2023

An access control issue on TP-LInk Tapo C200 V1 devices allows physically proximate attackers to obtain root access by c

The EU Cookie Law for GDPR/CCPA WordPress plugin through 3.1.6 does not sanitise and escape some of its settings, which

The Analyticator WordPress plugin before 6.5.6 unserializes user input provided via the settings, which could allow high

The WeStand WordPress theme before 2.1, footysquare WordPress theme, aidreform WordPress theme, statfort WordPress theme

ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF). The document editor servic

ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation. A lack of input validation can allo

ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An authentication bypass in the docume

ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting (XSS). The "macros" feature of the docume

ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An attacker can authenticate with the

ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document download URLs can be f

The Passster WordPress plugin before 3.5.5.9 does not properly check for password, as well as that the post to be viewed

The Passster WordPress plugin before 3.5.5.8 does not escape the area parameter of its shortcode, which could allow user

Observable Discrepancy in GitHub repository healthchecks/healthchecks prior to v2.6.

Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.

Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to obtain potentially sensitive attachments

Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to modify conversation attachments within th

app/View/AuthKeys/authkey_display.ctp in MISP through 2.4.167 has an XSS in authkey add via a Referer field.

An arbitrary file upload vulnerability in the /api/upload component of zdir v3.2.0 allows attackers to execute arbitrary

An issue in the component /admin/backups/work-dir of Sonic v1.0.4 allows attackers to execute a directory traversal.

processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g., "WRITE of siz

Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41.

Grand Theft Auto V for PC allows attackers to achieve partial remote code execution or modify files on a PC, as exploite

Booked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userId

In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgcon

KeePass through 2.53 (in a default installation) allows an attacker, who has write access to the XML configuration file,

A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to

Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40.

A remote attacker might be able to cause infinite recursion in PowerDNS Recursor 4.8.0 via a DNS query that retrieves DS

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225.

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Fou

A race condition in LightFTP through 2.2 allows an attacker to achieve path traversal via a malformed FTP request. A han

dtprintinfo in Common Desktop Environment 1.6 has a bug in the parser of lpstat (an invoked external command) during lis

A stack-based buffer overflow in ParseColors in libXm in Common Desktop Environment 1.6 can be exploited by local low-pr

The HTML-StripScripts module through 1.06 for Perl allows _hss_attval_style ReDoS because of catastrophic backtracking f

Yii Yii2 Gii before 2.2.2 allows remote attackers to execute arbitrary code via the Generator.php messageCategory field.

libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2

In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function

In MISP 2.4.167, app/webroot/js/action_table.js allows XSS via a network history name.

In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload.

act is a project which allows for local running of github actions. The artifact server that stores artifacts from Github

SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior allow

CRYSTALS-DILITHIUM (in Post-Quantum Cryptography Selected Algorithms 2022) in PQClean d03da30 may allow universal forger

erohtar/Dasherr is a dashboard for self-hosted services. In affected versions unrestricted file upload allows any unauth

When a file is processed, an infinite loop occurs in next_inline() of the more_curly() function.

When processing files, malloc stores the data of the current line. When processing comments, malloc incorrectly accesses

Cybereason EDR version 19.1.282 and above, 19.2.182 and above, 20.1.343 and above, and 20.2.X and above has a DLL hijack

A program using FoundationNetworking in swift-corelibs-foundation is potentially vulnerable to CRLF ( ) injection in URL

An incorrect default permissions vulnerability in Lenovo Leyun cloud music application could allow denial of service.

Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypa

The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerabili