2023

Delta Electronics DIAScreen may write past the end of an allocated buffer while parsing a specially crafted input file.

Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are sus

Mobile Security Framework (MobSF) <=v3.7.8 Beta is vulnerable to Insecure Permissions. NOTE: the vendor's position is th

An XXE (XML external entity injection) vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 2022

mee-admin 1.5 is vulnerable to Directory Traversal. The download method in the CommonFileController.java file does not v

The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to

The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, macO

quinn-proto is a state machine for the QUIC transport protocol. Prior to versions 0.9.5 and 0.10.5, receiving unknown QU

plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and

DataEase is an open source data visualization and analysis tool. Prior to version 1.18.11, DataEase has a vulnerability

Due to the implementation of "deriveVaultKey", prior to version 7.10, the generated vault key would always have the las

When sealing/unsealing the “vault” key, a list of PCRs is used, which defines which PCRs are used. In a previous proje

On boot, the Pillar eve container checks for the existence and content of “/config/GlobalConfig/global.json”. If the f

On boot, the Pillar eve container checks for the existence and content of “/config/authorized_keys”. If the file is pr

Phpjabbers PHP Shopping Cart 4.2 is vulnerable to SQL Injection via the id parameter.

In Eclipse RAP versions from 3.0.0 up to and including 3.25.0, Remote Code Execution is possible on Windows when using t

Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a path traversal

The Tungstenite crate before 0.20.1 for Rust allows remote attackers to cause a denial of service (minutes of CPU consum

Composer before 2016-02-10 allows cache poisoning from other projects built on the same host. This results in attacker-c

Faktory is a language-agnostic persistent background job server. Prior to version 1.8.0, the Faktory web dashboard can s

Cross Site Request Forgery (CSRF) vulnerability in icmsdev iCMSv.7.0.16 allows a remote attacker to execute arbitrary co

MyPrestaModules Prestashop Module v6.2.9 and UpdateProducts Prestashop Module v3.6.9 were discovered to contain a PHPInf

TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds NAPT ru

TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds ACL rul

Unrestricted File Upload vulnerability in Fl3xx Dispatch 2.10.37 and fl3xx Crew 2.10.37 allows a remote attacker to exec

A file upload vulnerability in EliteCMS v1.01 allows a remote attacker to execute arbitrary code via the manage_uploads.

An issue in CloudExplorer Lite 1.3.1 allows an attacker to obtain sensitive information via the login key component.

An issue in cimg.eu Cimg Library v2.9.3 allows an attacker to obtain sensitive information via a crafted JPEG file.

IBM Personal Communications 14.05, 14.06, and 15.0.0 could allow a local user to escalate their privileges to the SYSTEM

An information leak was found in OpenStack's undercloud. This flaw allows unauthenticated, remote attackers to inspect s

A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows atta

In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates tem

In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework creates t

Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the d

In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6

In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6

In EVE OS, the “measured boot” mechanism prevents a compromised device from accessing the encrypted data located in t

Vault Key Sealed With SHA1 PCRs The measured boot solution implemented in EVE OS leans on a PCR locking mechanism

PCR14 is not in the list of PCRs that seal/unseal the “vault” key, but due to the change that was implemented in commit

fake_upload.cgi on the Telstra Smart Modem Gen 2 (Arcadyan LH1000), firmware versions < 0.18.15r, allows unauthenticated

An XPC misconfiguration vulnerability in CoreCode MacUpdater before 2.3.8, and 3.x before 3.1.2, allows attackers to esc

An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on t

A flaw in the networking code handling DNS-over-TLS queries may cause `named` to terminate unexpectedly due to an assert

The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsi

Plesk 17.0 through 18.0.31 version, is vulnerable to a Cross-Site Scripting. A malicious subscription owner (either a cu

Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly whe

Use after free vulnerability exists in Kostac PLC Programming Software Version 1.6.11.0. Arbitrary code may be executed

Double free issue exists in Kostac PLC Programming Software Version 1.6.11.0 and earlier. Arbitrary code may be executed

Vulnerability in the RCPbind service running on UDP port (111), allowing a remote attacker to create a denial of service