2023

Cross Site Scripting vulnerability found in wkeyuan DWSurvey 1.0 allows a remote attacker to execute arbitrary code via

File upload vulnerability in ebCMS v.1.1.0 allows a remote attacker to execute arbitrary code via the upload type parame

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Flothemes Flo Forms – Easy Drag & Drop Form Builder pl

A vulnerability in Fibaro Motion Sensor firmware v3.4 allows attackers to cause a Denial of Service (DoS) via a crafted

A vulnerability in Aeotec WallMote Switch firmware v2.3 allows attackers to cause a Denial of Service (DoS) via a crafte

Craft CMS through 4.4.9 is vulnerable to HTML Injection.

A vulnerability was found in PuneethReddyHC Online Shopping System Advanced 1.0. It has been declared as critical. Affec

Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain

There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in John Brien WordPress NextGen GalleryView plugin <= 0.5.5 v

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Internet Marketing Dojo WP Affiliate Links plugin <= 0.1.1

Cloudflare WARP client for Windows (up to v2023.3.381.0) allowed a malicious actor to remotely access the warp-svc.exe b

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Team Heateor Super Socializer plugin <= 7.13.52

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Vadym K. Extra User Details plugin <= 0.5 versions.

Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not proper

It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT doc

When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. At

When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes. At

When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. At

IPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt is made. Attackers wit

Control characters were not removed when exporting user feedback content. This allowed attackers to include unexpected c

Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same con

Default permissions for a properties file were too permissive. Local system users could read potentially sensitive infor

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in EventPrime plugin <= 3.0.5 versions.

The CMS Commander plugin for WordPress is vulnerable to authorization bypass due to the use of an insufficiently unique

The WP Sticky Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including,

Missing permission checks in Jenkins Team Concert Plugin 2.4.1 and earlier allow attackers with Overall/Read permission

SUBNET PowerSYSTEM Center versions 2020 U10 and prior contain a cross-site scripting vulnerability that may allow an at

SUBNET PowerSYSTEM Center versions 2020 U10 and prior are vulnerable to replay attacks which may result in a denial-o

A vulnerability was found in drivers/cpufreq/qcom-cpufreq-hw.c in cpufreq subsystem in the Linux Kernel. This flaw, duri

A flaw was found in the IPv6 module of the Linux kernel. The arg.result was not used consistently in fib6_rule_lookup, s

NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access

PyBB is an open source bulletin board. A manual code review of the PyBB bulletin board server has revealed that a vulner

Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-par

Vulnerability of system restart triggered by abnormal callbacks passed to APIs.Successful exploitation of this vulnerabi

Permission control vulnerability in the window management module.Successful exploitation of this vulnerability may cause

Version update determination vulnerability in the user profile module.Successful exploitation of this vulnerability may

nappropriate authorization vulnerability in the SettingsProvider module.Successful exploitation of this vulnerability ma

Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-par

Improper permission control vulnerability in the Notepad app.Successful exploitation of the vulnerability may lead to pr

Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-par

Vulnerability of services denied by early fingerprint APIs on HarmonyOS products.Successful exploitation of this vulnera

Vulnerability of unauthorized calling on HUAWEI phones and tablets.Successful exploitation of this vulnerability may aff

Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.

Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.

Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.

Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.

Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.

Vulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulnera

Vulnerability of unauthorized access to foreground app information.Successful exploitation of this vulnerability may cau