2023

Xibo is a content management system (CMS). An SQL injection vulnerability was discovered starting in version 3.2.0 and p

At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’

Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the `/dataset/data/{id}` API

Avaya IX Workforce Engagement v15.2.7.1195 - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

Avaya IX Workforce Engagement v15.2.7.1195 - CWE-522: Insufficiently Protected Credentials

Avaya IX Workforce Engagement v15.2.7.1195 - User Enumeration - Observable Response Discrepancy

ROZCOM client CWE-798: Use of Hard-coded Credentials

An issue found in edjing Mix v.7.09.01 for Android allows a local attacker to cause a denial of service via the database

A user can supply malicious HTML and JavaScript code that will be executed in the client browser

Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control: authenticated users can read sensitive i

An issue discovered in Action Launcher for Android v50.5 allows an attacker to cause a denial of service via arbitary da

Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs. For Contr

Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 suffers from Multiple Stored Cross-Site Scripti

Shop Beat Solutions (pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Directory Traversal via server

MeterSphere is an open source continuous testing platform. Version 2.9.1 and prior are vulnerable to denial of service.

A vulnerability exists in a FOXMAN-UN and UNEM logging component, it only affects systems that use remote authentication

A memory leak vulnerability exists in NanoMQ 0.17.2. The vulnerability is located in the file message.c. An attacker cou

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior t

An issue found in Wave Animated Keyboard Emoji v.1.70.7 for Android allows a local attacker to cause a denial of service

RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process

An issue was discovered in Joomla! 4.2.0 through 4.3.1. Lack of input validation caused an open redirect and XSS issue w

Missing Authentication for Critical Function vulnerability in Honeywell OneWireless allows Authentication Bypass. This i

An attacker having physical access to WDM can plug USB device to gain access and execute unwanted commands. A malicious

Use of Insufficiently Random Values in Honeywell OneWireless. This vulnerability may allow attacker to manipulate claim

PowerPath for Windows, versions 7.0, 7.1 & 7.2 contains License Key Stored in Cleartext vulnerability. A local user wit

PowerPath for Windows, versions 7.0, 7.1 & 7.2 contains DLL Hijacking Vulnerabilities. A regular user (non-admin) can e

Dell NetWorker, contains an Improper Validation of Certificate with Host Mismatch vulnerability in Rabbitmq port which

VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. An unauthenticated m

A vulnerability classified as critical was found in Abstrium Pydio Cells 4.2.0. This vulnerability affects unknown code

A vulnerability classified as critical has been found in Abstrium Pydio Cells 4.2.0. This affects an unknown part of the

A vulnerability was found in Abstrium Pydio Cells 4.2.0. It has been rated as problematic. Affected by this issue is som

Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Imp

The privilege escalation vulnerability in the Zyxel GS1900-8 firmware version V2.70(AAHH.3) and the GS1900-8HP firmwar

The Easy Forms for Mailchimp WordPress plugin before 6.8.9 does not sanitise and escape a parameter before outputting it

The Add to Feedly WordPress plugin through 1.2.11 does not sanitize and escape its settings, allowing high-privilege use

The Loginizer WordPress plugin before 1.7.9 does not escape a parameter before outputting it back in the page, leading t

The Orbit Fox by ThemeIsle WordPress plugin before 2.10.24 does not limit URLs which may be used for the stock photo imp

The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.7 does not sanitize and escape some URL paramet

The Login rebuilder WordPress plugin before 2.8.1 does not sanitise and escape some of its settings, which could allow h

The Autoptimize WordPress plugin before 3.1.7 does not sanitise and escape the settings imported from a previous export,

The Fast & Effective Popups & Lead-Generation for WordPress plugin before 2.1.4 concatenates user input into an SQL quer

The Custom 404 Pro WordPress plugin before 3.7.3 does not escape some URLs before outputting them in attributes, leading

The Download Manager WordPress plugin before 3.2.71 does not adequately validate passwords for password-protected files.

The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow u

The AnyWhere Elementor WordPress plugin before 1.2.8 discloses a Freemius Secret Key which could be used by an attacker

The OSM WordPress plugin through 6.01 does not validate and escape some of its shortcode attributes, which could allow u

Minio Console is the UI for MinIO Object Storage. Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the orig

Kyverno is a policy engine designed for Kubernetes. Kyverno seccomp control can be circumvented. Users of the podSecurit

tgstation-server is a production scale tool for BYOND server management. The DreamMaker API (DMAPI) chat channel cache c

Kanboard is project management software that focuses on the Kanban methodology. Due to improper handling of elements und