2023

An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/connection.c in ksmbd has an off-by-one error in memo

An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/smb2pdu.c in ksmbd does not properly check the UserNa

An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/smb2pdu.c in ksmbd has an integer underflow and

An issue was discovered in the Linux kernel before 6.3.4. ksmbd has an out-of-bounds read in smb2_find_context_vals when

Open Enclave is a hardware-agnostic open source library for developing applications that utilize Hardware-based Trusted

If a TLS 1.3 client gets neither a PSK (pre shared key) extension nor a KSE (key share extension) when connecting to a m

An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before 6.2.12. Because

OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file ca

On Crestron 3-Series Control Systems before 1.8001.0187, crafting and sending a specific BACnet packet can cause a crash

The XPRTLD web application in Veritas InfoScale Operations Manager (VIOM) before 8.0.0.410 allows an authenticated attac

iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field.

CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features t

CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification an unauthenticated attackers ca

RCE (Remote Code Execution) vulnerability was found in some Furukawa ONU models, this vulnerability allows remote unauth

An issue in the emqx_sn plugin of EMQX v4.3.8 allows attackers to execute a directory traversal via uploading a crafted

faust commit ee39a19 was discovered to contain a stack overflow via the component boxppShared::print() at /boxes/ppbox.c

stress-test master commit e4c878 was discovered to contain a FPE vulnerability via the component combine_inner at /pixma

Metersphere is an opensource testing framework. Files uploaded to Metersphere may define a `belongType` value with a rel

Progress Chef Infra Server before 15.7 allows a local attacker to exploit a /var/opt/opscode/local-mode-cache/backup wor

D-Link DIR-619L v2.04(TW) was discovered to contain a stack overflow via the curTime parameter at /goform/formLogin.

An issue was discovered in ngiflib 0.4. There is SEGV in SDL_LoadAnimatedGif when use SDLaffgif. poc : ./SDLaffgif CA_fi

A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions

A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.36 Patch 2, USG FLEX series fir

A command injection vulnerability in the Free Time WiFi hotspot feature of the Zyxel USG FLEX series firmware versions 4

A command injection vulnerability in the hotspot management feature of the Zyxel ATP series firmware versions 4.60 throu

A command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 through 5.3

A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmw

Hamba avro is a go lang encoder/decoder implementation of the avro codec specification. In affected versions a well-craf

TOTOLINK CP300+ V5.2cu.7594 contains a Denial of Service vulnerability in function RebootSystem of the file lib/cste_mod

The configuration parser fails to sanitize user-controlled input in the Zyxel ATP series firmware versions 5.10 through

Furukawa Electric LatAm 423-41W/AC before v1.1.4 and LD421-21W before v1.3.3 were discovered to contain an HTML injectio

Mattermost iOS app fails to properly validate the server certificate while initializing the TLS connection allowing a ne

Mattermost fails to properly validate a gif image file, allowing an attacker to consume a significant amount of server r

Mattermost WelcomeBot plugin fails to to validate the membership status when inviting or adding users to channels allowi

Mattermost fails to properly validate markdown, allowing an attacker to crash the server via a specially crafted markdow

Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created.

Mattermost fails to delete card attachments in Boards, allowing an attacker to access deleted attachments.

Mattermost fails to properly show information in the UI, allowing a system admin to modify a board state allowing any us

Mattermost fails to disable public Boards after the "Enable Publicly-Shared Boards" configuration option is disabled, re

Mattermost Boards fail to properly validate a board link, allowing an attacker to crash a channel by posting a specially

Mattermost fails to properly check the authorization of POST /api/v4/teams when passing a team override scheme ID in the

Mattermost fails to verify channel membership when linking a board to a channel allowing a low-privileged authenticated

Mattermost fails to properly validate the origin of a websocket connection allowing a MITM attacker on Mattermost to acc

Mattermost fails to properly restrict requests to localhost/intranet during the interactive dialog, which could allow an

Cross-Site Request Forgery (CSRF) vulnerability in FiveStarPlugins Restaurant Menu and Food Ordering plugin <= 2.4.6 ver

Cross-Site Request Forgery (CSRF) vulnerability in Justin Klein WP Social AutoConnect plugin <= 4.6.1 versions.

Cross Site Scripting (XSS) vulnerability in Jaegertracing Jaeger UI before v.1.31.0 allows a remote attacker to execute

An issue was discovered on Espressif ESP32 3.0 (ESP32_rev300 ROM) devices. An EMFI attack on ECO3 provides the attacker

Cross-Site Request Forgery (CSRF) vulnerability in Metagauss Download Theme plugin <= 1.0.9 versions.

Cross-Site Request Forgery (CSRF) vulnerability in Nikola Loncar Easy Appointments plugin <= 3.11.9 versions.