2023

ChangingTec MOTP system has a path traversal vulnerability. A remote attacker with administrator’s privilege can exploit

aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ asynchronized message

aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ interpreter. An unauth

Nanoleaf firmware v7.1.1 and below is missing TLS verification, allowing attackers to execute arbitrary code via a DNS h

An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppUp

An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppUp

An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppDM

An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The decry

Reflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated pr

The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password

Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to f

Incorrect access control in the runReport function of MyQ Solution Print Server before 8.2 Patch 32 and Central Server b

Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially craft

typed-rest-client is a library for Node Rest and Http Clients with typings for use with TypeScript. Users of the typed-r

ESPv2 is a service proxy that provides API management capabilities using Google Service Infrastructure. ESPv2 2.20.0 thr

Payload is a free and open source headless content management system. In versions prior to 1.7.0, if a user has access t

vConsole v3.15.0 was discovered to contain a prototype pollution due to incorrect key and value resolution in setOptions

Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine

Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and

Zoho ManageEngine Applications Manager before 16400 allows proxy.html DOM XSS.

Buffer Overflow vulnerability found in Netgear R6900 v.1.0.2.26, R6700v3 v.1.0.4.128, R6700 v.1.0.0.26 allows a remote a

Cross Site Scripting vulnerability found in Exelysis Unified Communication Solutions (EUCS) v.1.0 allows a remote attack

Insecure Permission vulnerability found in Wondershare Dr.Fone v.12.9.6 allows a remote attacker to escalate privileges

Buffer Overflow vulnerability found in ByronKnoll Cmix v.19 allows an attacker to execute arbitrary code and cause a den

HCL Workload Automation is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remot

HCL Workload Automation 9.4, 9.5, and 10.1 are vulnerable to an XML External Entity Injection (XXE) attack when processi

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of serv

Sangoma FreePBX 1805 through 2302 (when obtained as a ,.ISO file) places AMPDBUSER, AMPDBPASS, AMPMGRUSER, and AMPMGRPAS

Denial of service due to unauthenticated API endpoint. The following products are affected: Acronis Agent (Windows, macO

Insecure Permission vulnerability found in Yoyager v.1.4 and before allows a remote attacker to execute arbitrary code v

The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gain

Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic an

Contiki-NG is an operating system for Internet of Things devices. An off-by-one error can be triggered in the Antelope d

Buffer Overflow vulnerability found in XPDF v.4.04 allows an attacker to cause a Denial of Service via the PDFDoc malloc

A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument

libming 0.4.8 0.4.8 is vulnerable to Buffer Overflow. In getInt() in decompile.c unknown type may lead to denial of serv

The Splus Server component of TIBCO Software Inc.'s TIBCO Spotfire Statistics Services contains a vulnerability that all

OURPHP <= 7.2.0 is vulnerale to Cross Site Scripting (XSS) via /client/manage/ourphp_out.php.

Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0.

OURPHP <= 7.2.0 is vulnerable to SQL Injection.

OURPHP <= 7.2.0 is vulnerable to Cross Site Scripting (XSS) via ourphp_tz.php.

A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML v

Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to arbitrarily reset passwords via a

Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Pr

Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user

Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading a

The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed

CLTPHP <=6.0 is vulnerable to Improper Input Validation via application/admin/controller/Template.php.

CLTPHP <=6.0 is vulnerable to Cross Site Scripting (XSS) via application/home/controller/Changyan.php.

CLTPHP <=6.0 is vulnerable to Unrestricted Upload of File with Dangerous Type.