2023

Use after free in OS Inputs in Google Chrome on ChromeOS prior to 113.0.5672.63 allowed a remote attacker who convinced

Insufficient validation of untrusted input in Extensions in Google Chrome prior to 113.0.5672.63 allowed an attacker who

Inappropriate implementation in Prompts in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to bypass perm

Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.7.0 allow a global buffer overflo

Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environm

In Nokia One-NDS (aka Network Directory Server) through 20.9, some Sudo permissions can be exploited by some users to es

Multiple components (such as Onlinetemplate-Verwaltung, Liste aller Teilbereiche, Umfragen anzeigen, and questionnaire p

The parameters nutzer_titel, nutzer_vn, and nutzer_nn in the user profile, and langID and ONLINEID in direct links, in e

A SQL injection issue in Logbuch in evasys before 8.2 Build 2286 and 9.x before 9.0 Build 2401 allows authenticated atta

The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external Wiki

The vulnerability was found Moodle which exists because the application allows a user to control path of the older to cr

An issue in the time-based authentication mechanism of Aigital Aigital Wireless-N Repeater Mini_Router v0.131229 allows

GL.iNET MT3000 4.1.0 Release 2 is vulnerable to OS Command Injection via /usr/lib/oui-httpd/rpc/logread.

European Chemicals Agency IUCLID before 6.27.6 allows remote authenticated users to execute arbitrary code via Server Si

European Chemicals Agency IUCLID 6.x before 6.27.6 allows authentication bypass because a weak hard-coded secret is used

Incorrect input validation for the default-storage-path in the settings page in Jedox 2020.2.5 allows remote, authentica

A Stored cross-site scripting vulnerability in Jedox 2020.2.5 allows remote, authenticated users to inject arbitrary web

The integrator in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to create Jobs to execute arbitrary code v

A Directory Traversal vulnerability in /be/erpc.php in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to ex

Improper Access Control in /tc/rpc in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to view details of dat

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containi

RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.

Zammad 5.3.x (Fixed in 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker with agent and custom

Zammad 5.3.x (Fixed 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker could gain information a

OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4.

D-Link DIR-868L Hardware version A1, firmware version 1.12 is vulnerable to Buffer Overflow. The vulnerability is in sca

A vulnerability was found in Funadmin up to 3.2.3. It has been declared as problematic. Affected by this vulnerability i

A vulnerability was found in Dromara J2eeFAST up to 2.6.0. It has been classified as problematic. Affected is an unknown

Improper access control in Subscriptions Folder path filter in Devolutions Server 2023.1.1 and earlier allows attackers

A vulnerability was found in Dromara J2eeFAST up to 2.6.0 and classified as problematic. This issue affects some unknown

A vulnerability has been found in Rebuild 3.2 and classified as problematic. This vulnerability affects unknown code. Th

A vulnerability was found in Dreamer CMS up to 4.1.3. It has been declared as problematic. This vulnerability affects th

A Cross-site scripting (XSS) vulnerability in the System Log/General Log page of the administrator web UI in ASUS RT-AC5

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Winwar Media WP Email Capture plugin <= 3.9.3 versions

Improper Authentication vulnerability in Easy Digital Downloads plugin allows unauth. Privilege Escalation. This issue a

** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option s

Transmission of credentials within query parameters in Checkmk <= 2.1.0p26, <= 2.0.0p35, and <= 2.2.0b6 (beta) may cause

Mattermost Desktop App fails to validate a mattermost server redirection and navigates to an arbitrary website

The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user

The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are alrea

The Limit Login Attempts WordPress plugin through 1.7.2 does not sanitize and escape usernames when outputting them back

The Download Manager WordPress plugin before 6.3.0 leaks master key information without the need for a password, allowin

The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the page parameter

The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the edit parameter

The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL stateme

The SEOPress WordPress plugin before 6.5.0.3 unserializes user input provided via the settings, which could allow high-p

The WP Custom Author URL WordPress plugin before 1.0.5 does not sanitise and escape some of its settings, which could al

The Quick Paypal Payments WordPress plugin before 5.7.26.4 does not sanitise and escape some of its settings, which coul

The MyCryptoCheckout WordPress plugin before 2.124 does not escape some URLs before outputting them in attributes, leadi

The Site Reviews WordPress plugin before 6.7.1 does not sanitise and escape some of its settings, which could allow high