2023

An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in captive portals allows att

An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in the administration web ser

An issue was discovered in Peplink Balance Two before 8.4.0. Console port authentication uses hard-coded credentials, wh

A vulnerability, which was classified as problematic, was found in code-projects E-Commerce Site 1.0. Affected is an unk

Incorrect access control in TP-Link Tapo before v3.1.315 allows attackers to access user credentials in plaintext.

A vulnerability, which was classified as critical, has been found in SourceCodester Medicine Tracking System 1.0. This i

Increasing the resolution of video frames, while performing a multi-threaded encode, can result in a heap overflow in av

An issue in simplemobiletools Simple Dialer 5.18.1 allows an attacker to bypass intended access restrictions via interac

An issue in Xenom Technologies (sinous) Phone Dialer-voice Call Dialer v.1.2.5 allows an attacker to bypass intended acc

An issue in Indi Browser (aka kvbrowser) v.12.11.23 allows an attacker to bypass intended access restrictions via intera

An issue in ArtistScope ArtisBrowser v.34.1.5 and before allows an attacker to bypass intended access restrictions via i

Phlox com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus has an Android manifest file that contains an

hyavijava v6.0.07.1 was discovered to contain a stack overflow via the ResultConverter.convert2Xml method.

The NumberUtil.toBigDecimal method in hutool-core v5.8.23 was discovered to contain a stack overflow.

A long execution time can occur in the ParseTools.subCompileExpression method in MVEL 2.5.0.Final because of many Java c

hutool-core v5.8.23 was discovered to contain an infinite loop in the StrSplitter.splitByRegex function. This vulnerabil

json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.

The com.altamirano.fabricio.tvbrowser TV browser application through 4.5.1 for Android is vulnerable to JavaScript code

The Kami Vision YI IoT com.yunyi.smartcamera application through 4.1.9_20231127 for Android allows a remote attacker to

Phlox com.phlox.simpleserver (aka Simple HTTP Server) 1.8 and com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS)

The com.phlox.tvwebbrowser TV Bro application through 2.0.0 for Android mishandles external intents through WebView. Thi

An issue in Shenzhen TCL Browser TV Web BrowseHere (aka com.tcl.browser) 6.65.022_dab24cc6_231221_gp allows a remote att

ReVanced API proxies requests needed to feed the ReVanced Manager and website with data. Up to and including commit 71f8

Arris DG860A and DG1670A devices have predictable default WPA2 PSKs that could lead to unauthorized remote access. (They

Nexkey is a lightweight fork of Misskey v12 optimized for small to medium size servers. Prior to 12.23Q4.5, Nexkey allow

Unofficial Mobile BankID Integration for WordPress lets users employ Mobile BankID to authenticate themselves on your Wo

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.7.0, Audiobookshelf is vulnerable to unauthenti

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.7.0, Audiobookshelf is vulnerable to unauthenti

tj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the `tj-actions/chan

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to

Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerab

A vulnerability, which was classified as critical, has been found in WeiYe-Jing datax-web 2.1.2. Affected by this issue

A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password

A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTabl

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in İzmir Katip Çelebi Unive

SteVe Community ocpp-jaxb before 0.0.8 generates invalid timestamps such as ones with month 00 in certain situations (su

An open redirect vulnerability in the python package Flask-Security-Too <=5.3.2 allows attackers to redirect unsuspectin

An open redirect through HTML injection in user messages in Asp.Net Zero before 12.3.0 allows remote attackers to redire

The JSON Content Importer WordPress plugin before 1.5.4 does not sanitise and escape the tab parameter before outputting

The BestWebSoft's Like & Share WordPress plugin before 2.74 discloses the content of password protected posts to unauthe

The Quiz Maker WordPress plugin before 6.4.9.5 does not escape generated URLs before outputting them in attributes, lead

The Quiz Maker WordPress plugin before 6.4.9.5 does not adequately authorize the `ays_quiz_author_user_search` AJAX acti

The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listin

The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as do

The BSK Forms Blacklist WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 loads the contents of the import file i

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 does not validate files to be uploaded,

The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL

The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file extensions uploading files to attach to em

The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file path parameters when attaching files to em