2023

An issue in the directory /system/bin/blkid of Skyworth v3.0 allows attackers to perform a directory traversal via mount

An information leak in Earthgarden_waiting 13.6.1 allows attackers to obtain the channel access token and send crafted m

An information leak in kokoroe_members card Line 13.6.1 allows attackers to obtain the channel access token and send cra

A cross-site scripting (XSS) vulnerability in /hoteldruid/visualizza_contratto.php of Hoteldruid v3.0.5 allows attackers

A cross-site scripting (XSS) vulnerability in /hoteldruid/clienti.php of Hoteldruid v3.0.5 allows attackers to execute a

IBM Storage Protect 8.1.0.0 through 8.1.19.0 could allow a privileged user to obtain sensitive information from the admi

An information leak in KUKURUDELI Line v13.6.1 allows attackers to obtain the channel access token and send crafted mess

A reflected cross-site scripting (XSS) vulnerability in OpenKnowledgeMaps Head Start versions 4, 5, 6, 7 as well as Visu

An information leak in ajino-Shiretoko Line v13.6.1 allows attackers to obtain the channel access token and send crafted

Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via loc

Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via loc

A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows atta

A missing permission check in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers with Overall/Read

Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not escape Failure Cause names in build logs, resulting in

Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of '

Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive buil

In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6

The `PaperCutNG Mobility Print` version 1.0.3512 application allows an unauthenticated attacker to perform a CSRF attac

A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especi

A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, r

The ping_from parameter of ping_tracerte.cgi in the web UI of Telstra Smart Modem Gen 2 (Arcadyan LH1000), firmware vers

M4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to a directory traversal vulnerabilit

A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a

The lack of web request control on ekorCCP and ekorRCI devices allows a potential attacker to create custom requests to

An issue was discovered in Croc through 9.6.5. The shared secret, located on a command line, can be read by local users

An issue was discovered in Croc through 9.6.5. The protocol requires a sender to provide its local IP addresses in clear

An issue was discovered in Croc through 9.6.5. When a custom shared secret is used, the sender and receiver may divulge

An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction.

Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insuffici

The Widget Responsive for Youtube plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'youtube' shortc

The WordPress Charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wp_charts' shortcode in vers

NVIDIA DGX H100 BMC contains a vulnerability in the REST service where a host user may cause as improper authentication

NVIDIA GeForce Now for Android contains a vulnerability in the game launcher component, where a malicious application on

NVIDIA DGX H100 BMC contains a vulnerability in the REST service, where an attacker may cause improper input validation.

NVIDIA DGX H100 BMC contains a vulnerability in the REST service where an attacker may cause improper input validation.

NVIDIA DGX H100 BMC contains a vulnerability in the REST service where an attacker may cause improper input validation.

NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation. A successfu

NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation. A successfu

NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause insufficient protection of credentials

NVIDIA Cumulus Linux contains a vulnerability in neighmgrd and nlmanager where an attacker on an adjacent network may ca

A reflected cross-site scripting (XSS) vulnerability in the url_str URL parameter of ISL ARP Guard v4.0.2 allows attacke

An issue was discovered in ImfHpRegFilter.sys in IOBit Malware Fighter version 8.0.2, allows local attackers to cause a

A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with acc

A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers

The Serial Codes Generator and Validator with WooCommerce Support WordPress plugin before 2.4.15 does not sanitise and e

The Leyka WordPress plugin before 3.30.4 does not sanitise and escape some of its settings, which could allow high privi

Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.x branch prior to versi

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to

MiniTool Power Data Recovery version 11.6 and before contains an insecure in-app payment system that allows attackers to

A Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15