2023

HedgeDoc is software for creating real-time collaborative markdown notes. Prior to version 1.9.9, the API of HedgeDoc 1

Nuclei is a vulnerability scanner. Prior to version 2.9.9, a security issue in the Nuclei project affected users utilizi

Metabase is an open-source business intelligence and analytics platform. Prior to versions 0.43.7.3, 0.44.7.3, 0.45.4.3,

The Aerospike Java client is a Java application that implements a network protocol to communicate with an Aerospike serv

PyroCMS 3.9 contains a remote code execution (RCE) vulnerability that can be exploited through a server-side template in

An issue was discovered in Zoho ManageEngine Network Configuration Manager 12.6.165. The WebSocket endpoint allows Cross

A heap out-of-bounds memory read flaw was found in the virtual nvme device in QEMU. The QEMU process does not validate a

VMware Horizon Server contains an information disclosure vulnerability. A malicious actor with network access may be abl

VMware Horizon Server contains a HTTP request smuggling vulnerability. A malicious actor with network access may be able

Fujitsu Software Infrastructure Manager (ISM) stores sensitive information at the product's maintenance data (ismsnap) i

The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and includin

The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and includin

The WP Ultimate CSV Importer plugin for WordPress is vulnerable to privilege escalation in versions up to, and including

The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Sensitive Information Exposure via Directory Listing

An issue has been discovered in GitLab EE affecting all versions starting from 14.1 before 16.0.8, all versions starting

Sulu is an open-source PHP content management system based on the Symfony framework. It allows over the Admin Login form

Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. A path

Assmann Digitus Plug&View IP Camera HT-IP211HDP, version 2.000.022 allows unauthenticated attackers to download a copy o

Predictable Exact Value from Previous Values vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT21 model

An issue in the delete function in the ActModelController class of jeesite v1.2.6 allows authenticated attackers to arbi

django-sspanel v2022.2.2 was discovered to contain a remote command execution (RCE) vulnerability via the component sspa

Cross Site Scripting (XSS) vulnerability in sourcecodester Lost and Found Information System 1.0 allows remote attackers

Cross Site Scripting (XSS) vulnerability in sourcecodester Toll Tax Management System 1.0 allows remote attackers to run

User enumeration is found in in PHPJabbers Cleaning Business Software 1.0. This issue occurs during password recovery, w

In PHPJabbers Cleaning Business Software 1.0, lack of verification when changing an email address and/or password (on th

PHPJabbers Cleaning Business Software 1.0 is vulnerable to Cross Site Scripting (XSS) via the theme parameter of preview

There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Class Scheduli

User enumeration is found in in PHPJabbers Class Scheduling System v1.0. This issue occurs during password recovery, whe

In PHP Jabbers Class Scheduling System 1.0, lack of verification when changing an email address and/or password (on the

PHPJabbers Availability Booking Calendar 5.0 is vulnerable to User Account Takeover through username/password change.

PHP Jabbers Availability Booking Calendar 5.0 is vulnerable to Incorrect Access Control.

PHPJabbers Availability Booking Calendar 5.0 is vulnerable to Incorrect Access Control due to improper input validation

ai-dev aitable before v0.2.2 was discovered to contain a SQL injection vulnerability via the component /includes/ajax.ph

An issue found in N-able Technologies N-central Server before 2023.4 allows a local attacker to execute arbitrary code v

Weak Encoding for Password vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.49.000

Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due

ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arb

A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbit

An issue in a hidden API in ZKTeco BioTime v8.5.5 allows unauthenticated attackers to arbitrarily reset the Administrato

A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign.  An attacker could hijack a user

A Persistent Cross-site Scripting (XSS) vulnerability can be carried out on certain pages of Unica Platform.  An attacke

A Persistent Cross-site Scripting (XSS) vulnerability can be carried out in a certain field of the Unica Platform.  An a

A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator.  It

The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated

A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundr

A security defect was discovered in Foundry Issues that enabled users to create convincing phishing links by editing the

The Foundry Magritte plugin rest-source was found to be vulnerable to an an XML external Entity attack (XXE).

The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint

A vulnerability in web-based management interface of Cisco SPA500 Series Analog Telephone Adapters (ATAs) could allow an

A vulnerability in the privilege management functionality of all Cisco BroadWorks server types could allow an authentica