2023

A missing authorization check in the MacOS agent configuration endpoint of the Insider Threat Management Server enables

A missing authorization check in multiple SOAP endpoints of the Insider Threat Management Server enables an attacker on

An insecure filesystem permission in the Insider Threat Management Agent for Windows enables local unprivileged users to

The CodeColorer WordPress plugin before 0.10.1 does not sanitise and escape some of its settings, which could allow high

The ERP WordPress plugin before 1.12.4 does not sanitise and escape the employee_name parameter before outputting it bac

The Ultimate Product Catalog WordPress plugin before 5.2.6 does not sanitise and escape some of its settings, which coul

The KiviCare WordPress plugin before 3.2.1 does not have proper CSRF and authorisation checks in various AJAX actions, a

The KiviCare WordPress plugin before 3.2.1 does not sanitise and escape a parameter before outputting it back in the pag

The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user

The wpbrutalai WordPress plugin before 2.0.1 does not sanitise and escape a parameter before outputting it back in the p

The AI Engine WordPress plugin before 1.6.83 does not sanitize and escape some of its settings, which could allow high-p

The Gravity Forms Google Sheet Connector WordPress plugin before 1.3.5, gsheetconnector-gravityforms-pro WordPress plugi

The Aajoda Testimonials WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could all

The Accordion & FAQ WordPress plugin before 1.9.9 does not escape various generated URLs, before outputting them in attr

The USM-Premium WordPress plugin before 16.3 does not sanitize and escape some of its settings, which could allow high-p

The Kanban Boards for WordPress plugin before 2.5.21 does not sanitise and escape some of its settings, which could allo

The Catalyst Connect Zoho CRM Client Portal WordPress plugin before 2.1.0 does not sanitize and escape a parameter befor

The Editorial Calendar WordPress plugin before 3.8.3 does not sanitise and escape its settings, allowing users with role

Incorrect access control in the component /index.php?mod=system&op=orgtree of dzzoffice 2.02.1_SC_UTF8 allows unauthenti

A reflected cross-site scripting (XSS) vulnerability in the zero parameter of dzzoffice 2.02.1_SC_UTF8 allows attackers

Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Ap

The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Stored Cro

The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Cross-Site

The MainWP Child plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including,

The EmbedPress plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on t

DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. In af

Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site s

Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site s

A link following vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker

An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticate

An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticate

Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site s

Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site s

Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks

Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks

Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks

Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks

Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks

Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains widget vulnerabilities that could allow a remote attacker to c

Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains widget vulnerabilities that could allow a remote attacker to c

A privilege escalation vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local att

DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. Affec

OPenFGA is an open source authorization/permission engine built for developers. OpenFGA versions v1.1.0 and prior are vu

A valid, authenticated LXCA user with elevated privileges may be able to delete folders in the LXCA filesystem through a

A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically

BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn. In affected versio

A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API ca

A potential vulnerability in the LenovoFlashDeviceInterface SMI handler may allow an attacker with local access and elev

Cross Site Scripting (XSS) vulnerability in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev4 allows remote attackers t

Cross Site Scripting vulnerabiltiy in eZ Systems AS eZPublish Platform v.5.4 and eZ Publish Legacy v.5.4 allows a remote