2023

The Post Views Count WordPress plugin through 3.0.2 does not validate and escape some of its shortcode attributes before

The Easy Social Box / Page Plugin WordPress plugin through 4.1.2 does not validate and escape some of its shortcode attr

The Opening Hours WordPress plugin through 2.3.0 does not validate and escape some of its shortcode attributes before ou

The WP Responsive Testimonials Slider And Widget WordPress plugin through 1.5 does not validate and escape some of its s

The WP Dark Mode WordPress plugin before 4.0.0 does not validate and escape one of its shortcode attributes, which could

The Page Builder: Live Composer WordPress plugin before 1.5.23 does not validate and escape some of its shortcode attrib

The Markup (JSON-LD) structured in schema.org WordPress plugin through 4.8.1 does not validate and escape some of its sh

The Login Logout Menu WordPress plugin through 1.3.3 does not validate and escape some of its shortcode attributes befor

The Intuitive Custom Post Order WordPress plugin before 3.1.4 lacks CSRF protection in its update-menu-order ajax action

The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order

The Spectra WordPress plugin before 1.15.0 does not sanitize user input as it reaches its style HTML attribute, allowing

A vulnerability classified as problematic has been found in UIKit0 libplist 1.12. This affects the function plist_from_x

Dell Multifunction Printer E525w Driver and Software Suite, versions prior to 1.047.2022, A05, contain a local privileg

In AFL++ 4.05c, the CmpLog component uses the current working directory to resolve and execute unprefixed fuzzing target

The Borg theme before 1.1.19 for Backdrop CMS does not sufficiently sanitize path arguments that are passed in via a URL

A vulnerability was found in cention-chatserver 3.8.0-rc1. It has been declared as problematic. Affected by this vulnera

In Gluster GlusterFS 11.0, there is an xlators/mount/fuse/src/fuse-bridge.c notify stack-based buffer over-read.

Knot Resolver before 5.6.0 enables attackers to consume its resources, launching amplification attacks and potentially c

In Gluster GlusterFS 11.0, there is an xlators/cluster/dht/src/dht-common.c dht_setxattr_mds_cbk use-after-free.

afu_mmio_region_get_by_offset in drivers/fpga/dfl-afu-region.c in the Linux kernel through 6.1.12 has an integer overflo

JD-GUI 1.6.6 allows XSS via util/net/InterProcessCommunicationUtil.java.

JD-GUI 1.6.6 allows deserialization via UIMainWindowPreferencesProvider.singleInstance.

Missing Authentication for Critical Function in SICK FX0-GENT v3 Firmware Version V3.04 and V3.05 allows an unprivileged

Missing Authentication for Critical Function in SICK FX0-GPNT v3 Firmware Version V3.04 and V3.05 allows an unprivileged

An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-iste

An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local comm

GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file,

Erxes, an experience operating system (XOS) with a set of plugins, is vulnerable to cross-site scripting in versions 0.2

Countly, a product analytics solution, is vulnerable to cross-site scripting prior to version 21.11 of the community edi

Mind-elixir is a free, open source mind map core. Prior to version 0.18.1, mind-elixir is prone to cross-site scripting

jQuery MiniColors is a color picker built on jQuery. Prior to version 2.3.6, jQuery MiniColors is prone to cross-site sc

Gnuboard 5.5.4 and 5.5.5 is vulnerable to Insecure Permissions. An attacker can change password of all users without kno

Prototype Pollution in Visioweb.js 1.10.6 allows attackers to execute XSS on the client system.

A vulnerability has been found in rtcwcoop 1.0.2 and classified as problematic. Affected by this vulnerability is the fu

Limited Server-Side Request Forgery (SSRF) in agent-receiver in Tribe29's Checkmk <= 2.1.0p11 allows an attacker to comm

Cross-site Request Forgery (CSRF) in Tribe29's Checkmk <= 2.1.0p17, Checkmk <= 2.0.0p31, and all versions of Checkmk 1.6

Sensitive host secret disclosed in cmk-update-agent.log file in Tribe29's Checkmk <= 2.1.0p13, Checkmk <= 2.0.0p29, and

No authorisation controls in the RestAPI documentation for Tribe29's Checkmk <= 2.1.0p13 and Checkmk <= 2.0.0p29 which m

Expired sessions were not securely terminated in the RestAPI for Tribe29's Checkmk <= 2.1.0p10 and Checkmk <= 2.0.0p28 a

Livestatus Query Language (LQL) injection in the AuthUser HTTP query header of Tribe29's Checkmk <= 2.1.0p11, Checkmk <=

PHP code injection in watolib auth.php and hosttags.php in Tribe29's Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Check

Command injection in SMS notifications in Tribe29 Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allo

Octobox is software for managing GitHub notifications. Prior to pull request (PR) 2807, a user of the system can provide

HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior, a malic

A vulnerability was found in meta4creations Post Duplicator Plugin 2.18 on WordPress. It has been classified as problema

A vulnerability was found in arnoldle submitByMailPlugin 1.0b2.9 and classified as problematic. This issue affects some

versionn, software for changing version information across multiple files, has a command injection vulnerability in all

notation-go is a collection of libraries for supporting Notation sign, verify, push, and pull of oci artifacts. Prior to

An LDAP Injection vulnerability exists in the LdapIdentityBackend of Apache Kerby before 2.0.3. 

Apollo is a configuration management system. Prior to version 2.1.0, there are potential security issues if users expose