2023

The Ruby Help Desk WordPress plugin before 1.3.4 does not ensure that the ticket being modified belongs to the user maki

The SMTP Mailing Queue WordPress plugin before 2.0.1 does not sanitise and escape some of its settings, which could allo

The amr ical events lists WordPress plugin through 6.6 does not sanitise and escape some of its settings, which could al

The ZYREX POPUP WordPress plugin through 1.0 does not validate the type of files uploaded when creating a popup, allowin

The StagTools WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputt

Transient DOS due to reachable assertion in Modem when UE received Downlink Data Indication message from the network.

Information disclosure due to buffer over-read in Trusted Execution Environment while QRKS report generation.

Memory Corruption in Graphics while accessing a buffer allocated through the graphics pool.

Memory corruption in Graphics while importing a file.

Memory corruption in HAB Memory management due to broad system privileges via physical address.

Transient DOS due to reachable assertion in Modem while processing config related to cross carrier scheduling, which is

Information disclosure due to buffer over-read in Modem while parsing DNS hostname.

Transient DOS due to reachable assertion in Modem during OSI decode scheduling.

Transient DOS due to NULL pointer dereference in Modem while sending invalid messages in DCCH.

Transient DOS due to NULL pointer dereference in Modem while performing pullup for received TCP/UDP packet.

Memory corruption in Qualcomm IPC due to use after free while receiving the incoming packet and reposting it.

Memory corruption due to improper validation of array index in computer vision while testing EVA kernel without sending

Memory corruption in Automotive due to Improper Restriction of Operations within the Bounds of a Memory Buffer while exp

In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function

3CX before 18 Hotfix 1 build 18.0.3.461 on Windows allows unauthenticated remote attackers to read %WINDIR%\system32 fil

3CX before 18 Update 2 Security Hotfix build 18.0.2.315 on Windows allows unauthenticated remote attackers to read certa

A vulnerability classified as problematic was found in BestWebSoft Job Board Plugin 1.0.0 on WordPress. This vulnerabili

A vulnerability, which was classified as problematic, has been found in Mail Subscribe List Plugin up to 2.0.10 on WordP

Archer Platform 6.8 before 6.12 P6 HF1 (6.12.0.6.1) contains a stored XSS vulnerability. A remote authenticated maliciou

Cleartext Transmission in cookie:ecos_pw: in Tenda N301 v6.0, firmware v12.03.01.06_pt allows an authenticated attacker

Cleartext Transmission in set-cookie:ecos_pw: Tenda N301 v6.0, Firmware v12.02.01.61_multi allows an authenticated attac

An issue was discovered in KaiOS 3.0. The pre-installed Communications application exposes a Web Activity that returns t

An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio an

An issue discovered in Konga 0.14.9 allows remote attackers to manipulate user accounts regardless of privilege via craf

HashiCorp Vault Enterprise 1.13.0 up to 1.13.1 is vulnerable to a padding oracle attack when using an HSM in conjunction

OpenText BizManager before 16.6.0.1 does not perform proper validation during the change-password operation. This allows

A buffer overflow vulnerability in the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remot

A format string vulnerability in a binary of the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could all

A buffer overflow vulnerability in the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remot

A cross-site scripting (XSS) vulnerability in the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could al

The post-authentication command injection vulnerability in the Zyxel NBG6604 firmware version V1.01(ABIR.0)C0 could allo

Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of a

A vulnerability was found in SourceCodester Online DJ Management System 1.0 and classified as critical. This issue affec

Cross Site Scripting (XSS) vulnerability in PerfreeBlog 3.1.2 allows attackers to execute arbitrary code via the Post fu

Cross Site Scripting (XSS) vulnerability in pandao editor.md thru 1.5.0 allows attackers to inject arbitrary web script

Cross site scripting (XSS) vulnerability in ZHENFENG13 My-Blog, allows attackers to inject arbitrary web script or HTML

Cross Site Scripting (XSS) vulnerability in WinterChenS my-site before commit 3f0423da6d5200c7a46e200da145c1f54ee18548,

Cross Site Scripting (XSS) vulnerability in Qbian61 forum-java, allows attackers to inject arbitrary web script or HTML

Cross site scripting (XSS) vulnerability in ZHENFENG13 My-Blog, allows attackers to inject arbitrary web script or HTML

File upload vulnerability in Antabot White-Jotter v0.2.2, allows remote attackers to execute malicious code via the file

A potential security vulnerability has been identified in HPE ProLiant RL300 Gen11 Server. The vulnerability could resul

A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined

A valid, authenticated XCC user with read only access may gain elevated privileges through a specifically crafted API ca

A directory permissions management vulnerability in Lenovo System Update may allow elevation of privileges.

A certificate validation vulnerability exists in the Baiying Android application which could lead to information disclos