2023

Kubernetes secrets-store-csi-driver in versions before 1.3.3 discloses service account tokens in logs.

Aria Operations for Networks contains an information disclosure vulnerability. A malicious actor with network access to

Aria Operations for Networks contains an authenticated deserialization vulnerability. A malicious actor with network acc

Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware

alist <=3.16.3 is vulnerable to Incorrect Access Control. Low privilege accounts can upload any file.

VMware Tools for Windows (12.x.y prior to 12.1.5, 11.x.y and 10.x.y) contains a denial-of-service vulnerability in the V

The 10Web Photo Gallery plugin through 1.5.69 for WordPress allows XSS via theme_id for bwg_frontend_data. NOTE: other p

The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on t

The WooCommerce Multi Currency plugin for WordPress is vulnerable to authorization bypass due to a missing capability ch

Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability

The Adning Advertising plugin for WordPress is vulnerable to file deletion via path traversal in versions up to, and inc

The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation

Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME Business Hub before 1.4.0 has left users vulne

Apache Guacamole 0.9.10 through 1.5.1 may continue to reference a freed RDP audio input buffer. Depending on timing, thi

Apache Guacamole 1.5.1 and older may incorrectly calculate the lengths of instruction elements sent during the Guacamole

The Web Frontend of KNIME Business Hub before 1.4.0 allows an unauthenticated remote attacker to access internals about

A heap-based overflow vulnerability in TA prior to version 5.7.9 allows a remote user to alter the page heap in the mac

A command Injection Vulnerability in TA for mac-OS prior to version 5.7.9 allows local users to place an arbitrary file

On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send broadcast events to

On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send a specially crafted

TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerabili

TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a buffer overflow via the compo

TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a buffer overflow via the compo

Due to failure in validating the length provided by an attacker-crafted IEEE-C37.118 packet, Wireshark version 4.0.5 and

Due to failure in validating the length provided by an attacker-crafted MSMMS packet, Wireshark version 4.0.5 and prior,

Due to failure in validating the length provided by an attacker-crafted RTPS packet, Wireshark version 4.0.5 and prior,

The B2BKing plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the '

The B2BKing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on

The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check

Imperial CMS v7.5 was discovered to contain an arbitrary file deletion vulnerability via the DelspReFile function in /sp

An arbitrary file upload vulnerability in /admin.php?c=upload of phpok v6.4.100 allows attackers to execute arbitrary co

Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that

The AdSanity plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aj

The FlyingPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX

The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to page content injection in versions up to, and includi

The Recently plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the fet

The uListing plugin for WordPress is vulnerable to authorization bypass via wp_route due to missing capability checks, a

The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and in

The Doneren met Mollie plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2

The WooCommerce Multi Currency plugin for WordPress is vulnerable to Missing Authorization in versions up to, and inclu

The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on t

The WordPress Automatic Plugin for WordPress is vulnerable to arbitrary options updates in versions up to, and including

The Better Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5

The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versi

The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Setting Changs in versions up to, and including, 5.5.

The uListing plugin for WordPress is vulnerable to authorization bypass as most actions and endpoints are accessible to

The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Content Injection in versions up to, and

The Frontend File Manager plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and inc

The Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Opti

The PWA for WP & AMP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the