2023

IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 stores user credentials in plain clear text

An insecure password reset issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 service via ins

An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to gain access to sensi

IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remot

IBM Aspera Faspex 4.4.2 could allow a remote authenticated attacker to obtain sensitive credential information using sp

IBM Aspera Faspex 4.4.2 could allow a remote attacker to obtain sensitive credential information for an external user, u

Insecure Permissions vulnerability found in Extplorer File manager eXtplorer v.2.1.15 allows a remote attacker to execut

IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1 , and 4.1.1 could allow a remote attacker to traverse d

IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to obtain

A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could

A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could allow the r

x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains wh

x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains wh

x86 shadow plus log-dirty mode use-after-free In environments where host assisted address translation is necessary but H

x86: speculative vulnerability in 32bit SYSCALL path Due to an oversight in the very original Spectre/Meltdown security

A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause acces

A vulnerability has been discovered in cloudflared's installer (<= 2023.3.0) for Windows 32-bits devices that allows a l

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pacsrapor allows R

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pacsrapor allows S

A CWE-20: Improper Input Validation vulnerability exists in Custom Reports that could cause a macro to be executed, pote

SQL Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.

A vulnerability has been found in Ydalb mapicoin up to 1.9.0 and classified as problematic. This vulnerability affects u

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Custom Reports that could

A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpreta

Authorization Bypass Through User-Controlled Key vulnerability in Vadi Corporate Information Systems DigiKent allows Aut

A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause manip

A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could

Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Galaxy Weblinks Gallery with thumbnail slider plugin <=

Auth. (contributor+) Cross-Site Scripting vulnerability in TCBarrett WP Glossary plugin <= 3.1.2 versions.

Auth. (contributor+) Stored Cross-Site Scripting vulnerability in Galleryape Gallery Images Ape plugin <= 2.2.8 versions

Insufficient Session Expiration in GitHub repository answerdev/answer prior to 1.0.6.

Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.

Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.

Observable Response Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.

Improper Restriction of Excessive Authentication Attempts in GitHub repository answerdev/answer prior to 1.0.6.

Observable Timing Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.

Authentication Bypass by Capture-replay in GitHub repository answerdev/answer prior to 1.0.6.

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.

Cross-site Scripting (XSS) - Generic in GitHub repository tsolucio/corebos prior to 8.0.

A vulnerability was found in 404like Plugin up to 1.0.2 on WordPress. It has been classified as critical. Affected is th

An information disclosure vulnerability exists in the User authentication functionality of WellinTech KingHistorian 35.0

An integer conversion vulnerability exists in the SORBAx64.dll RecvPacket functionality of WellinTech KingHistorian 35.0

Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticat

Galaxy is an open-source platform for data analysis. All supported versions of Galaxy are affected prior to 22.01, 22.05

Rapid7 InsightVM versions 6.6.178 and lower suffers from an open redirect vulnerability, whereby an attacker has the abi

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to e

HTML Email Injection in Tribe29 Checkmk <=2.1.0p23; <=2.0.0p34, and all versions of Checkmk 1.6.0 allows an authenticate

Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.19.

The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not imple