2023

An issue in Viatom Health ViHealth for Android v.2.74.58 and before allows a remote attacker to execute arbitrary code v

Cross Site Scripting vulnerability in Faculty Evaulation System using PHP/MySQLi v.1.0 allows an attacker to execute arb

PHPJabbers Catering System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /

There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Time Slots Boo

In PHP Jabbers Time Slots Booking Calendar 3.3 , lack of verification when changing an email address and/or password (on

User enumeration is found in in PHP Jabbers Time Slots Booking Calendar v3.3. This issue occurs during password recovery

Improper input validation of password parameter in PHP Jabbers Time Slots Booking Calendar v 3.3 results in insecure pas

There is a Cross Site Scripting (XSS) vulnerability in "cid" parameter of preview.php in PHPJabbers Time Slots Booking C

Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c, and v9.2.0 Could allow an authenticated, local user with kn

The Brocade Fabric OS Commands “configupload” and “configdownload” before Brocade Fabric OS v9.1.1c, v8.2.3d, v9.2.0

Brocade Fabric OS before Brocade Fabric OS 9.1.1c, 9.2.0 contains a vulnerability when using various commands such as “c

A vulnerability in the fosexec command of Brocade Fabric OS after Brocade Fabric OS v9.1.0 and, before Brocade Fabric OS

An authenticated command injection vulnerability exists in the AOS-CX command line interface. Successful exploitation o

A potential power side-channel vulnerability in AMD processors may allow an authenticated attacker to monitor the CPU po

An arbitrary file upload vulnerability in Uvdesk 1.1.3 allows attackers to execute arbitrary code via uploading a crafte

In certain EZVIZ products, two stack based buffer overflows in mulicast_parse_sadp_packet and mulicast_get_pack_type fun

In certain EZVIZ products, two stack buffer overflows in netClientSetWlanCfg function of the EZVIZ SDK command server ca

An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript. This issue may allow a local

A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This issue may allow a

The Barebones CMS v2.0.2 is vulnerable to Stored Cross-Site Scripting (XSS) when an authenticated user interacts with ce

MotoCMS Version 3.4.3 Store Category Template was discovered to contain a Server-Side Template Injection (SSTI) vulnerab

An Unrestricted Upload of File with Dangerous Type vulnerability in the Ajaxmanager File and Database explorer (ajaxmana

Memory safety bugs present in Firefox 115. Some of these bugs showed evidence of memory corruption and we presume that w

Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. Some of these bugs showed evidence

Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102

When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no l

When opening appref-ms files, Firefox did not warn the user that these files may contain malicious code. *This bug only

A website could have obscured the full screen notification by using a URL with a scheme handled by an external program,

The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, any files in that d

A website could have obscured the full screen notification by using the file open dialog. This could have led to user co

In some cases, an untrusted input stream was copied to a stack buffer without checking its size. This resulted in a pote

Race conditions in reference counting code were found through code inspection. These could have resulted in potentially

An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations.

A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting

In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in i

Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from anot

Session tokens in RWS WorldServer 11.7.3 and earlier have a low entropy and can be enumerated, leading to unauthorized a

rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPa

rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Fun

rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_b parameter in the doDiff Fun

Greenshot 1.2.10 and below allows arbitrary code execution because .NET content is insecurely deserialized when a .green

TP-Link Archer AX21(US)_V3_1.1.4 Build 20230219 and AX21(US)_V3.6_1.1.4 Build 20230219 are vulnerable to Buffer Overflow

A Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated attacker to execute arbitrary OS co

A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary comma

pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry

Reflected XSS in business intelligence in Checkmk <2.2.0p8, <2.1.0p32, <2.0.0p38, <=1.6.0p30.

Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of th

LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure.

LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure.

A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to ex