2023

The FACSChorus software database can be accessed directly with the privileges of the currently logged-in user. A threat

The FACSChorus software contains sensitive information stored in plaintext. A threat actor could gain hardcoded secrets

There is no BIOS password on the FACSChorus workstation. A threat actor with physical access to the workstation can pote

When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect ter

The FACSChorus workstation operating system does not restrict what devices can interact with its USB ports. If exploited

raptor-web is a CMS for game server communities that can be used to host information and keep track of players. In versi

An authentication bypass vulnerability in the Direct Connection Module in Ezviz CS-C6N-xxx prior to v5.3.x build 2023040

An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports,

A race condition in go-resty can result in HTTP request body disclosure across requests. This condition can be triggered

An authenticated user with read permissions on database connections metadata could potentially access sensitive informat

An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing t

Under rare conditions, the effective permissions of an object might be incorrectly calculated if the object has a specif

Cross Site Scripting (XSS) in Search filters in Prestashop Amazzing filter version up to version 3.2.5, allows remote at

A Cross-Site Scripting (XSS) vulnerability has been found in Alumne LMS affecting version 4.0.0.1.08. An attacker could

A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from resp

In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially cra

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a u

In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that m

Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairing in Bluetooth Core Specification 4.2 t

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Insecure Direct Object Reference in

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the

Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless contai

OroCommerce is an open-source Business to Business Commerce application built with flexibility in mind. Detailed Order t

OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can acce

OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access

An improper privilege management vulnerability in the hotspot feature of the Zyxel USG FLEX series firmware versions 4.5

An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 t

An improper privilege management vulnerability in the ZySH of the Zyxel ATP series firmware versions 4.32 through 5.37,

A buffer overflow vulnerability in the Zyxel ATP series firmware version 5.37, USG FLEX series firmware version 5.37, US

A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware ve

An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 t

A cross-site scripting (XSS) vulnerability in the CGI program of the Zyxel ATP series firmware versions 5.10 through 5.3

An improper input validation vulnerability in the “Quagga” package of the Zyxel ATP series firmware versions 4.32 throug

A vulnerability has been identified in Pachno 1.0.6 allowing an authenticated attacker to execute a cross-site scripting

In the module "CSV Feeds PRO" (csvfeeds) < 2.6.1 from Bl Modules for PrestaShop, a guest can download personal informati

A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.

A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar functio

A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk patte

The discontinued FFS Colibri product allows a remote user to access files on the system including files containing login

A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.

OroPlatform is a package that assists system and user calendar management. Back-office users can access information from

An issue discovered in Acer Wireless Keyboard SK-9662 allows attacker in physical proximity to both decrypt wireless key

The POST SMTP Mailer WordPress plugin before 2.7.1 does not escape email message content before displaying it in the bac

The Medialist WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputt

The Simple Social Media Share Buttons WordPress plugin before 5.1.1 leaks password-protected post content to unauthentic

The WordPress Backup & Migration WordPress plugin before 1.4.4 does not sanitise and escape some parameters, which could

The WordPress Backup & Migration WordPress plugin before 1.4.4 does not authorize some AJAX requests, allowing users wit

The WassUp Real Time Analytics WordPress plugin through 1.9.4.5 does not escape IP address provided via some headers bef

The Martins Free & Easy SEO BackLink Link Building Network WordPress plugin before 1.2.30 does not sanitise and escape a

The Web Push Notifications WordPress plugin before 4.35.0 does not prevent visitors on the site from changing some of th