2023

Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.

In the module "Orders (CSV, Excel) Export PRO" (ordersexport) < 5.2.0 from MyPrestaModules for PrestaShop, a guest can d

In the module "Product Tag Icons Pro" (ticons) before 1.8.4 from MyPresta.eu for PrestaShop, a guest can perform SQL inj

Jellyfin is a Free Software Media System for managing and streaming media. In affected versions there is an argument inj

An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitra

An issue was discovered in the function gdev_prn_open_printer_seekable() in Artifex Ghostscript through 10.02.0 allows r

A flaw was found in the Quarkus Cache Runtime. When request processing utilizes a Uni cached using @CacheResult and the

Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the

A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read man

AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a PNG Logo file with dange

AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a BMP Logo file with dange

The login REST API in ProLion CryptoSpike 3.0.15P2 (when LDAP or Active Directory is used as the users store) allows a r

TOTOLINK A3002RU version 2.0.0-B20190902.1958 has a post-authentication RCE due to incorrect access control, allows atta

Code injection in Remote Desktop Manager 2023.3.9.3 and earlier on macOS allows an attacker to execute code via the DYLI

Exposure of Proxy Administrator Credentials An authenticated administrator equivalent Filr user can access the credent

The Bluetooth module of some Huawei Smart Screen products has an identity authentication bypass vulnerability. Successf

Mattermost is grouping calls in the /metrics endpoint by id and reports that id in the response. Since this id is the ch

Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf

Permission management vulnerability in the module for disabling Sound Booster. Successful exploitation of this vulnerabi

Vulnerability of unauthorized file access in the Settings app. Successful exploitation of this vulnerability may cause u

Permission verification vulnerability in distributed scenarios. Successful exploitation of this vulnerability may affect

Unauthorized access vulnerability in the card management module. Successful exploitation of this vulnerability may affec

Unauthorized access vulnerability in the Huawei Share module. Successful exploitation of this vulnerability may affect s

Permission management vulnerability in the multi-user module. Successful exploitation of this vulnerability may affect s

Vulnerability of unauthorized access to email attachments in the email module. Successful exploitation of this vulnerabi

Free broadcast vulnerability in the running management module. Successful exploitation of this vulnerability may affect

API permission control vulnerability in the network management module. Successful exploitation of this vulnerability may

Unauthorized access vulnerability in the launcher module. Successful exploitation of this vulnerability may affect servi

Unauthorized access vulnerability in the card management module. Successful exploitation of this vulnerability may affec

Permission management vulnerability in the PMS module. Successful exploitation of this vulnerability may cause privilege

Open redirect vulnerability in Pleasanter 1.3.47.0 and earlier allows a remote unauthenticated attacker to redirect user

Pleasanter 1.3.47.0 and earlier contains an improper access control vulnerability, which may allow a remote authenticate

Vulnerability of missing permission verification for APIs in the Designed for Reliability (DFR) module. Successful explo

Vulnerability of data verification errors in the kernel module. Successful exploitation of this vulnerability may cause

Pleasanter 1.3.47.0 and earlier contains a stored cross-site scripting vulnerability. If this vulnerability is exploited

Ruijie EG Series Routers version EG_3.0(1)B11P216 and before allows unauthenticated attackers to remotely execute arbitr

An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version

A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit openin

The Email Subscription Popup plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the HTTP_REFERER h

Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubn

Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability. An att

This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with

This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject u

Improper input validation vulnerability in Samsung Open Source Escargot allows stack overflow and segmentation fault. Th

A vulnerability has been identified within Serv-U 15.4 that allows an authenticated actor to insert content on the file

Inappropriate implementation in Web Browser UI in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to pote

Inappropriate implementation in Autofill in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to bypass Aut

Use after free in Media Capture in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who convinced a user t

Use after free in Side Panel Search in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who convinced a us

Use after free in Media Stream in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to potentially exploit