2023

The <code>Content-Security-Policy-Report-Only</code> header could allow an attacker to leak a child iframe's unredacted

Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 108. Some of these bugs s

Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 108 and Firefox ESR 102.6

A duplicate `SystemPrincipal` object could be created when parsing a non-system html document via `DOMParser::ParseFromS

Regular expressions used to filter out forbidden properties and values from style directives in calls to `console.log` w

A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src head

Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to webs

Per origin notification permissions were being stored in a way that didn't take into account what browsing context the p

When copying a network request from the developer tools panel as a curl command the output was not being properly saniti

Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing f

A compromised web child process could disable web security opening restrictions, leading to a new child process being sp

Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable cr

An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12

If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and d

OCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certif

Certificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed with a revoked certific

A vulnerability classified as critical has been found in Campcodes Retro Cellphone Online Store 1.0. Affected is an unkn

Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.59.4.

ChuanhuChatGPT is a graphical user interface for ChatGPT and many large language models. A vulnerability in versions 202

Buffer overflow in Platform CLI component in Silicon Labs Gecko SDK v4.2.1 and earlier allows user to overwrite limited

SQL injection vulnerability in the City Autocomplete (cityautocomplete) module from ebewe.net for PrestaShop, prior to v

A vulnerability was found in code-projects Agro-School Management System 1.0. It has been classified as critical. Affect

A vulnerability was found in code-projects Agro-School Management System 1.0 and classified as critical. This issue affe

A vulnerability has been found in code-projects Agro-School Management System 1.0 and classified as problematic. This vu

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.

ReadyMedia (MiniDLNA) versions from 1.1.15 up to 1.3.2 is vulnerable to Buffer Overflow. The vulnerability is caused by

A vulnerability, which was classified as critical, was found in SourceCodester Online Exam Form Submission 1.0. This aff

A vulnerability was found in 07FLY CRM up to 1.2.0. It has been declared as problematic. This vulnerability affects unkn

A vulnerability was found in YFCMF up to 3.0.4. It has been rated as problematic. This issue affects some unknown proces

Incorrect Authorization vulnerability in Mobatime web application allows Privilege Escalation, Exploiting Incorrectly Co

Unrestricted Upload of File with Dangerous Type vulnerability in Mobatime web application (Documentary proof upload modu

Improper Limitation of a Pathname leads to a Path Traversal vulnerability in the module King-Avis for Prestashop, allowi

A vulnerability was found in YFCMF up to 3.0.4. It has been declared as problematic. This vulnerability affects unknown

Reflected Cross Site Scripting (XSS) in the view dashboard detail feature in Microworld Technologies eScan management co

mp4v2 v2.1.3 was discovered to contain a memory leak when a method calling MP4File::ReadBytes() had allocated memory but

An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operat

Bluetooth Classic in Bluetooth Core Specification through 5.3 does not properly conceal device information for Bluetooth

It is identified a vulnerability of insufficient authentication in the system configuration interface of Hitron Technolo

Hitron Technologies CODA-5310 Telnet function with the default account and password, and there is no warning or prompt t

Hitron Technologies CODA-5310’s Telnet function transfers sensitive data in plaintext. An unauthenticated remote attacke

Openfind Mail2000 has insufficient filtering special characters of email content of its content filtering function. A re

Furbo dog camera has insufficient filtering for special parameter of device log management function. An unauthenticated

ASUS RT-AC86U’s specific cgi function has a stack-based buffer overflow vulnerability due to insufficient validation for

ASUS RT-AC86U does not filter special characters for parameters in specific web URLs. A remote attacker with normal user

ELITE TECHNOLOGY CORP. Web Fax has a vulnerability of SQL Injection. An unauthenticated remote attacker can inject SQL c

OMICARD EDM backend system’s file uploading function does not restrict upload of file with dangerous type. A local area

Wade Graphic Design FANTSY has a vulnerability of insufficient filtering for file type in its file update function. An a

Wade Graphic Design FANTSY has a vulnerability of insufficient authorization check. An unauthenticated remote user can e

It is identified a vulnerability of insufficient authentication in an important specific function of Status PowerBPM. A

Hitron CODA-5310 has hard-coded encryption/decryption keys in the program code. A remote attacker authenticated as an ad