2023

The loading of external images is not blocked, even if configured, if the attacker uses protocol-relative URL in the pay

Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to pa

extract_user_to_sg in lib/scatterlist.c in the Linux kernel before 6.4.12 fails to unpin pages in a certain situation, a

SQL Injection in GitHub repository librenms/librenms prior to 23.10.0.

Backup, Recovery, and Media Services (BRMS) for IBM i 7.2, 7.3, and 7.4 contains a local privilege escalation vulnerabil

IBM Security Verify Governance 10.0 contains hard-coded credentials, such as a password or cryptographic key, which it u

A Universal Cross Site Scripting (UXSS) vulnerability in ClassLink OneClick Extension through 10.7 allows remote attacke

A vulnerability was found in SourceCodester Free Hospital Management System for Small Practices 1.0 and classified as cr

urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redi

IBM Directory Server for IBM i contains a local privilege escalation vulnerability. A malicious actor with command line

An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker can trigger a r

An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux kernel before

IBM QRadar SIEM 7.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScri

IBM QRadar SIEM 7.5.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly

IBM App Connect Enterprise 11.0.0.1 through 11.0.0.23, 12.0.1.0 through 12.0.10.0 and IBM Integration Bus 10.1 through 1

IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21

IBM Security Verify Access OIDC Provider could disclose directory information that could aid attackers in further attack

IBM Security Directory Server 6.4.0 could allow a remote attacker to traverse directories on the system. An attacker cou

IBM Security Directory Server 6.4.0 could allow a remote attacker to obtain sensitive information, caused by the failure

IBM Security Directory Server 6.4.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML d

A vulnerability classified as critical has been found in SourceCodester Library System 1.0. This affects an unknown part

The Hotjar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the hotjar_site_id in versions up to, a

Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve s

Apache Airflow, in versions prior to 2.7.2, contains a security vulnerability that allows an authenticated user with lim

Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to

Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specifi

Multiple Stored Cross Site Scripting (XSS) vulnerabilities in Opart opartmultihtmlblock before version 2.0.12 and Opart

Microsoft Edge (Chromium-based) Spoofing Vulnerability

A cross-site scripting (XSS) vulnerability has been reported to affect Video Station. If exploited, the vulnerability co

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited,

An OS command injection vulnerability has been reported to affect Container Station. If exploited, the vulnerability cou

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploite

HP is aware of a potential security vulnerability in HP t430 and t638 Thin Client PCs. These models may be susceptible t

Cross-Site Request Forgery (CSRF) vulnerability in automatededitor.Com Automated Editor plugin <= 1.3 versions.

Cross-Site Request Forgery (CSRF) vulnerability in PINPOINT.WORLD Pinpoint Booking System plugin <= 2.9.9.4.0 versions.

Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO plugin <= 2.0.25 versions.

IBM App Connect Enterprise 12.0.1.0 through 12.0.8.0 contains an unspecified vulnerability that could allow a local priv

Cross-Site Request Forgery (CSRF) vulnerability in Hitsteps Hitsteps Web Analytics plugin <= 5.86 versions.

Cross-Site Request Forgery (CSRF) vulnerability in Zizou1988 IRivYou plugin <= 2.2.1 versions.

An indirect object reference (IDOR) in GRANDING UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated attackers to a

A stored cross-site scripting (XSS) vulnerability in the Create A New Employee function of Granding UTime Master v9.0.7-

Cross-Site Request Forgery (CSRF) vulnerability in ZAKSTAN WhitePage plugin <= 1.1.5 versions.

The Embed Calendly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'calendly' shortcode in version

Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.0.22.

Cross-site Scripting (XSS) - Stored in GitHub repository hestiacp/hestiacp prior to 1.8.6.

Cross-Site Request Forgery (CSRF) vulnerability in Mailrelay plugin <= 2.1.1 versions.

Cross-Site Request Forgery (CSRF) vulnerability in GoodBarber plugin <= 1.0.22 versions.

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 2

Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2,

Allocation of Resources Without Limits or Throttling in GitHub repository vriteio/vrite prior to 0.3.0.