2023

Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially craft

Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and

Zoho ManageEngine Applications Manager before 16400 allows proxy.html DOM XSS.

Cross Site Scripting vulnerability found in Exelysis Unified Communication Solutions (EUCS) v.1.0 allows a remote attack

HCL Workload Automation is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remot

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of serv

The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gain

Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic an

Buffer Overflow vulnerability found in XPDF v.4.04 allows an attacker to cause a Denial of Service via the PDFDoc malloc

A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument

OURPHP <= 7.2.0 is vulnerale to Cross Site Scripting (XSS) via /client/manage/ourphp_out.php.

Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0.

OURPHP <= 7.2.0 is vulnerable to Cross Site Scripting (XSS) via ourphp_tz.php.

A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML v

Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Pr

Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user

The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed

CLTPHP <=6.0 is vulnerable to Cross Site Scripting (XSS) via application/home/controller/Changyan.php.

CLTPHP <=6.0 is vulnerable to Directory Traversal.

Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Pr

Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced

Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated

Rapid7 Insight Agent token handler versions 3.2.6 and below, suffer from a Directory Traversal vulnerability whereby uns

Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS).

Sourcecodester Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS) via page=about.

Northern.tech CFEngine Enterprise before 3.21.1 allows a subset of authenticated users to leverage the Scheduled Reports

ARC (aka ARC2) through 2011-12-01 allows reflected XSS via the end_point.php query parameter in an output=htmltab action

The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib_prctl_set

VMware Workstation and Fusion contain an out-of-bounds read vulnerability that exists in the functionality for sharing h

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0,

A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in table_cl

The SolarWinds Platform was susceptible to the Exposure of Sensitive Information Vulnerability. This vulnerability allow

HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in namithjawahar Wp-Insert plugin <= 2.5.0 versions.

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Winwar Media Inline Tweet Sharer – Twitter Sharing Plu

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tim Reeves & David Stöckl TinyMCE Custom Styles plugin

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Carlos Moreira Interactive Geo Maps plugin <= 1.

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in miniOrange WordPress Social Login and Register (Discor

Improper access control in the Web Login listener in Devolutions Remote Desktop Manager 2023.1.22 and earlier on Windows

An HPE OneView appliance dump may expose SNMPv3 read credentials

An HPE OneView appliance dump may expose OneView user accounts

An HPE OneView appliance dump may expose proxy credential settings

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in George Pattihis Link Juice Keeper plugin <= 2.0.2 vers

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Bernhard Kux JSON Content Importer plugin <= 1.3.15 ve

The PingFederate Local Identity Profiles '/pf/idprofile.ping' endpoint is vulnerable to Cross-Site Request Forgery (CSRF

The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to M

The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration v

Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote att

Cross-site scripting (XSS) issue in Website app of Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier,