2023

SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, under certain condition a

SAP PowerDesigner Client - version 16.7, allows an unauthenticated attacker to inject VBScript code in a document and ha

SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization

The Crayon Syntax Highlighter plugin for WordPress is vulnerable to Server Side Request Forgery via the 'crayon' shortco

The JQuery Accordion Menu Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dcwp-jquery-acco

The Google Maps Plugin by Intergeo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'intergeo' shor

The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mappress' shortco

Due to insufficient file type validation, SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML inte

The Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, 107, 108, allows an a

The OData service of the S4 HANA (Manage checkbook apps) - versions 102, 103, 104, 105, 106, 107, allows an attacker to

Due to missing authentication check in webdynpro application, an unauthorized user in SAP NetWeaver (Guided Procedures)

SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a

Due to the lack of validation, SAP BusinessObjects Business Intelligence Platform (Version Management System) - version

The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnera

A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the

NVIDIA ConnectX Host Firmware for the BlueField Data Processing Unit contains a vulnerability where a restricted host m

SQL Injection in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.

Authentication Bypass by Primary Weakness in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.

The issue was addressed with improved handling of caches. This issue is fixed in tvOS 16.3, iOS 16.3 and iPadOS 16.3, ma

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Big Sur

This issue was addressed with improved state management of S/MIME encrypted emails. This issue is fixed in macOS Montere

An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privileges via Acti

Magento LTS is the official OpenMage LTS codebase. Guest orders may be viewed without authentication using a "guest-view

A reflected cross-site scripting (XSS) vulnerability in DevCode OpenSTAManager versions 2.4.24 to 2.4.47 may allow a rem

Relative Path Traversal in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.

In MtpPropertyValue of MtpProperty.h, there is a possible memory corruption due to a use after free. This could lead to

In avdt_msg_asmbl of avdt_msg.cc, there is a possible out of bounds write due to an integer overflow. This could lead to

In bindSelection of DatabaseUtils.java, there is a possible way to access files from other applications due to SQL injec

In hasPermissionForActivity of PackageManagerHelper.java, there is a possible way to start arbitrary components due to a

In eatt_l2cap_reconfig_completed of eatt_impl.h, there is a possible out of bounds write due to an integer overflow. Thi

In multiple locations, there is a possible way to import contacts belonging to other users due to a confused deputy. Thi

In MtpPropertyValue of MtpProperty.h, there is a possible out of bounds read due to uninitialized data. This could lead

In onCreate of DeviceAdminAdd.java, there is a possible way to forcibly add a device admin due to a missing permission c

In createQuickShareAction of SaveImageInBackgroundTask.java, there is a possible way to trigger a background activity la

In loadMediaResumptionControls of MediaResumeListener.kt, there is a possible way to play and listen to media files play

In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the cod

In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to an integer overflow. This could le

In onHostEmulationData of HostEmulationManager.java, there is a possible way for a general purpose NFC reader to read th

In computeValuesFromData of FileUtils.java, there is a possible way to insert files to other apps' external private dire

In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to control other running activ

In updateList of NotificationAccessSettings.java, there is a possible way to hide approved notification listeners in the

In bta_av_rc_msg of bta_av_act.cc, there is a possible use after free due to a logic error in the code. This could lead

In multiple files, there is a possible way to import a contact from another user due to a missing permission check. This

In convertSubgraphFromHAL of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. Th

In gatt_process_prep_write_rsp of gatt_cl.cc, there is a possible privilege escalation due to a use after free. This cou

A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This f

The Herd Effects WordPress plugin before 5.2.4 does not have CSRF when deleting its items, which could allow attackers t

The wpDataTables WordPress plugin before 2.1.66 does not validate the "Serialized PHP array" input data before deseriali

The Lock User Account WordPress plugin through 1.0.3 does not have CSRF check when bulk locking and unlocking accounts,

The URL Shortify WordPress plugin before 1.7.6 does not properly escape the value of the referer header, thus allowing a