2023

All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking shell.exec without saniti

KioWare through 8.33 on Windows sets KioScriptingUrlACL.AclActions.AllowHigh for the about:blank origin, which allows at

A vulnerability has been found in ByWater Solutions bywater-koha-xslt and classified as critical. This vulnerability aff

Cross-site scripting vulnerability in Authentication Key Settings of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p

Cross-site scripting vulnerability in Product List Screen and Product Detail Screen of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUB

Cross-site scripting vulnerability in Contents Management of EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0

Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirec

The REPORT (after z but before a) parameter in wa.exe in L-Soft LISTSERV 16.5 before 17 allows an attacker to conduct XS

Ghost 5.35.0 allows authorization bypass: contributors can view draft posts of other users, which is arguably inconsiste

Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.4.

A vulnerability was found in ualbertalib NEOSDiscovery 1.0.70 and classified as problematic. This issue affects some unk

A vulnerability, which was classified as critical, has been found in json-logic-js 2.0.0. Affected by this issue is some

Cross-site Scripting (XSS) - Stored in GitHub repository icret/easyimages2.0 prior to 2.6.7.

A vulnerability, which was classified as critical, was found in ayttm up to 0.5.0.89. This affects the function http_con

A vulnerability was found in iGamingModules flashgames 1.1.0. It has been classified as critical. Affected is an unknown

A vulnerability has been found in codepeople cp-polls Plugin 1.0.1 on WordPress and classified as critical. This vulnera

A vulnerability was found in Artesãos SEOTools up to 0.17.1 and classified as critical. This issue affects the function

A vulnerability has been found in Artesãos SEOTools up to 0.17.1 and classified as problematic. This vulnerability affec

Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378.

A vulnerability, which was classified as problematic, was found in Artesãos SEOTools up to 0.17.1. This affects the func

Discourse is an open source platform for community discussion. Tags that are normally private are showing in metadata. T

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization design

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization design

An issue discovered in com.samourai.wallet.PinEntryActivity.java in Streetside Samourai Wallet 0.99.96i allows attackers

RSSHub is an open source and extensible RSS feed generator. When the URL parameters contain certain special characters,

gosaml2 is a Pure Go implementation of SAML 2.0. SAML Service Providers using this library for SAML authentication suppo

teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. In teler-w

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376.

Directus is a real-time API and App dashboard for managing SQL database content. Directus is vulnerable to Server-Side R

OpenZeppelin Contracts is a library for secure smart contract development. The ERC721Consecutive contract designed for m

Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an

Certain Draytek products are vulnerable to Cross Site Scripting (XSS) via the wlogin.cgi script and user_login.cgi scrip

The Watu Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘dn’, 'email', 'points', and

A vulnerability in the file upload functionality of Cisco Webex App for Web could allow an unauthenticated, remote attac

A vulnerability in the nginx configurations that are provided as part of the VPN-less reverse proxy for Cisco Finesse co

A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Netwo

Multiple vulnerabilities in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to collect s

Multiple vulnerabilities in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to collect s

LibTIFF 4.4.0 has an out-of-bounds read in tiffcp in tools/tiffcp.c:948, allowing attackers to cause a denial-of-service

A flaw was found in coreDNS. This flaw allows a malicious user to redirect traffic intended for external top-level domai

A flaw was found in coreDNS. This flaw allows a malicious user to reroute internal calls to some internal services that

A vulnerability was found in Zhong Bang CRMEB Java 1.3.4. It has been classified as critical. This affects an unknown pa

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5 and classified as c

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ASOS Information T

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ASOS Information T

Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0.

A malicious actor can clone access cards used to open control cabinets secured with Rittal CMC III locks.

A code injection vulnerability was identified in GitHub Enterprise Server that allowed setting arbitrary environment var

IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, 7.6.1.3 and IBM Maximo Application Suite 8.8 and 8.9 is vulnerable to stor

XWiki Platform is a generic wiki platform. Starting in version 1.3-rc-1, any user with edit right can execute arbitrary