2023

Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.

An OS command injection vulnerability has been reported to affect QUSBCam2. If exploited, the vulnerability could allow

An integer overflow in Silicon Labs Gecko Bootloader version 4.3.1 and earlier allows unbounded memory access when readi

VMware Workstation( 17.x prior to 17.5) and Fusion(13.x prior to 13.5) contain an out-of-bounds read vulnerability that

The Horizontal scrolling announcement plugin for WordPress is vulnerable to SQL Injection via the plugin's [horizontal-s

The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0

The miniOrange's Google Authenticator plugin for WordPress is vulnerable to authorization bypass due to a missing capabi

The Cyr to Lat plugin for WordPress is vulnerable to authenticated SQL Injection via the 'ctl_sanitize_title' function i

The Jetpack CRM plugin for WordPress is vulnerable to PHAR deserialization via the ‘zbscrmcsvimpf’ parameter in the 'zer

The ImageMagick Engine plugin for WordPress is vulnerable to remote code execution via the 'cli_path' parameter in versi

The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized modification of site options due to a miss

The Brizy plugin for WordPress is vulnerable to authorization bypass due to a incorrect capability check on the is_admin

The Migration, Backup, Staging - WPvivid plugin for WordPress is vulnerable to Sensitive Information Exposure in version

Insufficient blacklisting in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before

Execution of downloaded content flaw in M-Files Web Companion before release version 23.10 and LTS Service Release Versi

The Slimstat Analytics plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to,

The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0

The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Directory Traversal in versions up to, an

Sollace Unicopia version 1.1.1 and before was discovered to deserialize untrusted data, allowing attackers to execute ar

Stored XSS Vulnerability in M-Files Classic Web versions before 23.10 and LTS Service Release Versions before 23.2 LTS S

The WP Cerber Security plugin for WordPress is vulnerable to stored cross-site scripting via the log parameter when logg

The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to unauthorized user interaction in versions

SECUDOS Qiata (DOMOS OS) 4.13 has Insecure Permissions for the previewRm.sh daily cronjob. To exploit this, an attacker

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOC

VMware Aria Operations for Logs contains a deserialization vulnerability. A malicious actor with non-administrative acce

Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerabil

The Home Assistant Companion for iOS and macOS app up to version 2023.4 are vulnerable to Client-Side Request Forgery. A

Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary co

Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is

Home assistant is an open source home automation. Home Assistant server does not set any HTTP security headers, includin

Home assistant is an open source home automation. Whilst auditing the frontend code to identify hidden parameters, Cure5

Home assistant is an open source home automation. The Home Assistant login page allows users to use their local Home Ass

Inadequate encryption strength in mycli 1.27.0 allows attackers to view sensitive information via /mycli/config.py

Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for

An issue discovered in IXP Data EasyInstall 6.6.14907.0 allows attackers to gain escalated privileges via static Cryptog

An issue found in IXP Data Easy Install v.6.6.14884.0 allows a local attacker to gain privileges via a static XOR key.

An issue discovered in IXP Data Easy Install v.6.6.14884.0 allows local attackers to gain escalated privileges via weak

An issue found in IXP Data Easy Install v.6.6.14884.0 allows an attacker to escalate privileges via lack of permissions

In Weintek's cMT3000 HMI Web CGI device, an anonymous attacker can execute arbitrary commands after login to th

An issue found in IXP Data Easy Install 6.6.148840 allows a remote attacker to escalate privileges via insecure PRNG.

The affected product is vulnerable to an improper authentication vulnerability, which may allow an attacker to

Santesoft Sante FFT Imaging lacks proper validation of user-supplied data when parsing DICOM files. This could lead

Sante DICOM Viewer Pro lacks proper validation of user-supplied data when parsing DICOM files. This could lead to an

An out-of-bounds write vulnerability exists in the "HyperLinkFrame" stream parser of Ichitaro 2023 1.0.1.59372. A specia

An integer overflow exists in the "HyperLinkFrame" stream parser of Ichitaro 2023 1.0.1.59372. A specially crafted docum

Sante DICOM Viewer Pro lacks proper validation of user-supplied data when parsing DICOM files. This could lead to a sta

A use-after-free vulnerability exists in the Figure stream parsing functionality of Ichitaro 2023 1.0.1.59372. A special

Yamcs 5.8.6 is vulnerable to directory traversal (issue 1 of 2). The vulnerability is in the storage functionality of th

An out-of-bounds write vulnerability exists within the parsers for both the "DocumentViewStyles" and "DocumentEditStyles

XNSoft Nconvert 7.136 has an Exception Handler Chain Corrupted via a crafted image file. Attackers could exploit this is