2023

When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. At

IPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt is made. Attackers wit

Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same con

The WP Sticky Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including,

Missing permission checks in Jenkins Team Concert Plugin 2.4.1 and earlier allow attackers with Overall/Read permission

SUBNET PowerSYSTEM Center versions 2020 U10 and prior contain a cross-site scripting vulnerability that may allow an at

SUBNET PowerSYSTEM Center versions 2020 U10 and prior are vulnerable to replay attacks which may result in a denial-o

A flaw was found in the IPv6 module of the Linux kernel. The arg.result was not used consistently in fib6_rule_lookup, s

PyBB is an open source bulletin board. A manual code review of the PyBB bulletin board server has revealed that a vulner

Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-par

Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-par

Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-par

Vulnerability of services denied by early fingerprint APIs on HarmonyOS products.Successful exploitation of this vulnera

Vulnerability of unauthorized access to foreground app information.Successful exploitation of this vulnerability may cau

Vulnerability of missing authentication on certain HUAWEI phones.Successful exploitation of this vulnerability can lead

Vulnerability of bypassing the default desktop security controls.Successful exploitation of this vulnerability may cause

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Seed Webs Seed Fonts plugin <= 2.3.1 versions.

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Beplus Sermon'e – Sermons Online plugin <= 1.0.0

Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Project Manager plugin <= 3.3.93 versions.

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gVectors Display Custom Fields – wpView plugin <= 1.3.

A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path tha

When choosing a site-isolated process for a document loaded from a data: URL that was the result of a redirect, Firefox

The Google Map Shortcode WordPress plugin through 3.1.2 does not validate and escape some of its shortcode attributes be

The Ultimate Dashboard WordPress plugin before 3.7.6 does not sanitise and escape some of its settings, which could allo

The AI ChatBot WordPress plugin before 4.5.6 does not sanitise and escape numerous of its settings, which could allow hi

The Social Share, Social Login and Social Comments WordPress plugin before 7.13.52 does not sanitise and escape a parame

The Upload Resume WordPress plugin through 1.2.0 does not validate the captcha parameter when uploading a resume via the

The AI ChatBot WordPress plugin before 4.5.5 does not sanitize and escape its settings, allowing high-privilege users su

The File Renaming on Upload WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could

The Conditional Menus WordPress plugin before 1.2.1 does not escape a parameter before outputting it back in an attribut

The Custom Base Terms WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, which could allow

The Integration for Contact Form 7 and Zoho CRM, Bigin WordPress plugin before 1.2.4 does not properly sanitise and esca

The QuBot WordPress plugin before 1.1.6 does not sanitise and escape some of its settings, which could allow high privil

The QuBot WordPress plugin before 1.1.6 doesn't filter user input on chat, leading to bad code inserted on it be reflect

When recording the screen while in Private Browsing on Firefox for Android the address bar and keyboard were not hidden,

Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable n

The SlideOnline WordPress plugin through 1.2.1 does not validate and escape some of its shortcode attributes before outp

The Responsive Tabs For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.1 does not validate

Documents were incorrectly assuming an ordering of principal objects when ensuring we were loading an appropriately priv

Service workers could reveal script base URL due to dynamic `import()`. This vulnerability affects Firefox < 113.

A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service

In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations. This vulnerabi

In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master passwo

libcoap 4.3.1 contains a buffer over-read via the function coap_parse_oscore_conf_mem at coap_oscore.c.

A stored cross-site scripting (XSS) vulnerability in Eyoucms v1.6.2 allows attackers to execute arbitrary web scripts or

_joinPath in elFinderVolumeLocalFileSystem.class.php in elFinder before 2.1.62 allows path traversal in the PHP LocalVol

A vulnerability, which was classified as critical, has been found in code-projects Agro-School Management System 1.0. Af

A vulnerability classified as problematic has been found in whaleal IceFrog 1.1.8. Affected is an unknown function of th

A vulnerability was found in miniCal 1.0.0. It has been rated as critical. This issue affects some unknown processing of

OpenZeppelin Contracts is a library for smart contract development. Starting in version 4.7.0 and prior to version 4.9.2