2023

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer on

Use After Free (UAF) vulnerability in ireader media-server before commit 3e0f63f1d3553f75c7d4eb32fa7c7a1976a9ff84 in lib

An issue was discovered in NiterForum version 2.5.0-beta in /src/main/java/cn/niter/forum/api/SsoApi.java and /src/main/

SQL Injection vulnerability in Ehoney version 2.0.0 in models/protocol.go and models/images.go, allows attackers to exec

SQL Injection vulnerability in rttys versions 4.0.0, 4.0.1, 4.0.2, and 4.4.x in api.go, allows attackers to execute arbi

SQL Injection vulnerability in dataease before 1.2.0, allows attackers to gain sensitive information via the orders para

SQL Injection vulnerability in SEO Panel 4.9.0 in api/user.api.php in function getUserName in the username parameter, al

Information Disclosure in Authentication Component of ScreenCheck BadgeMaker 2.6.2.0 application allows internal attacke

ASUS EC Tool driver (aka d.sys) 1beb15c90dcf7a5234ed077833a0a3e900969b60be1d04fcebce0a9f8994bdbb, as signed by ASUS and

An uspecified endpoint in the web server of the switch does not properly authenticate the user identity, and may allow d

SolarWinds Platform version 2022.4.1 was found to be susceptible to the Deserialization of Untrusted Data. This vulnerab

Media CP Media Control Panel latest version. Reflected XSS possible through unspecified endpoint.

Media CP Media Control Panel latest version. A Permissive Flash Cross-domain Policy may allow information disclosure.

Customers who had configured their polling to occur via Kerberos did not expect NTLM Traffic on their environment, but s

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversa

SolarWinds Platform was susceptible to the Directory Traversal Vulnerability. This vulnerability allows a local adversar

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversa

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversa

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversa

LS ELECTRIC XBC-DN32U with operating system version 01.80 transmits sensitive information in cleartext when communicatin

LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication to perform critical functions to the

A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can

If an attacker were to access memory locations of LS ELECTRIC XBC-DN32U with operating system version 01.80 that are out

Starlite is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 1.5.2, the request body parsing

AMI MegaRAC SPX devices allow Password Disclosure through Redfish. The fixed versions are SPx_12-update-7.00 and SPx_13-

Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it e

Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it e

A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allo

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the FvbServicesRuntimeDxe shared

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the VariableRuntimeDxe shared bu

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the PnpSmm shared buffer used by

An Incorrect Default Permissions vulnerability in saphanabootstrap-formula of SUSE Linux Enterprise Module for SAP Appli

Improper Privilege Management vulnerability in Apache Software Foundation Apache ShenYu. ShenYu Admin allows low-privi

PC settings tool Ver10.1.26.0 and earlier, PC settings tool Ver11.0.22.0 and earlier allows a attacker to write to the r

Stored cross-site scripting vulnerability in the Create event section in Pandora FMS Console v766 and lower. An attacker

In permissions of AndroidManifest.xml, there is a possible way to grant signature permissions due to a permissions bypas

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the SdHostDriver buffer used by

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the AhciBusDxe shared buffer use

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the HddPassword shared buffer us

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the FwBlockServiceSmm shared buf

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the NvmExpressDxe buffer used by

An issue was discovered in Insyde InsydeH2O with kernel 5.1 through 5.5. DMA attacks on the SdMmcDevice buffer used by S

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the IdeBusDxe shared buffer used

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the StorageSecurityCommandDxe sh

An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. The IhisiDxe driver uses the comman

An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4

Improper restriction of XML external entity reference (XXE) vulnerability exists in tsClinical Define.xml Generator all

Untrusted search path vulnerability in ELECOM Camera Assistant 1.00 and QuickFileDealer Ver.1.2.1 and earlier allows an

LexisNexis Firco Compliance Link 3.7 allows CSRF.

Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, when `g