2023

An issue has been discovered in GitLab affecting all versions starting from 11.2 before 16.2.8, all versions starting fr

Denial of Service in pipelines affecting all versions of Gitlab EE and CE prior to 16.2.8, 16.3 prior to 16.3.5, and 16.

A business logic error in GitLab EE affecting all versions prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4

An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior

An issue has been discovered in GitLab EE affecting all versions affecting all versions from 11.11 prior to 16.2.8, 16.3

An improper authorization issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.

An information disclosure issue in GitLab CE/EE affecting all versions starting from 13.11 prior to 16.2.8, 16.3 prior t

An issue was discovered in net/ceph/messenger_v2.c in the Linux kernel before 6.4.5. There is an integer signedness erro

Denial-of-service in NodeBB <= v2.8.10 allows unauthenticated attackers to trigger a crash, when invoking `eventName.sta

pretix before 2023.7.2 allows Pillow to parse EPS files.

All versions of the package ithewei/libhv are vulnerable to CRLF Injection when untrusted user input is used to set requ

All versions of the package ithewei/libhv are vulnerable to HTTP Response Splitting when untrusted user input is used to

All versions of the package ithewei/libhv are vulnerable to Cross-site Scripting (XSS) such that when a file with a name

The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditio

A Vault Enterprise Sentinel Role Governing Policy created by an operator to restrict access to resources in one namespac

TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper

Online Movie Ticket Booking System v1.0 is vulnerable to an authenticated Stored Cross-Site Scripting vulnerability.

The 'age' parameter of the process_registration.php resource does not validate the characters received and they are se

The 'Email' parameter of the process_login.php resource does not validate the characters received and they are sent un

The 'search' parameter of the process_search.php resource does not validate the characters received and they are sent

The 'bookisbn' parameter of the cart.php resource does not validate the characters received and they are sent unfilter

ShokoServer is a media server which specializes in organizing anime. In affected versions the `/api/Image/WithPath` endp

Asset Management System v1.0 is vulnerable to an Authenticated SQL Injection vulnerability on the 'first_name' and 'la

Gym Management System Project v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'file' parameter of p

Hospital management system version 378c157 allows to bypass authentication. This is possible because the application is

Hospital management system version 378c157 allows to bypass authentication. This is possible because the application is

Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating ema

Online Movie Ticket Booking System v1.0 is vulnerable to an authenticated Reflected Cross-Site Scripting vulnerability.

Online Book Store Project v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'image' parameter of admin_

Asset Management System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'email' parameter

Samsung Mobile Processor Exynos 2200 allows a GPU Double Free (issue 1 of 2).

mooSocial 3.1.8 is vulnerable to external service interaction on post function. When executed, the server sends a HTTP a

An arbitrary file upload vulnerability in dede/baidunews.php in DedeCMS 5.7.111 and earlier allows attackers to execute

In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause se

PrestaShop is an Open Source e-commerce web application. In the Prestashop Back office interface, an employee can list a

PrestaShop is an Open Source e-commerce web application. In affected versions any module can be disabled or uninstalled

discourse-encrypt is a plugin that provides a secure communication channel through Discourse. Improper escaping of encry

IBM License Metric Tool 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send

Integrated application server for IBM i 7.2, 7.3, 7.4, and 7.5 contains a local privilege escalation vulnerability. A m

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remo

Use after free in Extensions in Google Chrome prior to 117.0.5938.132 allowed an attacker who convinced a user to instal

Use after free in Passwords in Google Chrome prior to 117.0.5938.132 allowed a remote attacker who convinced a user to e

Sourcecodester Packers and Movers Management System v1.0 was discovered to contain a SQL injection vulnerability via the

A Cross-site scripting (XSS) vulnerability in Reference ID from the panel Transactions, of Subrion v4.2.1 allows attacke

Rite CMS 3.0 has a Cross-Site scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafte

Rite CMS 3.0 has Multiple Cross-Site scripting (XSS) vulnerabilities that allow attackers to execute arbitrary code via

A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an attacker to execute arbitrary w

A flaw was found in libnbd. A server can reply with a block size larger than 2^63 (the NBD spec states the size is a 64-

Multiple Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code

A Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a c