2023

Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS allows users to uplo

PostHog-js is a library to interface with the PostHog analytics tool. Versions prior to 1.57.2 have the potential for cr

Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects suppl

Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was fo

CKAN is an open-source data management system for powering data hubs and data portals. Multiple vulnerabilities have bee

Nextcloud server is an open source personal cloud implementation. Missing brute-force protection on the WebDAV endpoints

Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was fo

CloudExplorer Lite is an open source cloud management tool. In affected versions users can add themselves to any organiz

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based

CloudExplorer Lite is an open source cloud management platform. In CloudExplorer Lite prior to version 1.1.0 users organ

Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification. Referring to [GHSA-85

NextCloud Cookbook is a recipe library app. Prior to commit a46d9855 on the `master` branch and commit 489bb744 on the `

There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the Linux kernel. This flaw all

NetApp Blue XP Connector versions prior to 3.9.25 expose information via a directory listing. A new Connector architectu

XSS vulnerability from InstantPlay in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API

InstantPlay which included vulnerable script which could execute javascript in Galaxy Store prior to version 4.5.49.8 al

Improper scheme validation from InstantPlay Deeplink in Galaxy Store prior to version 4.5.49.8 allows attackers to execu

Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. T

Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output i

Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when

Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS S

GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or cra

NetScaler file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture

BLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file

VMS TCPIPtrace file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted ca

Candump log parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture fi

BLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file

An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously u

An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patt

A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for reso

A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's publ

An issue was discovered in Papaya Viewer 1.0.1449. User-supplied input in form of DICOM or NIFTI images can be loaded in

Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthentic

Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the U

Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination s

Nextcloud server provides a home for data. A regression in the session handling between Nextcloud Server and the Nextclo

A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_

Bottles before 51.0 mishandles YAML load, which allows remote code execution via a crafted file.

NSX-T contains a reflected cross-site scripting vulnerability due to a lack of input validation. A remote attacker can i

A vulnerability was found in the avahi library. This flaw allows an unprivileged user to make a dbus call, causing the a

A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authent

A flaw was found in Keycloak. This flaw depends on a non-default configuration "Revalidate Client Certificate" to be ena

A stored cross-site scripting (XSS) vulnerability in TFDi Design smartCARS 3 v0.7.0 and below allows attackers to execut

A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another use

The hwPartsDFR module has a vulnerability in API calling verification. Successful exploitation of this vulnerability may

The SDK for the MediaPlaybackController module has improper permission verification. Successful exploitation of this vul

The Gallery app has the risk of hijacking attacks. Successful exploitation of this vulnerability may cause download fail

A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including

A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock.