2023

SQL injection vulnerability in janobe Online Job Portal v.2020 allows a remote attacker to execute arbitrary code via th

SQL injection vulnerability in janobe Online Job Portal v.2020 allows a remote attacker to execute arbitrary code via th

Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the function mjs_get_ptr().

D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection.

D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection due to lax filtering of

SQL injection vulnerbility in jeecgboot jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code

dst-admin v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the userId parameter at /h

An issue was discovered in Wind River VxWorks 6.9 and 7. The function ``tarExtract`` implements TAR file extraction and

TaxonWorks is a web-based workbench designed for taxonomists and biodiversity scientists. Prior to version 0.34.0, a SQL

The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Prior to p

Galaxy is an open-source platform for FAIR data analysis. Prior to version 22.05, Galaxy is vulnerable to server-side re

Command injection in homemng.htm in Juplink RX4-1500 versions V1.0.2, V1.0.3, V1.0.4, and V1.0.5 allows remote authentic

Command injection vulnerability in the homemng.htm endpoint in Juplink RX4-1500 Wifi router firmware versions V1.0.2, V1

Credential disclosure in the '/webs/userpasswd.htm' endpoint in Juplink RX4-1500 Wifi router firmware versions V1.0.4 an

aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version 0.10.3, in the AES

AutomataCI is a template git repository equipped with a native built-in semi-autonomous CI tools. An issue in versions 1

Projectworldsl Assets-management-system-in-php 1.0 is vulnerable to SQL Injection via the "id" parameter in delete.php.

An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displa

A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured manage

A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to ext

The fix for XSA-423 added logic to Linux'es netback driver to deal with a frontend splitting a packet in a way such that

A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the forem

The WP-Matomo Integration (WP-Piwik) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wp-piwik

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shor

Plesk Onyx 17.8.11 has accessKeyId and secretAccessKey fields that are related to an Amazon AWS Firehose component. NOTE

Cadence through 0.9.2 2023-08-21 uses an Insecure /tmp/cadence-wineasio.reg Temporary File. The filename is used even if

Cadence through 0.9.2 2023-08-21 uses an Insecure /tmp/.cadence-aloop-daemon.x Temporary File. The file is used even if

In nqptp-message-handlers.c in nqptp before 1.2.3, crafted packets received on the control port could crash the program.

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with craft

A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows

Certain WithSecure products allow Denial of Service via the aepack archive unpack handler. This affects WithSecure Clien

Certain WithSecure products allow Local privilege escalation via the lhz archive unpack handler. This affects WithSecure

Certain WithSecure products allow Denial of Service in the aeelf component. This affects WithSecure Client Security 15,

Certain WithSecure products allow XSS via an unvalidated parameter in the endpoint. This affects WithSecure Policy Manag

Certain WithSecure products allow Unauthenticated Remote Code Execution via the web server (backend). This affects WithS

Certain WithSecure products allow Denial of Service (infinite loop). This affects WithSecure Client Security 15, WithSec

Certain WithSecure products allow Denial of Service via a fuzzed PE32 file. This affects WithSecure Client Security 15,

A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating systems. If exploi

A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating system. If exploit

An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerabilit

FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin.

FUXA <= 1.1.12 is vulnerable to Local via Inclusion via /api/download.

A SQL Injection attack in FUXA <= 1.1.12 allows exfiltration of confidential information from the database.

FUXA <= 1.1.12 has a Local File Inclusion vulnerability via file=fuxa.log

Delta Electronics DIAScreen may write past the end of an allocated buffer while parsing a specially crafted input file.

Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are sus

D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection due to lax filtering of

A reflected cross-site scripting (XSS) vulnerability in the Search Student function of Student Management System v1.2.3

A stored cross-site scripting (XSS) vulnerability in the Add Animal Details function of Zoo Management System v1.0 allow

Mobile Security Framework (MobSF) <=v3.7.8 Beta is vulnerable to Insecure Permissions. NOTE: the vendor's position is th