2023

There exists a privilege escalation vulnerability in SmartBear Zephyr Enterprise through 7.15.0 that could be exploited

SmartBear Zephyr Enterprise through 7.15.0 allows unauthenticated users to upload large files, which could exhaust the l

Multiplication of certain unreduced P-256 scalars produce incorrect results. There are no protocols known at this time t

xCAT is a toolkit for deployment and administration of computer clusters. In versions prior to 2.16.5 if zones are confi

onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/curd/code.

A vulnerability, which was classified as critical, was found in kylin-system-updater up to 1.4.20kord on Ubuntu Kylin. A

An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operat

feiqu-opensource Background Vertical authorization vulnerability exists in IndexController.java. demo users with low per

The webutils in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows an authenticated user to

OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards,

Use after free in Core in Google Chrome on Lacros prior to 111.0.5563.64 allowed a remote attacker who convinced a user

Heap buffer overflow in Web Audio API in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially e

Heap buffer overflow in UMA in Google Chrome prior to 111.0.5563.64 allowed a remote attacker who had compromised the re

Heap buffer overflow in Metrics in Google Chrome prior to 111.0.5563.64 allowed a remote attacker who had compromised th

Use after free in WebRTC in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap c

Use after free in DevTools in Google Chrome prior to 111.0.5563.64 allowed a remote attacker who had convienced the user

Type confusion in CSS in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corr

Type confusion in V8 in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corru

Use after free in Swiftshader in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit h

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected ver

Goutil is a collection of miscellaneous functionality for the go language. In versions prior to 0.6.0 when users use fsu

A improper access control vulnerability in Fortinet FortiSOAR 7.3.0 - 7.3.1 allows an attacker authenticated on the admi

CRMEB <=1.3.4 is vulnerable to SQL Injection via /api/admin/user/list.

An attacker with physical access to the affected Moxa UC Series devices can initiate a restart of the device and gain ac

A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 an

An uncontrolled resource consumption vulnerability [CWE-400] in FortiRecorder version 6.4.3 and below, 6.0.11 and below

A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC versions 9.4

A improper privilege management in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.6,

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb versio

HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server:

A vulnerability, which was classified as critical, was found in SourceCodester Health Center Patient Record Management S

The Plus Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in versions up to, and includin

The Envato Elements & Download and Template Kit – Import plugins for WordPress are vulnerable to arbitrary file uploads

The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to Cross-Site Request Forgery in version

Uncontrolled search path element vulnerability exists in pg_ivm versions prior to 1.5.1. When refreshing an IMMV, pg_ivm

SQL Injection in GitHub repository phpipam/phpipam prior to v1.5.2.

rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.

A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string,

The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!=

A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in the way the first gru_file_unlocked_ioctl functi

A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead

Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987, ServiceDesk Plus MSP before 14000, and Su

AgileBio Electronic Lab Notebook v4.234 was discovered to contain a local file inclusion vulnerability.

Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third p

In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictio

In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion de

In the module "Xen Forum" (xenforum) for PrestaShop, an authenticated user can perform SQL injection in versions up to 2

quickentity-editor-next is an open source, system local, video game asset editor. In affected versions HTML tags in ent

Directus is a real-time API and App dashboard for managing SQL database content. Instances relying on an allow-listed re

An issue in Prism Launcher up to v6.1 allows attackers to perform a directory traversal via importing a crafted .mrpack