2023

Cross-Site Request Forgery (CSRF) vulnerability in phoeniixx Custom My Account for Woocommerce allows Cross-Site Scripti

Remarshal prior to v0.17.1 expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack.

Cross-Site Request Forgery (CSRF) vulnerability leading to Local File Inclusion (LF) in Webpushr Web Push Notifications

Server-Side Request Forgery (SSRF) vulnerability in Vova Anokhin WP Shortcodes Plugin — Shortcodes Ultimate.This issue a

Cross-Site Request Forgery (CSRF) vulnerability in WPIndeed Debug Assistant plugin <= 1.4 versions.

Local attacker can escalate privileges on affected installations of Check Point Harmony Endpoint/ZoneAlarm Extreme Secur

Headscale through 0.22.3 writes bearer tokens to info-level logs.

Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and pr

An attacker with local access to a system (either through a disk or external drive) can present a modified XFS partition

A CWE-269: Improper Privilege Management vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit C

Discourse is an open source platform for community discussion. In versions 3.1.0 through 3.1.2 of the `stable` branch an

A SQL injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authentic

A SQL injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authentic

An OS command injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow a

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

An issue discovered in Pfsense CE version 2.6.0 allows attackers to change the password of any user without verification

An issue has been discovered in GitLab EE affecting all versions starting from 15.3 prior to 16.2.8, 16.3 prior to 16.3.

A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the q

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists in Telit Cinterion EHS5/6/8 that could allow

The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a

An issue discovered in esptool 4.6.2 allows attackers to view sensitive information via weak cryptographic algorithm.

application-collabora is an integration of Collabora Online in XWiki. As part of the application use cases, depending on

The AppsAnywhere macOS client-privileged helper can be tricked into executing arbitrary commands with elevated permissio

Symmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engine

The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vu

The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vu

CSV injection in export as csv in Combodo iTop v.3.1.0-2-11973 allows a local attacker to execute arbitrary code via a c

Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmw

Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmwar

Lenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file download

A privilege escalation vulnerability was reported in Lenovo preloaded devices deployed using Microsoft AutoPilot under

An uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local a

BleachBit cleans files to free disk space and to maintain privacy. BleachBit for Windows up to version 4.4.2 is vulnerab

ZITADEL provides identity infrastructure. ZITADEL provides administrators the possibility to define a `Lockout Policy` w

Couchbase Server 7.1.4 before 7.1.5 and 7.2.0 before 7.2.1 allows Directory Traversal.

An issue was discovered in Couchbase Server 7.2.0. There is a private key leak in debug.log while adding a pre-7.0 node

Use after free in WebAudio in Google Chrome prior to 119.0.6045.123 allowed a remote attacker to potentially exploit hea

Incorrect Privilege Assignment vulnerability in opentext Fortify ScanCentral DAST. The vulnerability could be exploited

A time-of-check to time-of-use (TOCTOU) bug in handling of IOCTL (input/output control) requests. This TOCTOU bug leads

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in GARY JEZORSKI CloudNet360 plugin <= 3.2.0 versions.

In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the buffer was identified.

PILOS is an open source front-end for BigBlueButton servers with a built-in load balancer. The password reset component

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ashish Ajani WordPress Simple HTML Sitemap plugin <= 2.1 v

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FLOWFACT WP Connector plugin <= 2.1.7 versions.

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Enej Bajgoric / Gagan Sandhu / CTLT DEV User Avatar plugin

In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the commit function was id