2023

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Spider Teams ApplyOnline – Application Form Builder and Ma

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in POSIMYTH Nexter Extension plugin <= 2.0.3 versions.

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in EventPrime EventPrime – Events Calendar, Bookings and Tick

File Upload vulnerability in zzzCMS v.2.1.9 allows a remote attacker to execute arbitrary code via a crafted file to the

The Android Client application, when enrolled with the define method 1 (the user manually inserts the server ip address

The Android Client application, when enrolled with the define method 1(the user manually inserts the server ip address),

An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted reque

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The OGC

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote at

A vulnerability in the ClearPass OnGuard Linux agent could allow malicious users on a Linux instance to elevate their us

The vulnerability allows a low privileged (untrusted) application to modify a critical system property that should be d

EisBaer Scada - CWE-749: Exposed Dangerous Method or Function

EisBaer Scada - CWE-256: Plaintext Storage of a Password

EisBaer Scada - CWE-321: Use of Hard-coded Cryptographic Key

EisBaer Scada - CWE-285: Improper Authorization

EisBaer Scada - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EisBaer Scada - CWE-732: Incorrect Permission Assignment for Critical Resource

EisBaer Scada - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The vulnerability allows an unprivileged(untrusted) third-party application to interact with a content-provider unsafely

The vulnerability allows an unprivileged (untrusted) third- party application to arbitrary modify the server settings of

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The WMS

The vulnerability allows an unprivileged user with access to the subnet of the TPC-110W device to gain a root shell on t

A vulnerability was reported in Elliptic Labs Virtual Lock Sensor for ThinkPad T14 Gen 3 that could allow an attacker wi

Grafana is an open-source platform for monitoring and observability. The WorldMap panel plugin, versions before 1.0.4

A first-factor authentication bypass vulnerability exists in the PingFederate with PingID Radius PCV when a MSCHAP authe

The leakage of the client secret in Onigiriya-musubee Line 13.6.1 allows attackers to obtain the channel access token an

The leakage of the client secret in REGINA SWEETS&BAKERY Line 13.6.1 allows attackers to obtain the channel access token

The leakage of the client secret in Matsuya Line 13.6.1 allows attackers to obtain the channel access token and send cra

The leakage of the client secret in Fukunaga_memberscard Line 13.6.1 allows attackers to obtain the channel access token

The leakage of the client secret in Uomasa_Saiji_news Line 13.6.1 allows attackers to obtain the channel access token an

The leakage of the client secret in VISION MEAT WORKS TrackDiner10/10_mc Line v13.6.1 allows attackers to obtain the cha

The leakage of the client secret in TonTon-Tei Line v13.6.1 allows attackers to obtain the channel access token and send

The leakage of the client secret in Tokueimaru_waiting Line 13.6.1 allows attackers to obtain the channel access token a

ReDos in NPMJS Node Email Check v.1.0.4 allows an attacker to cause a denial of service via a crafted string to the scpS

PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authenti

PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java

A logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition. When a p

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with t

Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate Iden

iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, on `pages/UI.php`,

iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, when displaying `pa

jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less.

A remote code execution issue exists in HPE OneView.

Missing authentication in the StudentPopupDetails_EmergencyContactDetails method in IDAttend’s IDWeb application

Missing authentication in the StudentPopupDetails_StudentDetails method in IDAttend’s IDWeb application 3.1.052 an

Missing authentication in the StudentPopupDetails_ContactDetails method in IDAttend’s IDWeb application 3.1.052 an

Missing authentication in the GetAssignmentsDue method in IDAttend’s IDWeb application 3.1.052 and earlier allows e

Missing authentication in the GetStudentGroupStudents method in IDAttend’s IDWeb application 3.1.052 and earlier all

Missing authentication in the GetActiveToiletPasses method in IDAttend’s IDWeb application 3.1.052 and earlier allows

Unauthenticated arbitrary file read in the IDAttend’s IDWeb application 3.1.013 allows the retrieval of any file present