2023

Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Par

Nextcloud server is a self hosted home cloud product. In affected versions the `OC\Files\Node\Folder::getFullPath()` fun

Misskey is an open source, decentralized social media platform. In versions prior to 13.5.0 the link to the instance to

A vulnerability classified as critical has been found in SourceCodester Sales Tracker Management System 1.0. Affected is

A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been rated as critical. This issue affects so

A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been declared as critical. This vulnerability

A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been classified as critical. This affects an

Unauthenticated, stored cross-site scripting in the display of alarm reduction keys in multiple versions of OpenNMS Hori

The BusinessConnect UI component of TIBCO Software Inc.'s TIBCO BusinessConnect contains easily exploitable Reflected Cr

A vulnerability was found in SeaCMS 11.6 and classified as problematic. Affected by this issue is some unknown functiona

An authenticated user can exploit a vulnerability in the IBM Spectrum Virtualize 8.2, 8.3, 8.4, and 8.5 GUI to execute c

IBM Spectrum Virtualize 8.3, 8.4, and 8.5 could disclose SNMPv3 server credentials to an authenticated user in log files

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.7 and 6.1.0.0 through 6.1.2.0 is vulnerable to cross-

The BusinessConnect UI component of TIBCO Software Inc.'s TIBCO BusinessConnect contains an easily exploitable vulnerabi

The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows

The Web Application component of TIBCO Software Inc.'s TIBCO EBX and TIBCO Product and Service Catalog powered by TIBCO

TP-Link router TL-WR940N V6 3.19.1 Build 180119 uses a deprecated MD5 algorithm to hash the admin password used for basi

An issue was discovered in the Linux kernel through 6.2.0-rc2. drivers/tty/vcc.c has a race condition and resultant use-

Cellinx NVT v1.0.6.002b was discovered to contain a local file disclosure vulnerability via the component /cgi-bin/GetFi

Cloudflow contains a unauthenticated file upload vulnerability, which makes it possible for an attacker to upload malici

Local File Inclusion vulnerability within Cloudflow allows attackers to retrieve confidential information from the syste

Cross-site Scripting (XSS) - Reflected in GitHub repository modoboa/modoboa prior to 2.0.5.

The mono package before 6.8.0.105+dfsg-3.3 for Debian allows arbitrary code execution because the application/x-ms-dos-e

MvcTools 6d48cd6830fc1df1d8c9d61caa1805fd6a1b7737 was discovered to contain a code execution backdoor via the request pa

hour_of_code_python_2015 commit 520929797b9ca43bb818b2e8f963fb2025459fa3 was discovered to contain a code execution back

Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3.

In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Serv

VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injectio

VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. A malicious actor, with non-administra

An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if th

A vulnerability, which was classified as problematic, has been found in NHN TOAST UI Chart 4.1.4. This issue affects som

Multiple stored cross-site scripting (XSS) vulnerabilities in Redrock Software TutorTrac before v4.2.170210 allows attac

A lack of rate limiting on the password reset endpoint of Chamberlain myQ v5.222.0.32277 (on iOS) allows attackers to co

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServ

An access control issue in Axcora POS #0~gitf77ec09 allows unauthenticated attackers to execute arbitrary commands via u

Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a `Deny` policy on ByPassGover

Uptime Kuma is a self-hosted monitoring tool. In versions prior to 1.20.0 the Uptime Kuma `name` parameter allows a pers

Uptime Kuma is a self-hosted monitoring tool. In versions prior to 1.20.0 the Uptime Kuma status page allows a persisten

Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions earlier than 1.5.7

GeoTools is an open source Java library that provides tools for geospatial data. GeoTools includes support for OGC Filte

A vulnerability has been found in SourceCodester Best POS Management System 1.0 and classified as critical. Affected by

A vulnerability, which was classified as problematic, was found in SourceCodester Best POS Management System 1.0. Affect

Prolink router PRS1841 was discovered to contain hardcoded credentials for its Telnet and FTP services.

A vulnerability was found in InSTEDD Pollit 2.3.1. It has been rated as critical. This issue affects the function TourCo

A vulnerability, which was classified as problematic, has been found in SourceCodester Best POS Management System 1.0. T

The Japanized For WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ paramet

Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitra

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Codiad 2.8.0. It has been rated as problematic. Affected by

A vulnerability was found in GoPistolet. It has been declared as problematic. This vulnerability affects unknown code of

Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS pa