2023

An attacker having physical access to WDM can plug USB device to gain access and execute unwanted commands. A malicious

Use of Insufficiently Random Values in Honeywell OneWireless. This vulnerability may allow attacker to manipulate claim

PowerPath for Windows, versions 7.0, 7.1 & 7.2 contains License Key Stored in Cleartext vulnerability. A local user wit

PowerPath for Windows, versions 7.0, 7.1 & 7.2 contains DLL Hijacking Vulnerabilities. A regular user (non-admin) can e

PowerPath for Windows, versions 7.0, 7.1 & 7.2 contains Insecure File and Folder Permissions vulnerability. A regular u

RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process

RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process

Dell NetWorker, contains an Improper Validation of Certificate with Host Mismatch vulnerability in Rabbitmq port which

VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. An unauthenticated m

Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22.

Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23.

A vulnerability, which was classified as problematic, has been found in Abstrium Pydio Cells 4.2.0. This issue affects s

A vulnerability classified as critical was found in Abstrium Pydio Cells 4.2.0. This vulnerability affects unknown code

A vulnerability classified as critical has been found in Abstrium Pydio Cells 4.2.0. This affects an unknown part of the

A vulnerability was found in Abstrium Pydio Cells 4.2.0. It has been rated as problematic. Affected by this issue is som

Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Imp

Prestashop salesbooster <= 1.10.4 is vulnerable to Incorrect Access Control via modules/salesbooster/downloads/download.

Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar ima

A vulnerability, which was classified as problematic, has been found in SourceCodester Students Online Internship Timesh

Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3.

The privilege escalation vulnerability in the Zyxel GS1900-8 firmware version V2.70(AAHH.3) and the GS1900-8HP firmwar

Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user runn

The Easy Forms for Mailchimp WordPress plugin before 6.8.9 does not sanitise and escape a parameter before outputting it

The Add to Feedly WordPress plugin through 1.2.11 does not sanitize and escape its settings, allowing high-privilege use

The Loginizer WordPress plugin before 1.7.9 does not escape a parameter before outputting it back in the page, leading t

The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing file operati

The Orbit Fox by ThemeIsle WordPress plugin before 2.10.24 does not limit URLs which may be used for the stock photo imp

The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.7 does not sanitize and escape some URL paramet

The Login rebuilder WordPress plugin before 2.8.1 does not sanitise and escape some of its settings, which could allow h

The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the get_su

The Autoptimize WordPress plugin before 3.1.7 does not sanitise and escape the settings imported from a previous export,

The Fast & Effective Popups & Lead-Generation for WordPress plugin before 2.1.4 concatenates user input into an SQL quer

The Custom 404 Pro WordPress plugin before 3.7.3 does not escape some URLs before outputting them in attributes, leading

The WP Fastest Cache WordPress plugin before 1.1.5 does not have CSRF check in an AJAX action, and does not validate use

The Download Manager WordPress plugin before 3.2.71 does not adequately validate passwords for password-protected files.

The Newsletter Popup WordPress plugin through 1.2 does not have CSRF checks in some places, which could allow attackers

The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow u

The AnyWhere Elementor WordPress plugin before 1.2.8 discloses a Freemius Secret Key which could be used by an attacker

The Elementor Website Builder WordPress plugin before 3.12.2 does not properly sanitize and escape the Replace URL param

The OSM WordPress plugin through 6.01 does not validate and escape some of its shortcode attributes, which could allow u

Minio Console is the UI for MinIO Object Storage. Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the orig

Kyverno is a policy engine designed for Kubernetes. Kyverno seccomp control can be circumvented. Users of the podSecurit

Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any for

Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisio

Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and ch

Calendar app for Nextcloud easily sync events from various devices with your Nextcloud. Some internal paths of the websi

A vulnerability classified as problematic was found in MindSpore 2.0.0-alpha/2.0.0-rc1. This vulnerability affects the f

Minecraft through 1.19 and 1.20 pre-releases before 7 (Java) allow arbitrary file overwrite, and possibly code execution

tgstation-server is a production scale tool for BYOND server management. The DreamMaker API (DMAPI) chat channel cache c

Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. The unsani