2023

Ability to enumerate the Oracle LDAP attributes for the current user by modifying the query used by the application

User’s supplied input (usually a CRLF sequence) can be used to split a returning response into two responses.

An authenticated user can supply malicious HTML and JavaScript code that will be executed in the client browser.

Modelina is a library for generating data models based on inputs such as AsyncAPI, OpenAPI, or JSON Schema documents. Ve

Pi-hole®'s Web interface (based off of AdminLTE) provides a central location to manage your Pi-hole. Versions 4.0 and ab

OpenSearch is an open source distributed and RESTful search engine. In affected versions there is an issue in the implem

OpenSearch is an open source distributed and RESTful search engine. OpenSearch uses JWTs to store role claims obtained f

LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provid

GLPI is a Free Asset and IT Management Software package. Versions prior to 9.5.12 and 10.0.6 are vulnerable to Improper

Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. Versions prior to and inc

Spotipy is a light weight Python library for the Spotify Web API. In versions prior to 2.22.1, if a malicious URI is pas

bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file deletion vulnerability via the component /include/inc_co

Cross Site Scripting (XSS) vulnerability in Hughes Network Systems Router Terminal for HX200 v8.3.1.14, HX90 v6.11.0.5,

Discourse is an open source platform for community discussion. Versions prior to 3.0.1 (stable), 3.1.0.beta2 (beta), and

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions starting with 2.5.0-rc1 and above, pr

GLPI is a Free Asset and IT Management Software package. Versions 0.6.0 and above, prior to 10.0.6 are vulnerable to Cro

GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting vi

GLPI is a Free Asset and IT Management Software package. Versions 9.4.0 and above, prior to 10.0.6 are subject to Cross-

GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6 are vulnerable to In

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions of Argo CD starting with v1.8.2 and p

Discourse is an open source platform for community discussion. Versions prior to 2.8.13 (stable), 3.0.0.beta16 (beta) an

In binder_vma_close of binder.c, there is a possible use after free due to improper locking. This could lead to local es

In setUclampMinLocked of PowerSessionManager.cpp, there is a possible way to corrupt memory due to a use after free. Thi

In (TBD) of (TBD), there is a possible way to bypass the lockscreen due to Biometric Auth Failure. This could lead to lo

In exported content providers of ShannonRcs, there is a possible way to get access to protected content providers due to

In setMimeGroup of PackageManagerService.java, there is a possible crash loop due to resource exhaustion. This could lea

In onPackageRemoved of AccessibilityManagerService.java, there is a possibility to automatically grant accessibility ser

In queue of UsbRequest.java, there is a possible way to corrupt memory due to a use after free. This could lead to local

In getStringsForPrefix of Settings.java, there is a possible prevention of package uninstallation due to a logic error i

In getMainActivityLaunchIntent of LauncherAppsService.java, there is a possible way to bypass the restrictions on starti

In addOrReplacePhoneAccount of PhoneAccountRegistrar.java, there is a possible way to enable a phone account without use

In onCreate of PhoneAccountSettingsActivity.java and related files, there is a possible way to mislead the user into ena

In onActivityResult of AvatarPickerActivity.java, there is a possible way to access images belonging to other users due

In several functions of SettingsState.java, there is a possible system crash loop due to resource exhaustion. This could

In Mfc_Transceive of phNxpExtns_MifareStd.cpp, there is a possible out of bounds write due to a missing bounds check. Th

In getTrampolineIntent of SettingsActivity.java, there is a possible launch of arbitrary activity due to an Intent misma

A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been classified as crit

A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. Thi

A vulnerability has been found in isoftforce Dreamer CMS up to 4.0.1 and classified as problematic. This vulnerability a

A LDAP injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning i

A use-after-free flaw was found in io_uring/filetable.c in io_install_fixed_file in the io_uring subcomponent in the Lin

A use-after-free flaw was found in io_uring/poll.c in io_poll_check_events in the io_uring subcomponent in the Linux Ker

The force offline MFA prompt setting is not respected when switching to offline mode in Devolutions Remote Desktop Manag

Econolite EOS versions prior to 3.2.23 use a weak hash algorithm for encrypting privileged user credentials. A configura

Econolite EOS versions prior to 3.2.23 lack a password requirement for gaining “READONLY” access to log files and certai

The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resultin

A privilege escalation vulnerability exists in Delta Electronics InfraSuite Device Master 00.00.02a. A default user 'Use

Memory leak in the NFS dissector in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet

GNW dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or