2023

A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator.  It

The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated

A local user could edit the VideoEdge configuration file and interfere with VideoEdge operation.

emlog v2.1.9 was discovered to contain a SQL injection vulnerability via the component /admin/user.php.

External input could be used on TEL-STER TelWin SCADA WebInterface to construct paths to files and directories without

A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) a

Fabasoft Cloud Enterprise Client 23.3.0.130 allows a user to escalate their privileges to local administrator.

An arbitrary file download vulnerability in the /c/PluginsController.php component of jizhi CMS 1.9.5 allows attackers t

An arbitrary file upload vulnerability in the /languages/install.php component of WBCE CMS v1.6.1 allows attackers to ex

A SQL injection vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows authenticated users to inject arbit

A path traversal vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows unauthenticated attackers to fetch

An OS Command injection vulnerability exists in Suprema BioStar 2 before V2.9.1, which allows authenticated users to exe

An authentication bypass vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows unauthenticated users to a

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine

A File Upload vulnerability in typecho v.1.2.1 allows a remote attacker to execute arbitrary code via the upload and opt

DedeCMS v5.7.109 has a File Upload vulnerability, leading to remote code execution (RCE).

The Cloudflare WARP client for Windows assigns loopback IPv4 addresses for the DNS Servers, since WARP acts as local DNS

An issue was discovered in InsydeH2O. A malicious operating system can tamper with a runtime-writable EFI variable, lead

Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. By having a user open a specially crafted CXP

Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. By having a user open a specially crafted CXP

Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. By having a user open a specially crafted CXP

In CODESYS Control in multiple versions a improper restriction of operations within the bounds of a memory buffer allow

Dell XtremIO X2 XMS versions prior to 6-4-1.11 contain an improper access control vulnerability. A remote read only use

In CODESYS Development System versions from 3.5.11.20 and before 3.5.19.20 a missing integrity check might allow an unau

In CODESYS Development System versions from 3.5.17.0 and prior to 3.5.19.20 a vulnerability allows for execution of bina

User provided input is not sanitized on the AXIS License Plate Verifier specific “search.cgi” allowing for SQL injection

User provided input is not sanitized in the “Settings > Access Control” configuration interface allowing for arbitrary c

User provided input is not sanitized on the AXIS License Plate Verifier specific “api.cgi” allowing for arbitrary code e

Due to insufficient file permissions, unprivileged users could gain access to unencrypted administrator credentials all

Due to insufficient file permissions, unprivileged users could gain access to unencrypted user credentials that are use

A broken access control was found allowing for privileged escalation of the operator account to gain administrator priv

Use after free vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a

Heap-based buffer overflow vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier.

An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions startin

Out-of-bounds read vulnerability/issue exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By

Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue exists in the built-in

Insufficient Session Expiration in GitHub repository answerdev/answer prior to v1.1.0.

Weak Password Requirements in GitHub repository answerdev/answer prior to v1.1.0.

Element55 KnowMore appliances version 21 and older was discovered to store passwords in plaintext.

In the Keyfactor EJBCA before 8.0.0, the RA web certificate distribution servlet /ejbca/ra/cert allows partial denial of

A path traversal vulnerability in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to read arbitrary files v

ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to obtain sensitive information about all managed devices,

An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote attacker to execute arbitrar

File Upload vulnerability in Total CMS v.1.7.4 allows a remote attacker to execute arbitrary code via a crafted PHP file

Inappropriate implementation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a

Insufficient data validation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a

Use after free in WebRTC in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap

Use after free in Cast in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap co

Use after free in Blink Task Scheduling in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentiall

Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 115.0.5790.170 allowed a remote attacker to potent