradis before 4.8.0 allows persistent XSS by authenticated author users, related to avatars.

VMware Workstation (17.x) and VMware Fusion (13.x) contain a stack-based buffer-overflow vulnerability that exists in th

Apptainer is an open source container platform for Linux. There is an ext4 use-after-free flaw that is exploitable throu

Git for Windows is the Windows port of Git. Prior to version 2.40.1, any user of Git CMD who starts the command in an un

Git for Windows, the Windows port of Git, ships with an executable called `connect.exe`, which implements a SOCKS5 proxy

Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38

On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a

VMware Workstation and Fusion contain an out-of-bounds read/write vulnerability in SCSI CD/DVD device emulation.

VMware Fusion contains a local privilege escalation vulnerability. A malicious actor with read/write access to the host

Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38

PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, the `ValidateCore::isClean

An HPE OneView appliance dump may expose FTP credentials for c7000 Interconnect Modules

An HPE OneView appliance dump may expose SAN switch administrative credentials

PWS Personal Weather Station Dashboard (PWS_Dashboard) LTS December 2020 (2012_lts) allows remote code execution by inje

PingID Desktop prior to the latest released version 1.7.4 contains a vulnerability that can be exploited to bypass the m