2023

Memory safety bugs present in Firefox 119. Some of these bugs showed evidence of memory corruption and we presume that w

Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. Some of these bugs showed evidence

If an attacker needed a user to load an insecure http: page and knew that user had enabled HTTPS-only mode, the attacker

When an https: web page created a pop-up from a "javascript:" URL, that pop-up was incorrectly allowed to load blockable

Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could be

When using X11, text selected by the page using the Selection API was erroneously copied into the primary selection, a t

Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox < 120, Firefox

The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prom

It was possible to cause the use of a MessagePort after it had already been freed, which could potentially have led to a

On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak m

An attacker could have performed HTML template injection via Reader Mode and exfiltrated user information. This vulnerab

An attacker could have accessed internal pages or data by ex-filtrating a security key from ReaderMode via the `referrer

Cross Site Scripting in SUP Online Shopping v.1.0 allows a remote attacker to execute arbitrary code via the Name, Email

An uncontrolled search path element vulnerability has been found in the Duet Display product, affecting version 2.5.9.1.

An Improper Validation of Integrity Check Value in Zscaler Client Connector on Windows allows an authenticated user to d

A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x thr

Stored Cross-site Scripting (XSS) vulnerabilities affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through

The Post Meta Data Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and i

During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device t

An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, le

A vulnerability in the web-based management allows an unauthenticated remote attacker to inject arbitrary system command

eyoucms v1.6.4 is vulnerable Cross Site Scripting (XSS), which can lead to stealing sensitive information of logged-in u

Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup.cgi was vulnerable to pat

Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage.cgi was vulnera

Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi was vulnerable t

The BGP daemon (bgpd) in IP Infusion ZebOS through 7.10.6 allow remote attackers to cause a denial of service by sending

Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled (UDR-A) any Sixnet UDR message will meet an

Dev blog v1.0 allows to exploit an account takeover through the "user" cookie. With this, an attacker can access any use

Dev blog v1.0 allows to exploit an XSS through an unrestricted file upload, together with a bad entropy of filenames. Wi

When user authentication is not enabled the shell can execute commands with the highest privileges. Red Lion SixTRAK

Book Stack version 23.10.2 allows filtering local files on the server. This is possible because the application is vulne

TestingPlatform is a testing platform for Internet Security Standards. Prior to version 2.1.1, user input is not filtere

An issue in /upydev/keygen.py in upydev v0.4.3 allows attackers to decrypt sensitive information via weak encryption pad

An issue in TOTOlink A3700R v.9.1.2u.6134_B20201202 allows a local attacker to execute arbitrary code via the setTracero

An Insecure Permissions issue in WebsiteGuide v.0.2 allows a remote attacker to gain escalated privileges via crafted jw

An arbitrary file write vulnerability exists where an authenticated attacker with privileges on the managing applicatio

An arbitrary file write vulnerability exists where an authenticated, remote attacker with administrator privileges on t

An issue in Yamcs 5.8.6 allows attackers to send aribitrary telelcommands in a Command Stack via Clickjacking.

Certain WithSecure products allow Local Privilege Escalation. This affects WithSecure Client Security 15, WithSecure Ser

Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arbi

Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arbi

Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the time parameter in the function saveParentContro

Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow via the urls parameter in the function saveParentControl

Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow via the deviceId parameter in the function saveParentCon

Cross Site Scripting (XSS) vulnerability in the component /shells/embedder.html of DZSlides after v2011.07.25 allows att

Deserialization of Untrusted Data in PublicCMS v.4.0.202302.e allows a remote attacker to execute arbitrary code via a c

Buffer Overflow vulnerability in Tenda Ac19 v.1.0, AC18, AC9 v.1.0, AC6 v.2.0 and v.1.0 allows a remote attacker to exec

The WP Hotel Booking WordPress plugin before 2.0.8 does not have proper authorisation when deleting a package, allowing

The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not esca

The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensu