2023

Arbitrary file upload to web root in the IDAttend’s IDWeb application 3.1.013 allows authenticated attackers to upload d

Stored cross-site scripting in the IDAttend’s IDWeb application 3.1.052 and earlier allows attackers to hijack the brows

Missing authentication in the SearchStudentsRFID method in IDAttend’s IDWeb application 3.1.052 and earlier allows ext

Missing authentication in the SearchStudentsStaff method in IDAttend’s IDWeb application 3.1.052 and earlier allows ext

Missing authentication in the SearchStudents method in IDAttend’s IDWeb application 3.1.052 and earlier allows extractio

Missing authentication in the SetDB method in IDAttend’s IDWeb application 3.1.052 and earlier allows denial of service

Missing authentication in the SetStudentNotes method in IDAttend’s IDWeb application 3.1.052 and earlier allows modific

Missing authentication in the StudentPopupDetails_Timetable method in IDAttend’s IDWeb application 3.1.052 and earlier a

The Hawk Console and Hawk Agent components of TIBCO Software Inc.'s TIBCO Hawk, TIBCO Hawk Distribution for TIBCO Silver

A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject c

Reflected cross-site scripting in the StudentSearch component in IDAttend’s IDWeb application 3.1.052 and earlier allows

A privilege escalation vulnerability was reported in the Lenovo HardwareScanPlugin prior to version 1.3.1.2 and Lenovo

An arbitrary file upload and directory traversal vulnerability exist in the file upload functionality of the System Setu

carRental 1.0 is vulnerable to Incorrect Access Control (Arbitrary File Read on the Back-end System).

The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in

umputun remark42 version 1.12.1 and before has a Blind Server-Side Request Forgery (SSRF) vulnerability.

In International Color Consortium DemoIccMAX 79ecb74, there is an out-of-bounds read in the CIccPRMG::GetChroma function

In International Color Consortium DemoIccMAX 79ecb74, there is a stack-based buffer overflow in the icFixXml function in

IBM Security Verify Governance 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the sys

An issue in OpenImageIO oiio v.2.4.12.0 allows a remote attacker to execute arbitrary code and cause a denial of service

An Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows replacing

Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows Code Injectio

Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Inclusion of Code in Existing Process.

Buffer overflow vulnerability in the signelf library used by Zscaler Client Connector on Linux allows Code Injection. Th

Zscaler Client Connector for macOS prior to 3.7 had an unquoted search path vulnerability via the PATH variable. A local

Authentication Bypass by Capture-replay in SICK Flexi Soft Gateways with Partnumbers 1044073, 1127717, 1130282, 1044074,

An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection

Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.5

pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may

WALLIX Bastion 9.x before 9.0.9 and 10.x before 10.0.5 allows unauthenticated access to sensitive information by bypassi

Knot Resolver before 5.7.0 performs many TCP reconnections upon receiving certain nonsensical responses from servers.

The zanllp sd-webui-infinite-image-browsing (aka Infinite Image Browsing) extension before 977815a for stable-diffusion-

The web administration interface in NetModule Router Software (NRSW) 4.6 before 4.6.0.106 and 4.8 before 4.8.0.101 execu

link_to_local_path in ebooks/conversion/plugins/html_input.py in calibre before 6.19.0 can, by default, add resources ou

Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached

An issue in ThingNario Photon v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via a cra

The Soisy Pagamento Rateale plugin for WordPress is vulnerable to unauthorized access of data due to a missing capabilit

An issue was discovered in SuperWebMailer 9.00.0.01710. It allows Remote Code Execution via a crafted sendmail command l

An issue was discovered in SuperWebMailer 9.00.0.01710. It allows Export SQL Injection via the size parameter.

stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory writ

stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allo

stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of boun

stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of boun

stb_image is a single file MIT licensed library for processing images. It may look like `stbi__load_gif_main` doesn’t g

stb_image is a single file MIT licensed library for processing images. A crafted image file can trigger `stbi__load_gif_

In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrar

reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform sc

pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious `

Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.2.2.

Cross-Site Request Forgery (CSRF) in GitHub repository mosparo/mosparo prior to 1.0.3.