2023

Technicolor TG670 10.5.N.9 devices contain multiple accounts with hard-coded passwords. One account has administrative p

Lack of device control over web requests in ekorCCP and ekorRCI, allowing an attacker to create customised requests to e

SQL injection vulnerability in Arconte Áurea, in its 1.5.0.0 version. The exploitation of this vulnerability could allow

Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Flink Stateful Functions 3.1.0, 3.1.1 and 3.2.0 allo

An authenticated user can see and modify the value for ‘next’ query parameter in Symantec Identity Portal 14.4

Devices ekorCCP and ekorRCI are vulnerable due to access to the FTP service using default credentials. Exploitation of t

Vulnerability in ekorCCP and ekorRCI that could allow an attacker with access to the network where the device is located

Uncontrolled resource consumption in ekorRCI, allowing an attacker with low-privileged access to the web server to send

Operating system command injection in ekorCCP and ekorRCI, which could allow an authenticated attacker to execute comman

Exposure of sensitive information in ekorCCP and ekorRCI, potentially allowing a remote attacker to obtain critical info

Incorrect authorisation in ekorCCP and ekorRCI, which could allow a remote attacker to obtain resources with sensitive i

A Denial of Service (Dos) vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain

A SQL Injection vulnerability has been found in Nozomi Networks Guardian and CMC, due to improper input validation in ce

A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields us

A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to K3s s

A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-welcome allows local attackers to execute

The vulnerability exists in Uniview IP Camera due to identification and authentication failure at its web-based manageme

A SQL injection in the flutter_downloader component through 1.11.1 for iOS allows remote attackers to steal session toke

An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.2.7, all versions startin

The Super Store Finder plugin for WordPress is vulnerable to unauthenticated arbitrary email creation and relay in versi

Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API. Th

Cross Site Scripting vulnerability in xdsoft.net Jodit Editor v.4.0.0-beta.86 allows a remote attacker to obtain sensiti

Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.1.

An issue in the component /common/DownController.java of JFinalCMS v5.0.0 allows attackers to execute a directory traver

NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action fro

SpringBlade <=V3.6.0 is vulnerable to Incorrect Access Control due to incorrect configuration in the default gateway res

SQL Injection vulnerability in SearchTextBox parameter in Fortra (Formerly HelpSystems) DeliverNow before version 1.2.18

SQLpage is a SQL-only webapp builder. Someone using SQLpage versions prior to 0.11.1, whose SQLpage instance is exposed

Pow is a authentication and user management solution for Phoenix and Plug-based apps. Starting in version 1.0.14 and pri

SQL injection vulnerability in Novel-Plus v.4.1.0 allows a remote attacker to execute arbitrary code via a crafted scrip

An information leak in Coffee-jumbo v13.6.1 allows attackers to obtain the channel access token and send crafted message

An information leak in youmart-tokunaga v13.6.1 allows attackers to obtain the channel access token and send crafted mes

An information leak in TonTon-Tei_waiting Line v13.6.1 allows attackers to obtain the channel access token and send craf

Cross Site Scripting (XSS) vulnerability in Neos CMS 8.3.3 allows a remote authenticated attacker to execute arbitrary c

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In version 0.3.9 and prior, under ce

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Starting in version 0.2.9 and prior

The web application that owns the device clearly stores the credentials within the user management sectio

Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the

An information leak in THE_B_members card v13.6.1 allows attackers to obtain the channel access token and send crafted m

An information leak in YKC Tokushima_awayokocho Line v13.6.1 allows attackers to obtain the channel access token and sen

An information leak in Cheese Cafe Line v13.6.1 allows attackers to obtain the channel access token and send crafted mes

An information leak in Camp Style Project Line v13.6.1 allows attackers to obtain the channel access token and send craf

Persistent cross-site scripting (XSS) in the web application of MOD3GP-SY-120K allows an authenticated remote a

A potential attacker with or without (cookie theft) access to the device would be able to include malic

Sending some requests in the web application of the vulnerable device allows information to be obtained due to the lack

Session management within the web application is incorrect and allows attackers to steal session cookies to p

The absence of filters when loading some sections in the web application of the vulnerable device allows po

A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute

Hard-coded credentials in Juplink RX4-1500 versions V1.0.2 through V1.0.5 allow unauthenticated attackers to log in to t

A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has