2023

A missing nullptr-check in handle_ra_input can cause a nullptr-deref.

An authenticated administrator is able to prepare an alert that is able to execute an SSRF attack. This is exclusively w

SmartBPM.NET component has a vulnerability of path traversal within its file download function. An unauthenticated remot

Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.10.

A Cross-Site Scripting (XSS) vulnerability found in UniFi Network (Version 7.3.83 and earlier) allows a malicious actor

A vulnerability in the web interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct

A vulnerability in the web interface of Cisco Webex Meetings could allow an authenticated, remote attacker to conduct a

IBM Cloud Object System 3.15.8.97 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed

The Online Examination System Project 1.0 version is vulnerable to Cross-Site Request Forgery (CSRF) attacks. An attacke

A null pointer dereference was found in libpano13, version libpano13-2.9.20. The flow allows attackers to cause a denial

Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the classes/usergroups managemen

Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the skills wheel.

Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the session category management

Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the extra fields management sect

Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the careers & promotions managem

Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the course categories' definitio

Chamilo 1.11.x up to 1.11.20 allows users with an admin privilege account to insert XSS in the languages management sect

A Cross-site scripting (XSS) vulnerability in the content editor in Gis3W g3w-suite 3.5 allows remote authenticated user

Zoho ManageEngine ADAudit Plus before 7100 allows XSS via the username field.

Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300

A vulnerability was found in SourceCodester Shopping Website 1.0. It has been classified as critical. Affected is an unk

The Site Kit by Google plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and inc

Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon. A malicious attacker can

Cross-site Scripting (XSS) - Stored in GitHub repository outline/outline prior to 0.70.1.

IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security, caused by the improper encodin

PiiGAB M-Bus stores credentials in a plaintext file, which could allow a low-level user to gain admin credentia

Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2,

The number of login attempts is not limited. This could allow an attacker to perform a brute force on HTTP basic auth

Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.10.

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 2.6.0 and prior to versi

yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external down

A vulnerability classified as problematic has been found in Rotem Dynamics Rotem CRM up to 20230729. This affects an unk

A vulnerability was found in ThinuTech ThinuCMS 1.5. It has been rated as critical. Affected by this issue is some unkno

ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting (XSS) vulnerability that was

An issue was discovered in the Linux kernel through 6.4.2. A crafted UDF filesystem image causes a use-after-free write

An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in r

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files,

A stored cross-site scripting (XSS) vulnerability in the Basic Website Information module of eyoucms v1.6.3 allows attac

A stored cross-site scripting (XSS) vulnerability in the Image Upload module of eyoucms v1.6.3 allows attackers to execu

A stored cross-site scripting (XSS) vulnerability in the Basic Information module of eyoucms v1.6.3 allows attackers to

A stored cross-site scripting (XSS) vulnerability in the Column management module of eyoucms v1.6.3 allows attackers to

A stored cross-site scripting (XSS) vulnerability in the custom variables module of eyoucms v1.6.3 allows attackers to e

A Cross-Site Request Forgery (CSRF) in the component /public/admin/profile/update.html of YznCMS v1.1.0 allows attackers

A stored cross-site scripting (XSS) vulnerability in the Management Custom label module of SEACMS v12.1 allows attackers

A stored cross-site scripting (XSS) vulnerability in the Site Setup module of SEACMS v12.1 allows attackers to execute a

A stored cross-site scripting (XSS) vulnerability in Bagecms v3.1.0 allows attackers to execute arbitrary web scripts or

A Cross-site scripting (XSS) vulnerability in CMS Made Simple v2.2.17 allows remote attackers to inject arbitrary web sc

Novu provides an API for sending notifications through multiple channels. Versions prior to 0.16.0 contain an open redir

Cross Site Scripting (XSS) vulnerability in username field in /WebContent/WEB-INF/lib/chatbox.jsp in wliang6 ChatEngine

Cross Site Scripting (XSS) vulnerability in username field in /src/chatbotapp/chatWindow.java in Payatu ChatEngine v.1.0