2023

A Stored Cross Site Scripting (XSS) vulnerability exists in multiple pages of Hotel Druid version 3.0.4, which allows ar

Inappropriate implementation in PictureInPicture in Google Chrome prior to 113.0.5672.63 allowed a remote attacker who h

Inappropriate implementation in Prompts in Google Chrome on Android prior to 113.0.5672.63 allowed a remote attacker to

Inappropriate implementation in Prompts in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to spoof the c

Inappropriate implementation in CORS in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to leak cross-ori

Inappropriate implementation in PictureInPicture in Google Chrome prior to 113.0.5672.63 allowed an attacker who convinc

Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 113.0.5672.63 allowed a remote att

Inappropriate implementation in Prompts in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to obfuscate m

Inappropriate implementation in Prompts in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to bypass perm

Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environm

The parameters nutzer_titel, nutzer_vn, and nutzer_nn in the user profile, and langID and ONLINEID in direct links, in e

The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external Wiki

The vulnerability was found Moodle which exists because the application allows a user to control path of the older to cr

A Stored cross-site scripting vulnerability in Jedox 2020.2.5 allows remote, authenticated users to inject arbitrary web

Improper Access Control in /tc/rpc in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to view details of dat

RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.

Zammad 5.3.x (Fixed in 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker with agent and custom

Zammad 5.3.x (Fixed 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker could gain information a

Improper access control in Subscriptions Folder path filter in Devolutions Server 2023.1.1 and earlier allows attackers

A vulnerability has been found in Rebuild 3.2 and classified as problematic. This vulnerability affects unknown code. Th

A vulnerability was found in Dreamer CMS up to 4.1.3. It has been declared as problematic. This vulnerability affects th

A Cross-site scripting (XSS) vulnerability in the System Log/General Log page of the administrator web UI in ASUS RT-AC5

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Winwar Media WP Email Capture plugin <= 3.9.3 versions

Transmission of credentials within query parameters in Checkmk <= 2.1.0p26, <= 2.0.0p35, and <= 2.2.0b6 (beta) may cause

Mattermost Desktop App fails to validate a mattermost server redirection and navigates to an arbitrary website

The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are alrea

The Limit Login Attempts WordPress plugin through 1.7.2 does not sanitize and escape usernames when outputting them back

The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the page parameter

The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the edit parameter

The WP Custom Author URL WordPress plugin before 1.0.5 does not sanitise and escape some of its settings, which could al

The Quick Paypal Payments WordPress plugin before 5.7.26.4 does not sanitise and escape some of its settings, which coul

The MyCryptoCheckout WordPress plugin before 2.124 does not escape some URLs before outputting them in attributes, leadi

The Site Reviews WordPress plugin before 6.7.1 does not sanitise and escape some of its settings, which could allow high

The Ruby Help Desk WordPress plugin before 1.3.4 does not ensure that the ticket being modified belongs to the user maki

The SMTP Mailing Queue WordPress plugin before 2.0.1 does not sanitise and escape some of its settings, which could allo

The amr ical events lists WordPress plugin through 6.6 does not sanitise and escape some of its settings, which could al

The StagTools WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputt

Memory corruption due to improper validation of array index in computer vision while testing EVA kernel without sending

In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function

Cleartext Transmission in cookie:ecos_pw: in Tenda N301 v6.0, firmware v12.03.01.06_pt allows an authenticated attacker

Cleartext Transmission in set-cookie:ecos_pw: Tenda N301 v6.0, Firmware v12.02.01.61_multi allows an authenticated attac

An issue was discovered in KaiOS 3.0. The pre-installed Communications application exposes a Web Activity that returns t

An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio an

An issue discovered in Konga 0.14.9 allows remote attackers to manipulate user accounts regardless of privilege via craf

A buffer overflow vulnerability in the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remot

A format string vulnerability in a binary of the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could all

Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of a

A vulnerability was found in SourceCodester Online DJ Management System 1.0 and classified as critical. This issue affec

Cross Site Scripting (XSS) vulnerability in PerfreeBlog 3.1.2 allows attackers to execute arbitrary code via the Post fu

Cross Site Scripting (XSS) vulnerability in pandao editor.md thru 1.5.0 allows attackers to inject arbitrary web script