2023

A server-side request forgery vulnerability in ESM prior to version 11.6.8 allows a low privileged authenticated user t

Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the shareSpeed parameter

Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the time parameter in th

Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the urls parameter in th

Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the firewallEn parameter

Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the src parameter in the

Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the list parameter in th

Insecure Permissions vulnerability in GL.iNet AX1800 v.3.215 and before allows a remote attacker to execute arbitrary co

In Dreamer CMS before 4.0.1, the backend attachment management office has an Arbitrary File Download vulnerability.

Dreamer CMS before version 4.0.1 is vulnerable to Directory Traversal. Background template management allows arbitrary m

Zumtobel Netlink CCD Onboard v3.74 - Firmware v3.80 was discovered to contain a buffer overflow via the component Netlin

Zumtobel Netlink CCD Onboard 3.74 - Firmware 3.80 was discovered to contain a command injection vulnerability via the Ne

Zumtobel Netlink CCD Onboard 3.74 - Firmware 3.80 was discovered to contain hardcoded credentials for the Administrator

An issue in GitKraken GitLens before v.14.0.0 allows an attacker to execute arbitrary code via a crafted file to the Vis

RustCrypto/RSA is a portable RSA implementation in pure Rust. Due to a non-constant-time implementation, information abo

Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute arbitrary code via by

The FACSChorus software does not properly assign data access privileges for operating system user accounts. A non-admini

The FACSChorus software database can be accessed directly with the privileges of the currently logged-in user. A threat

The FACSChorus software contains sensitive information stored in plaintext. A threat actor could gain hardcoded secrets

The FACSChorus workstation does not prevent physical access to its PCI express (PCIe) slots, which could allow a threat

The Operating System hosting the FACSChorus application is configured to allow transmission of hashed user credentials u

There is no BIOS password on the FACSChorus workstation. A threat actor with physical access to the workstation can pote

HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive info

The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, th

When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect ter

The FACSChorus workstation operating system does not restrict what devices can interact with its USB ports. If exploited

raptor-web is a CMS for game server communities that can be used to host information and keep track of players. In versi

An authentication bypass vulnerability in the Direct Connection Module in Ezviz CS-C6N-xxx prior to v5.3.x build 2023040

An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports,

SQL Injection Remote Code Vulnerability was found in the SolarWinds Platform. This vulnerability can be expl

An arbitrary file read vulnerability in ureport v2.2.9 allows a remote attacker to arbitrarily read files on the server

A race condition in go-resty can result in HTTP request body disclosure across requests. This condition can be triggered

An authenticated user with read permissions on database connections metadata could potentially access sensitive informat

An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing t

Netwrix Usercube before 6.0.215, in certain misconfigured on-premises installations, allows authentication bypass on dep

Katran could disclose non-initialized kernel memory as part of an IP header. The issue was present for IPv4 encapsulatio

Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 throug

Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.  In details, in ActiveMQ

Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection ag

A dylib injection vulnerability in XMachOViewer 0.04 allows attackers to compromise integrity. By exploiting this, unaut

Under rare conditions, the effective permissions of an object might be incorrectly calculated if the object has a specif

Cross Site Scripting (XSS) in Search filters in Prestashop Amazzing filter version up to version 3.2.5, allows remote at

A Cross-Site Scripting (XSS) vulnerability has been found in Alumne LMS affecting version 4.0.0.1.08. An attacker could

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Univera Comp

A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from resp

IBM Security Guardium 11.3, 11.4, and 11.5 is potentially vulnerable to CSV injection. A remote attacker could execute

Incorrect Use of Privileged APIs vulnerability in ESKOM Computer e-municipality module allows Collect Data as Provided b

Incorrect Use of Privileged APIs vulnerability in ESKOM Computer e-municipality module allows Collect Data as Provided b

The web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fie

In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially cra