2023

Versions of the package mt7688-wiscan before 0.8.3 are vulnerable to Command Injection due to improper input sanitizatio

All versions of the package is-http2 are vulnerable to Command Injection due to missing input sanitization or other chec

Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to r1606.

A CWE-285: Improper Authorization vulnerability exists that could cause unauthorized access to certain software function

A CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause local privilege escalation when local att

A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could cause local privilege e

A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could cause remote code execution w

A CWE-306: Missing Authentication for Critical Function The software does not perform any authentication for functionali

A CWE-190: Integer Overflow or Wraparound vulnerability exists that could cause heap-based buffer overflow, leading to d

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflo

A CWE-200: Information Exposure vulnerability exists that could cause the exposure of sensitive information stored on th

Due to insufficient length validation in the Open5GS GTP library versions prior to versions 2.4.13 and 2.5.7, when parsi

VMware vRealize Operations (vROps) contains a CSRF bypass vulnerability. A malicious user could execute actions on the v

A file upload vulnerability in exists in Trend Micro Apex One server build 11110. Using a malformed Content-Length heade

As part of our Security Development Lifecycle, a potential privilege escalation issue was identified internally. This co

OrangeScrum version 2.0.11 allows an authenticated external attacker to delete arbitrary local files from the server. Th

A sensitive information leak issue has been discovered in all versions of DAST API scanner from 1.6.50 prior to 2.0.102,

Serenissima Informatica Fast Checkin version v1.0 is vulnerable to Unauthenticated SQL Injection.

An arbitrary file write vulnerability in Serenissima Informatica Fast Checkin v1.0 allows unauthenticated attackers to u

Serenissima Informatica Fast Checkin 1.0 is vulnerable to Directory Traversal.

Notepad++ v8.4.1 was discovered to contain a stack overflow via the component Finder::add().

reason-jose is a JOSE implementation in ReasonML and OCaml.`Jose.Jws.validate` does not check HS256 signatures. This all

Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Exp

Cross-site Scripting (XSS) - Reflected in GitHub repository ampache/ampache prior to 5.5.7.

Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /cha.php

Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/l

Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image

A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker t

Easy Images v2.0 was discovered to contain an arbitrary file download vulnerability via the component /application/down.

Netcad KEOS 1.0 is vulnerable to XML External Entity (XXE) resulting in SSRF with XXE (remote).

Buffer overflow vulnerability in function json_parse_object in sheredom json.h before commit 0825301a07cbf51653882bf2b15

EQ v1.5.31 to v2.2.0 was discovered to contain a SQL injection vulnerability via the UserPwd parameter.

BTCPay Server 1.3.0 through 1.5.3 allows a remote attacker to obtain sensitive information when a public Point of Sale a

A vulnerability, which was classified as problematic, was found in SiteFusion Application Server up to 6.6.6. This affec

i-librarian 4.10 is vulnerable to Arbitrary file upload in ajaxsupplement.php.

COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Cross

COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 and before is vulnerab

COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Incor

COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Cross

COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 and before is vulnerab

An issue was discovered in LIVEBOX Collaboration vDesk before v018. Broken Access Control can occur under the /api/v1/re

A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information

A CWE-863: Incorrect Authorization vulnerability exists that could cause Denial of Service against the Geo SCADA server

SQL Inection vulnerability in Dromara hutool before 5.8.21 allows attacker to execute arbitrary code via the aviator tem

Deserialization vulnerability in Dromara Hutool v5.8.11 allows attacker to execute arbitrary code via the XmlUtil.readOb

SQL Injection vulnerability in Bangresto 1.0 via the itemID parameter.

Buffer Overflow Vulnerability in D-Link DIR-825 v1.33.0.44ebdd4-embedded and below allows attacker to execute arbitrary

Cross Site Scripting vulnerability in Joplin Desktop App before v2.9.17 allows attacker to execute arbitrary code via im

On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sen

Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allow