2023

Directory Traversal vulnerability found in Pfsense v.2.1.3 and Pfsense Suricata v.1.4.6 pkg v.1.0.1 allows a remote atta

The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.js`

Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can c

Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large num

HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading t

The Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lock logging feature

SQL injection vulnerability found in Tailor Mangement System v.1 allows a remote attacker to execute arbitrary code via

SQL injection vulnerability found in Tailor Management System v.1 allows a remote attacker to execute arbitrary code via

SQL injection vulnerability found in Tailor Management System v.1 allows a remote attacker to execute arbitrary code via

SQL injection vulnerability found in Tailor Management System v.1 allows a remote authenticated attacker to execute arbi

Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer (MSI) of WA

Dell Trusted Device Agent, versions prior to 5.3.0, contain(s) an improper installation permissions vulnerability. An u

Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Event Manager plugin <= 9.7.4 versions.

An issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is an out-of-bounds write in bz3_decode_block.

Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2.

Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN

A vulnerability in the web-based management interface of Cisco Secure Network Analytics could allow an authenticated, re

A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network subcomponent in the Li

SQL Injection in the Hardware Inventory report of Security Center 5.11.2.

Ulearn version a5a7ca20de859051ea0470542844980a66dfc05d allows an attacker with administrator permissions to obtain remo

The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to

The Order GLPI plugin allows users to manage order management within GLPI. Starting with version 1.8.0 and prior to vers

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN

The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up t

GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.

Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

A heap-based buffer overflow vulnerability exists in the way Ichitaro version 2022 1.0.1.57600 processes certain LayoutB

An invalid free vulnerability exists in the Frame stream parser functionality of Ichitaro 2022 1.0.1.57600. A specially

An unprivileged (non-admin) user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for

A buffer overflow vulnerability exists in the Attribute Arena functionality of Ichitaro 2022 1.0.1.57600. A specially cr

A use-after-free vulnerability exists within the way Ichitaro Word Processor 2022, version 1.0.1.57600, processes protec

GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.

An arbitrary file upload vulnerability in /admin/ajax.php?action=save_uploads of Dynamic Transaction Queuing System v1.0

Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter a

ascii_load_sockaddr in smtpd in OpenBSD before 7.1 errata 024 and 7.2 before errata 020, and OpenSMTPD Portable before 7

markdown-pdf version 11.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible becau

VitalPBX version 3.2.3-8 allows an unauthenticated external attacker to obtain the instance administrator's account. Thi

SvelteKit is a web development framework. The SvelteKit framework offers developers an option to create simple REST APIs

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for aut

Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Ru

Heap buffer overflow in Browser History in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who convinced

Use after free in Vulkan in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to potentially exploit heap c

Use after free in Networking APIs in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who convinced a user

Out of bounds memory access in DOM Bindings in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to perform

Use after free in Frames in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who convinced a user to engag

Heap buffer overflow in Visuals in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who had compromised th

Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server. This is possible because

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3,

An unauthorized access issue found in XiaoBingby TeaCMS 2.3.3 allows attackers to escalate privileges via the id and key