2023

Docker Desktop before 4.23.0 allows Access Token theft via a crafted extension icon URL. This issue affects Docker Desk

Docker Desktop before 4.23.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions via t

A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which

The Import XML and RSS Feeds WordPress plugin before 2.1.4 does not filter file extensions for uploaded files, allowing

The Prevent files / folders access WordPress plugin before 2.5.2 does not validate files to be uploaded, which could all

Directory Traversal vulnerability in itechyou dreamer CMS v.4.1.3 allows a remote attacker to execute arbitrary code via

The FileOrganizer WordPress plugin through 1.0.2 does not restrict functionality on multisite instances, allowing site a

Mediawiki v1.40.0 does not validate namespaces used in XML files. Therefore, if the instance administrator allows XML f

The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly check nonce values in several action

A heap-based buffer overflow vulnerability exists in the create_png_object functionality of Accusoft ImageGear 20.1. A s

An out-of-bounds write vulnerability exists in the tiff_planar_adobe functionality of Accusoft ImageGear 20.1. A special

A heap-based buffer overflow vulnerability exists in the CreateDIBfromPict functionality of Accusoft ImageGear 20.1. A s

In Docker Desktop on Windows before 4.12.0 an argument injection to installer may result in local privilege escalation (

Docker Desktop before 4.12.0 is vulnerable to RCE via query parameters in message-box route. This issue affects Docker

Docker Desktop before 4.12.0 is vulnerable to RCE via a crafted extension description or changelog. This issue affects

Command injection vulnerability in the distributed file system module. Successful exploitation of this vulnerability may

Redirection permission verification vulnerability in the home screen module. Successful exploitation of this vulnerabili

Vulnerability of unauthorized API access in the PMS module. Successful exploitation of this vulnerability may cause feat

Vulnerability of parameters not being strictly verified in the PMS module. Successful exploitation of this vulnerability

Data security classification vulnerability in the DDMP module. Successful exploitation of this vulnerability may affect

DoS vulnerability in the PMS module. Successful exploitation of this vulnerability may cause the system to restart.

Vulnerability of permission control in the window module. Successful exploitation of this vulnerability may affect confi

DoS vulnerability in the PMS module. Successful exploitation of this vulnerability may cause the system to restart.

DoS vulnerability in the PMS module. Successful exploitation of this vulnerability may cause the system to restart.

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Xtemos WoodMart plugin <= 7.2.4 versions.

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Tyche Softwares Order Delivery Date for WooCommerce plugin

An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the

An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated

An issue was discovered in Wind River VxWorks 6.9 and 7. The function ``tarExtract`` implements TAR file extraction and

The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Prior to p

Command injection in homemng.htm in Juplink RX4-1500 versions V1.0.2, V1.0.3, V1.0.4, and V1.0.5 allows remote authentic

Command injection vulnerability in the homemng.htm endpoint in Juplink RX4-1500 Wifi router firmware versions V1.0.2, V1

Credential disclosure in the '/webs/userpasswd.htm' endpoint in Juplink RX4-1500 Wifi router firmware versions V1.0.4 an

AutomataCI is a template git repository equipped with a native built-in semi-autonomous CI tools. An issue in versions 1

A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured manage

The fix for XSA-423 added logic to Linux'es netback driver to deal with a frontend splitting a packet in a way such that

A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the forem

Plesk Onyx 17.8.11 has accessKeyId and secretAccessKey fields that are related to an Amazon AWS Firehose component. NOTE

Cadence through 0.9.2 2023-08-21 uses an Insecure /tmp/cadence-wineasio.reg Temporary File. The filename is used even if

Certain WithSecure products allow Denial of Service via the aepack archive unpack handler. This affects WithSecure Clien

Certain WithSecure products allow Local privilege escalation via the lhz archive unpack handler. This affects WithSecure

Certain WithSecure products allow Denial of Service in the aeelf component. This affects WithSecure Client Security 15,

Certain WithSecure products allow Denial of Service (infinite loop). This affects WithSecure Client Security 15, WithSec

Certain WithSecure products allow Denial of Service via a fuzzed PE32 file. This affects WithSecure Client Security 15,

A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating systems. If exploi

A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating system. If exploit

An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerabilit

FUXA <= 1.1.12 is vulnerable to Local via Inclusion via /api/download.

A SQL Injection attack in FUXA <= 1.1.12 allows exfiltration of confidential information from the database.

FUXA <= 1.1.12 has a Local File Inclusion vulnerability via file=fuxa.log