2023

The 'LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login' extension is vulnerable to LDAP Inject

Zoho ManageEngine Exchange Reporter Plus before 5708 allows attackers to conduct XXE attacks.

A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory

IBM QRadar SIEM 7.4 and 7.5copies certificate key files used for SSL/TLS in the QRadar web user interface to managed ho

A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate privileges to root

A vulnerability was found in saemorris TheRadSystem and classified as critical. This issue affects the function redirect

In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the

In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an atta

A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach

NLnet Labs Krill supports direct access to the RRDP repository content through its built-in web server at the "/rrdp" en

Panasonic Sanyo CCTV Network Cameras versions 1.02-05 and 2.03-0x are vulnerable to CSRFs that can be exploited to allo

RONDS EPM version 1.19.5 has a vulnerability in which a function could allow unauthenticated users to leak credentials.

RONDS EPM version 1.19.5 does not properly validate the filename parameter, which could allow an unauthorized user to s

CX-Motion-MCH v2.32 and earlier contains an access of uninitialized pointer vulnerability. Having a user to open a speci

OS command injection vulnerability in PIX-RT100 versions RT100_TEQ_2.1.1_EQ101 and RT100_TEQ_2.1.2_EQ101 allows a networ

Cross-site request forgery (CSRF) vulnerability in MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PB

MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, an

ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a

ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a

A vulnerability was found in SourceCodester Online Food Ordering System 2.0. It has been classified as critical. Affecte

An issue was discovered in the Arm Mali GPU Kernel Driver. There is a use-after-free. A non-privileged user can make imp

Fuji Electric Tellus Lite V-Simulator versions 4.0.12.0 and prior are vulnerable to an out-of-bounds write which may al

The Conditional Payment Methods for WooCommerce WordPress plugin through 1.0 does not properly sanitise and escape a par

Trusted Firmware-A through 2.8 has an out-of-bounds read in the X.509 parser for parsing boot certificates. This affects

A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. Aff

Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue a

In multiple versions of HIMA PC based Software an unquoted Windows search path vulnerability might allow local users to

Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8.

BlueCat Device Registration Portal 2.2 allows XXE attacks that exfiltrate single-line files. A single-line file might co

Mercedes-Benz XENTRY Retail Data Storage 7.8.1 allows remote attackers to cause a denial of service (device restart) via

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository radareorg/r

When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an auth

Tiki before 24.2 allows lib/importer/tikiimporter_blog_wordpress.php PHP Object Injection by an admin because of an unse

Tiki before 24.1, when the Spreadsheets feature is enabled, allows lib/sheet/grid.php PHP Object Injection because of an

Tiki before 24.1, when feature_create_webhelp is enabled, allows lib/structures/structlib.php PHP Object Injection becau

Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. An attacker with the abili

KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate productio

KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. T

Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that en

APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j that provides hundreds of procedures and functions. A

A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP reque

Hospital Management System v1.0 is vulnerable to SQL Injection. Attackers can gain administrator privileges without the

Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds write vulnerability that c

Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by an Improper Input Validation vulnerability

Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds write vulnerability that c

Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability

Authenticated mail users, under specific circumstances, could add files with unsanitized content in public folders where

Under some circumstances an Insufficiently Protected Credentials vulnerability in Johnson Controls Metasys ADS/ADX/OAS 1

Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds write vulnerability that

Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds write vulnerability that