2023

Tenda A18 V15.13.07.09 was discovered to contain a stack overflow via the rule_info parameter in the formAddMacfilterRul

Svelecte is a flexible autocomplete/select component written in Svelte. Svelecte item names are rendered as raw HTML wit

In startActivityInner of ActivityStarter.java, there is a possible way to launch an activity into PiP mode from the back

In update of MmsProvider.java, there is a possible way to change directory permissions due to a path traversal error. Th

In multiple functions of KeyguardViewMediator.java, there is a possible way to bypass lockdown mode with screen pinning

In multiple locations, there are root CA certificates which need to be disabled. This could lead to remote information d

In multiple functions of mem_protect.c, there is a possible way to access hypervisor memory due to a memory access check

In isServerCertChainValid of InsecureEapNetworkHandler.java, there is a possible way to trust an imposter server due to

In onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a miss

In onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a miss

In onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a miss

In onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a miss

In processMessageImpl of ClientModeImpl.java, there is a possible credential disclosure in the TOFU flow due to a logic

ScanCode.io is a server to script and automate software composition analysis pipelines. In the `/license/` endpoint, the

yaklang is a programming language designed for cybersecurity. The Yak Engine has been found to contain a local file incl

The WP-EMail WordPress plugin before 2.69.1 does not sanitise and escape some of its settings, which could allow high pr

The Contact Form Builder by Bit Form WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, wh

The Simple Author Box WordPress plugin before 2.52 does not verify a user ID before outputting information about that us

The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitise and escape several parameters before usi

The Custom Field For WP Job Manager WordPress plugin before 1.2 does not sanitise and escape some of its settings, which

The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape a parameter before ou

The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape some of its settings,

The WP Brutal AI WordPress plugin before 2.06 does not sanitise and escape some of its settings, which could allow high

The Elementor Website Builder WordPress plugin before 3.5.5 does not filter out user-controlled URLs from being loaded i

The PKCS11 module of the YubiHSM 2 SDK through 2023.01 does not properly validate the length of specific read operations

A Command Injection vulnerability has been identified in the MiVoice Office 400 SMB Controller through 1.2.5.23 which co

A SQL Injection vulnerability has been identified in the MiVoice Office 400 SMB Controller through 1.2.5.23 which could

The Texas Instruments (TI) WiLink WL18xx MCP driver does not limit the number of information elements (IEs) of type XCC_

An issue was discovered in Tigergraph Enterprise 3.7.0. The GSQL query language provides users with the ability to write

An issue was discovered in Tigergraph Enterprise 3.7.0. A single TigerGraph instance can host multiple graphs that are a

An issue was discovered in Tigergraph Enterprise 3.7.0. There is unsecured write access to SSH authorized keys file. Any

An issue was discovered in Tigergraph Enterprise 3.7.0. The TigerGraph platform allows users to define new User Defined

QEMU through 8.0.4 accesses a NULL pointer in nvme_directive_receive in hw/nvme/ctrl.c because there is no check for whe

Multiple reflected XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon 31.0.8 and versi

Multiple stored XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon 31.0.8 and versions

IBM TXSeries for Multiplatforms 8.1, 8.2, and 9.1 is vulnerable to a denial of service, caused by improper enforcement

The IBM i 7.2, 7.3, 7.4, and 7.5 product Facsimile Support for i contains a local privilege escalation vulnerability.

The Linux DVS server component of Mitel MiVoice Connect through 19.3 SP2 (22.24.1500.0) could allow an unauthenticated a

The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple pl

xterm before 380 supports ReGIS reporting for character-set names even if they have unexpected characters (i.e., neither

An issue was discovered in MariaDB MaxScale before 23.02.3. A user enters an encrypted password on a "maxctrl create ser

A post-authentication command injection vulnerability in the NTP feature of Zyxel NBG6604 firmware version V1.01(ABIR.1)

Improper frame handling in the Zyxel XGS2220-30 firmware version V4.80(ABXN.1), XMG1930-30 firmware version V4.80(ACAR.1

Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.

An issue was discovered in SysPasswordDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. System password information c

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in AdFoxly AdFoxly – Ad Manager, AdSense Ads & Ads.Txt plugin

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Silvia Pfeiffer and Andrew Nimmo External Videos plugi

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in iControlWP Article Directory Redux plugin <= 1.0.2 ver

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in ihomefinder Optima Express + MarketBoost IDX Plugin pl

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Email Subscription Popup plugin <=