2023

Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially craft

McAfee Total Protection prior to 16.0.50 may allow an adversary (with full administrative access) to modify a McAfee spe

A cleartext transmission vulnerability exists in the Remote Management functionality of Netgear Orbi Router RBR750 4.6.8

A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function

IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 is vulnerable to SQL injection. A remote att

IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 stores user credentials in plain clear text

IBM Aspera Faspex 4.4.2 could allow a remote authenticated attacker to obtain sensitive credential information using sp

IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to obtain

A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could

A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could allow the r

x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains wh

x86: speculative vulnerability in 32bit SYSCALL path Due to an oversight in the very original Spectre/Meltdown security

A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause acces

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pacsrapor allows R

Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Galaxy Weblinks Gallery with thumbnail slider plugin <=

Auth. (contributor+) Cross-Site Scripting vulnerability in TCBarrett WP Glossary plugin <= 3.1.2 versions.

Auth. (contributor+) Stored Cross-Site Scripting vulnerability in Galleryape Gallery Images Ape plugin <= 2.2.8 versions

Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.

Observable Response Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.

Improper Restriction of Excessive Authentication Attempts in GitHub repository answerdev/answer prior to 1.0.6.

Observable Timing Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.

Cross-site Scripting (XSS) - Generic in GitHub repository tsolucio/corebos prior to 8.0.

Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticat

Rapid7 InsightVM versions 6.6.178 and lower suffers from an open redirect vulnerability, whereby an attacker has the abi

HTML Email Injection in Tribe29 Checkmk <=2.1.0p23; <=2.0.0p34, and all versions of Checkmk 1.6.0 allows an authenticate

Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.19.

The VK All in One Expansion Unit WordPress plugin before 9.87.1.0 does not escape the $_SERVER['REQUEST_URI'] parameter

The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to

The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not ensure that posts to be di

The WP Meta SEO WordPress plugin before 4.5.3 does not authorize several ajax actions, allowing low-privilege users to m

The WPB Advanced FAQ WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before

The GoToWP WordPress plugin through 5.1.1 does not validate and escape some of its shortcode attributes before outputtin

The React Webcam WordPress plugin through 1.2.0 does not validate and escape some of its shortcode attributes before out

The real.Kit WordPress plugin before 5.1.1 does not validate and escape some of its shortcode attributes before outputti

The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate and escape some of its shortcode attribute

The Responsive Clients Logo Gallery Plugin for WordPress plugin through 1.1.9 does not validate and escape some of its s

The GetResponse for WordPress plugin through 5.5.31 does not validate and escape some of its shortcode attributes before

The Saan World Clock WordPress plugin through 1.8 does not validate and escape some of its shortcode attributes before o

The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.3.0 has a flawed CSRF and authorisation check when

The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.5 does not have CSRF check when deleting a client

Pimcore is an open source data and experience management platform. Versions prior to 10.5.19 have an unsecured tooltip f

PDFio is a C library for reading and writing PDF files. In versions 1.1.0 and prior, a denial of service vulnerability e

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Izmir Katip Celebi

Cross-Site Request Forgery (CSRF) vulnerability in David Gwyer Admin Log plugin <= 1.50 versions.

Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Esstat17 Page Loading Effects plugin <= 2.0.0 versions.

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Altanic No API Amazon Affiliate plugin <= 4.2.2 versio

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Nicolas Lemoine WP Better Emails plugin <= 0.4 version