2023

Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too

Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser. The scr

URL validation scheme receives input from a user and then parses it to identify its various components. The validation s

Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web applic

Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web a

Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attrib

Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server o

JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of u

JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Prep

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iDisplay PlatPlay

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Apache Hive Provider. Patching on

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bullwark allows Path Tra

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Lisa Software Flor

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Elra Parkmatik all

Code injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent authenticated attacker to execute

OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent authenticated attacker to ex

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.3 before 15.11.10, all versions sta

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.3 before 15.11.10, all versions sta

An information disclosure issue in Gitlab CE/EE affecting all versions from 13.6 prior to 15.11.10, all versions from 16

An information disclosure issue in GitLab CE/EE affecting all versions from 16.0 prior to 16.0.6, and version 16.1.0 all

The User Registration plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.0.1

The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and

coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on

acme.sh before 3.0.6 runs arbitrary commands from a remote server via eval, as exploited in the wild in June 2023.

ELECOM wireless LAN routers are vulnerable to sensitive information exposure, which allows a network-adjacent unauthoriz

Cross-site request forgery (CSRF) vulnerability in exists in WTC-C1167GC-B v1.17 and earlier, and WTC-C1167GC-W v1.17 an

SonicWall GMS and Analytics CAS Web Services application use static values for authentication without proper checks lead

Vulnerability in SonicWall GMS and Analytics allows unauthenticated attacker to upload files to a restricted location no

Path Traversal vulnerability in SonicWall GMS and Analytics allows a remote authenticated attacker to read arbitrary fil

Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics allows authentic

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and

Use of password hash instead of password for authentication vulnerability in SonicWall GMS and Analytics allows Pass-the

Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics enables an unaut

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 prior to 15.11.10, all versions f

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions sta

An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14 before 15.11.10, all versions sta

An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. There are infinit

ELECOM wireless LAN routers WRC-1167GHBK-S v1.03 and earlier, and WRC-1167GEBK-S v1.03 and earlier allow a network-adjac

Command injection vulnerability in ELECOM and LOGITEC wireless LAN routers allows a remote unauthenticated attacker to e

Command injection vulnerability in ELECOM and LOGITEC wireless LAN routers allows a network-adjacent authenticated attac

Open redirect vulnerability in ELECOM wireless LAN routers and ELECOM wireless LAN repeaters allows a remote unauthentic

Cross-site scripting vulnerability in WRH-300WH-H v2.12 and earlier, and WTC-300HWH v1.09 and earlier allows a remote un

SonicWall GMS and Analytics use outdated Tiny Encryption Algorithm (TEA) with a hardcoded key to encrypt sensitive data.

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in SonicWall GMS and Analyt

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.10 before 15.11.10, all versions st

Tomcat application credentials are hardcoded in SonicWall GMS and Analytics configuration file. This issue affects GMS:

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SonicWall GM

Vulnerability in SonicWall GMS and Analytics allows an authenticated attacker to upload files on the underlying filesyst

Path Traversal vulnerability in GMS and Analytics allows an authenticated attacker to read arbitrary files from the unde

The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authenticatio