2023

Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Tools plugin <= 2.3.1 versions.

Cross-Site Request Forgery (CSRF) vulnerability in Fluenx DeepL API translation plugin <= 2.1.4 versions.

Cross-Site Request Forgery (CSRF) vulnerability in Pierre Lannoy / PerfOps One DecaLog plugin <= 3.7.0 versions.

Cross-Site Request Forgery (CSRF) vulnerability in Teplitsa of social technologies Leyka plugin <= 3.29.2 versions.

Cross-Site Request Forgery (CSRF) vulnerability in WPPOOL Sheets To WP Table Live Sync plugin <= 2.12.15 versions.

Cross-Site Request Forgery (CSRF) vulnerability in AccessPress Themes Social Auto Poster plugin <= 2.1.4 versions.

PowerProtect Agent for File System Version 19.14 and prior, contains an incorrect default permissions vulnerability in

Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace plugin <= 1.3.

A saved encryption key in the Uninstaller in Digital Guardian's Agent before version 7.9.4 allows a local attacker to re

Lack of authentication vulnerability. An unauthenticated local user is able to see through the cameras using the web ser

Missing access permissions checks in the M-Files server before 23.11.13156.0 allow attackers to perform data write and

A possibility of unwanted server memory consumption was detected through the obsolete functionalities in the Rest API me

It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DECE Software Geod

The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. Th

The UserPro plugin for WordPress is vulnerable to sensitive information disclosure via the 'userpro' shortcode in versio

An access control issue in Mercedes me IOS APP v1.34.0 and below allows attackers to view the maintenance orders of othe

An access control issue in Mercedes me IOS APP v1.34.0 and below allows attackers to view the carts of other users via s

Autodesk Customer Support Portal allows cases created by users under an account to see cases created by other users on t

Autodesk users who no longer have an active license for an account can still access cases for that account.

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.1 is vulnerable to cross-

An issue was found with how API keys are created with the Fleet-Server service account. When an API key is created with

It was discovered that a user with Fleet admin permissions could upload a malicious package. Due to using an older versi

Kibana contains an embedded version of the Chromium browser that the Reporting feature uses to generate the downloadable

The Nautobot Device Onboarding plugin uses the netmiko and NAPALM libraries to simplify the onboarding process of a new

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prio

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prio

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prio

A buffer overflow vulnerability was found in the NVM Express (NVMe) driver in the Linux kernel. Only privileged user cou

TorchServe is a tool for serving and scaling PyTorch models in production. Starting in version 0.1.0 and prior to versio

Cap'n Proto is a data interchange format and capability-based RPC system. In versions 1.0 and 1.0.1, when using the KJ H

OpenReplay is a self-hosted session replay suite. In version 1.14.0, due to lack of validation Name field - Account Sett

A vulnerability in the installer script of Cisco AppDynamics PHP Agent could allow an authenticated, local attacker to e

A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, re

A vulnerability in the web-based management interface of a small subset of Cisco IP Phones could allow an authenticated,

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to cond

If an attacker needed a user to load an insecure http: page and knew that user had enabled HTTPS-only mode, the attacker

When an https: web page created a pop-up from a "javascript:" URL, that pop-up was incorrectly allowed to load blockable

Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could be

The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prom

It was possible to cause the use of a MessagePort after it had already been freed, which could potentially have led to a

On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak m

An attacker could have performed HTML template injection via Reader Mode and exfiltrated user information. This vulnerab

Cross Site Scripting in SUP Online Shopping v.1.0 allows a remote attacker to execute arbitrary code via the Name, Email

An Improper Validation of Integrity Check Value in Zscaler Client Connector on Windows allows an authenticated user to d

A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x thr

Stored Cross-site Scripting (XSS) vulnerabilities affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through

The Post Meta Data Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and i

eyoucms v1.6.4 is vulnerable Cross Site Scripting (XSS), which can lead to stealing sensitive information of logged-in u

Dev blog v1.0 allows to exploit an XSS through an unrestricted file upload, together with a bad entropy of filenames. Wi