2023

Vulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulnera

Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.

Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.

Vulnerability of missing authentication on certain HUAWEI phones.Successful exploitation of this vulnerability can lead

Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.

Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.

Vulnerability of bypassing the default desktop security controls.Successful exploitation of this vulnerability may cause

Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.

Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.

A flawed pseudorandom number generator in Dominion Voting Systems ImageCast Precinct (ICP and ICP2) and ImageCast Evolut

A remote unprivileged attacker can modify and access configuration settings on the EventCam App due to the absence of AP

A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transpo

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Seed Webs Seed Fonts plugin <= 2.3.1 versions.

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Beplus Sermon'e – Sermons Online plugin <= 1.0.0

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Backup Solutions WP Backup Manager plugin <= 1.13.1 ver

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Alain Gonzalez Google Map Shortcode plugin <= 3.1.2 versio

A vulnerability was found in SourceCodester Resort Management System 1.0. It has been declared as problematic. Affected

Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Project Manager plugin <= 3.3.93 versions.

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gVectors Display Custom Fields – wpView plugin <= 1.3.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Marksoft allows SQ

Auth. (author+) Broken Access Control vulnerability leading to Arbitrary File Deletion in Nabil Lemsieh Easy Media Repla

A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path tha

The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0,

Unauth. SQL Injection (SQLi) vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin <= 3.1.23 versions.

Memory safety bugs present in Firefox 113. Some of these bugs showed evidence of memory corruption and we presume that w

Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs showed evidenc

When choosing a site-isolated process for a document loaded from a data: URL that was the result of a redirect, Firefox

The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts

The Google Map Shortcode WordPress plugin through 3.1.2 does not validate and escape some of its shortcode attributes be

The Ultimate Dashboard WordPress plugin before 3.7.6 does not sanitise and escape some of its settings, which could allo

The AI ChatBot WordPress plugin before 4.5.6 does not sanitise and escape numerous of its settings, which could allow hi

The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the agents[] parameter in the set_a

The Social Share, Social Login and Social Comments WordPress plugin before 7.13.52 does not sanitise and escape a parame

The Upload Resume WordPress plugin through 1.2.0 does not validate the captcha parameter when uploading a resume via the

The AI ChatBot WordPress plugin before 4.5.5 does not sanitize and escape its settings, allowing high-privilege users su

The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the `id` parameter for an Agent in

The File Renaming on Upload WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could

The Conditional Menus WordPress plugin before 1.2.1 does not escape a parameter before outputting it back in an attribut

The Custom Base Terms WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, which could allow

The Integration for Contact Form 7 and Zoho CRM, Bigin WordPress plugin before 1.2.4 does not properly sanitise and esca

The QueryWall: Plug'n Play Firewall WordPress plugin through 1.1.1 does not properly sanitise and escape a parameter bef

The QuBot WordPress plugin before 1.1.6 does not sanitise and escape some of its settings, which could allow high privil

The QuBot WordPress plugin before 1.1.6 doesn't filter user input on chat, leading to bad code inserted on it be reflect

The Slider Revolution WordPress plugin through 6.6.12 does not check for valid image files upon import, leading to an ar

The WP Custom Cursors WordPress plugin before 3.2 does not properly sanitise and escape a parameter before using it in a

When recording the screen while in Private Browsing on Firefox for Android the address bar and keyboard were not hidden,

Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable n

A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious fil

Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android. These could have

A potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on Android API below versi