2023

In canStartSystemGesture of RecentsAnimationDeviceState.java, there is a possible partial lockscreen bypass due to a rac

In _PMRCreate of the PowerVR kernel driver, a missing bounds check means it is possible to overwrite heap memory via Phy

In PVRSRVBridgeSyncPrimOpCreate of the PowerVR kernel driver, a missing size check means there is a possible integer ove

An arbitrary file upload vulnerability in the component /api/upload.php of ThinkAdmin v6 allows attackers to execute arb

snappy-java is a fast compressor/decompressor for Java. Due to use of an unchecked chunk length, an unrecoverable fatal

cmseasy v7.7.7.7 20230520 was discovered to contain a path traversal vulnerability via the add_action method at lib/admi

Cross-site scripting (XSS) vulnerability in Phpgurukul Cyber Cafe Management System 1.0 allows remote attackers to injec

snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur

snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur

Piwigo 13.7.0 is vulnerable to SQL Injection via the "Users" function.

Cross-Site Request Forgery (CSRF) vulnerability allows arbitrary file upload in Shingo Intrepidity plugin <= 1.5.1 versi

Cross-Site Request Forgery (CSRF) vulnerability in Amit Agarwal Google XML Sitemap for Videos plugin <= 2.6.1 versions.

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Zestard Technologies Admin side data storage for Contact F

A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this is

A vulnerability classified as critical was found in PHPGurukul Rail Pass Management System 1.0. Affected by this vulnera

A vulnerability classified as critical has been found in code-projects Supplier Management System 1.0. Affected is an un

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in IKSWEB WordPress Старт plugin <= 3.7 versions.

Cross-Site Request Forgery (CSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform plugin <= 2.

Cross-Site Request Forgery (CSRF) vulnerability in HasThemes HT Easy GA4 ( Google Analytics 4 ) plugin <= 1.0.6 versions

Cross-Site Request Forgery (CSRF) vulnerability in Oliver Seidel, Bastian Germann cformsII plugin <= 15.0.4 versions.

Due to an error in the software interface to the secure element chip on Bosch IP cameras of family CPP13 and CPP14, the

Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access

During internal security analysis, a local privilege escalation vulnerability has been identified. On a machine with th

The Netskope client service (prior to R96) on Windows runs as NT AUTHORITY\SYSTEM which writes log files to a writable d

Cross-site request forgery (CSRF) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 thro

The Netskope client service running with NT\SYSTEM privileges accepts network connections from localhost to start variou

Cross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4

Open redirect vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Li

IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 could allow a privileged user to upload malicious files of danger

IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 uses an inadequate account lockout setting that could allow a rem

IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 could allow a remote authenticated attacker to execute arbitrary

IBM Security Directory Suite VA 8.0.1 could allow an attacker to cause a denial of service due to uncontrolled resource

IBM Security Directory Suite VA 8.0.1 specifies permissions for a security-critical resource in a way that allows that r

IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 stores user credentials in plain clear text which can be read by

IBM PowerVM Hypervisor FW950.00 through FW950.71, FW1010.00 through FW1010.40, FW1020.00 through FW1020.20, and FW1030.0

IBM Security Guardium 11.3, 11.4, and 11.5 could allow a local user to obtain elevated privileges due to incorrect autho

Grav is a flat-file content management system. In versions 1.7.42 and prior, the "/forgot_password" page has a self-refl

Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side templ

Grav is a flat-file content management system. Prior to version 1.7.42, the denylist introduced in commit 9d6a2d to prev

Grav is a flat-file content management system. Prior to version 1.7.42, there is a logic flaw in the `GravExtension.filt

Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection

An information disclosure vulnerability in the faye endpoint in Proofpoint Threat Response / Threat Response Auto-Pull (

A stored cross-site scripting vulnerability in the Sources UI in Proofpoint Threat Response/ Threat Response Auto Pull (

Netbox 3.5.1 is vulnerable to Cross Site Scripting (XSS) in the "Create Wireless LAN Groups" function.

ink! is an embedded domain specific language to write smart contracts in Rust for blockchains built on the Substrate fra

SoftExpert Excellence Suite 2.1.9 is vulnerable to Cross Site Scripting (XSS) via query screens.

There is a command injection vulnerability in the adslr VW2100 router with firmware version M1DV1.0. An unauthenticated

PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php.

loadImage() in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based use after free via a crafted TIFF image.

A potential security vulnerability has been identified for certain HP multifunction printers (MFPs). The vulnerability m