2023

An issue was discovered in espcms version P8.18101601. There is a cross site scripting (XSS) vulnerability that allows a

Meldekarten generator is an open source project to create a program, running locally in the browser without the need for

IBM Cloud Pak for Security (CP4S) 1.9.0.0 through 1.9.2.0 could allow an attacker with a valid API key for one tenant to

Directory Traversal vulnerability found in Cryptoprof WCMS v.0.3.2 allows a remote attacker to execute arbitrary code vi

An cross site request forgery (CSRF) vulnerability discovered in Jymusic v2.0.0.,that allows attackers to execute arbitr

Stored cross site scripting (XSS) vulnerability in /index.php?admin-master-navmenu-add of Chaoji CMS v2.18 that allows a

A stored cross site scripting (XSS) vulnerability in /index.php?admin-master-article-edit of Chaoji CMS v2.18 that allow

An issue was discovered in cmseasy v7.0.0 that allows user credentials to be sent in clear text due to no encryption of

A maliciously crafted file consumed through pskernel.dll file could lead to memory corruption vulnerabilities. These vul

A maliciously crafted pskernel.dll file in Autodesk products is used to trigger integer overflow vulnerabilities. Exploi

IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.7.3 and 23.0.0 through 23.0.3 is vulnerable to insuffic

IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.7.3 and 23.0.0 through 23.0.3 is vulnerable to securit

A Cross site request forgery (CSRF) vulnerability was discovered in FeiFeiCMS v4.1.190209, which allows attackers to cre

A Cross Site Request Forgery (CSRF) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows a remote attacker to gain priv

A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remot

A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remot

A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remot

A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remot

Apereo CAS is an open source multilingual single sign-on solution for the web. Apereo CAS can be configured to use authe

IBM QRadar SIEM 7.5.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly

IBM QRadar SIEM 7.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScr

IBM QRadar SIEM 7.5.0 could allow an authenticated user to perform unauthorized actions due to hazardous input validatio

IBM QRadar SIEM 7.5.0 is vulnerable to information exposure allowing a delegated Admin tenant user with a specific doma

Stormshield Endpoint Security Evolution 2.0.0 through 2.4.2 has Insecure Permissions. An ACL entry on the SES Evolution

Stormshield Endpoint Security Evolution 2.0.0 through 2.3.2 has Insecure Permissions. An interactive user can use the SE

i-doit Open v24 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the timeout parameter

Cloudexplorer-lite is an open source cloud software stack. Weak passwords can be easily guessed and are an easy target f

Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it wa

Shopware is an open source e-commerce software. Due to an incorrect configuration in the `.htaccess` file, the configura

IBM Business Automation Workflow is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitra

Server-Side Request Forgery (SSRF) in GitHub repository plantuml/plantuml prior to 1.2023.9.

Improper Access Control in GitHub repository plantuml/plantuml prior to 1.2023.9.

Unchecked parameter value in M-Files Server in versions before 23.6.12695.3 (excluding 23.2 SR2 and newer) allows anonym

A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an an

A missing authorization check in the MacOS agent configuration endpoint of the Insider Threat Management Server enables

A missing authorization check in multiple SOAP endpoints of the Insider Threat Management Server enables an attacker on

An insecure filesystem permission in the Insider Threat Management Agent for Windows enables local unprivileged users to

The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing users with author roles or above t

The Formidable Forms WordPress plugin before 6.3.1 does not adequately authorize the user or validate the plugin URL in

The WP Inventory Manager WordPress plugin before 2.1.0.14 does not have CSRF checks, which could allow attackers to make

The CodeColorer WordPress plugin before 0.10.1 does not sanitise and escape some of its settings, which could allow high

The ERP WordPress plugin before 1.12.4 does not properly sanitise and escape the `type` parameter in the `erp/v1/account

The ERP WordPress plugin before 1.12.4 does not sanitise and escape the employee_name parameter before outputting it bac

The Ultimate Product Catalog WordPress plugin before 5.2.6 does not sanitise and escape some of its settings, which coul

The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks (either flawed or missing completely) in various AJ

The KiviCare WordPress plugin before 3.2.1 does not have proper CSRF and authorisation checks in various AJAX actions, a

The KiviCare WordPress plugin before 3.2.1 does not sanitise and escape a parameter before outputting it back in the pag

The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user

The wpbrutalai WordPress plugin before 2.0.1 does not sanitise and escape a parameter before outputting it back in the p

The wpbrutalai WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL