2023

Out-of-bounds write when handling split HTTP headers; When handling split HTTP headers, GRUB2 HTTP code accidentally mov

Integer underflow in grub_net_recv_ip4_packets; A malicious crafted IP packet can lead to an integer underflow in grub_n

Weintek Weincloud v0.13.6 could allow an attacker to abuse the registration functionality to login with testing cred

​In Keysight Geolocation Server v2.4.2 and prior, a low privileged attacker could create a local ZIP file containin

Weintek Weincloud v0.13.6 could allow an attacker to reset a password with the corresponding account’s JWT token on

Weintek Weincloud v0.13.6 could allow an attacker to cause a denial-of-service condition for Weincloud by sending

In Keysight Geolocation Server v2.4.2 and prior, an attacker could upload a specially crafted malicious file or d

The Data Exchange Add-on component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerabili

An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remo

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Feathers socke

Privilege Escalation to root administrator (nsroot)

Reflected Cross-Site Scripting (XSS)

There is SQL injection vulnerability in Esri ArcGIS Insights Desktop for Mac and Windows version 2022.1 that may allow

There is SQL injection vulnerability in Esri ArcGIS Insights 2022.1 for ArcGIS Enterprise and that may allow a remote,

A use-after-free vulnerability exists in the way Foxit Reader 12.1.2.15332 handles destroying annotations. Specially cra

A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 12.1.2.15332. By

A type confusion vulnerability exists in the Javascript checkThisBox method as implemented in Foxit Reader 12.1.2.15332.

A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.1.1.15289. A s

A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 12.1.2.15332. By

Deserialization of Untrusted Data vulnerability in Apache ShardingSphere-Agent, which allows attackers to execute arbitr

IBM Security Guardium 11.3 could allow a local user to escalate their privileges due to improper permission controls.

This High severity Injection and RCE (Remote Code Execution) vulnerability known as CVE-2023-22506 was introduced in ver

This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22508 was introduced in version 6.1.0 of

Grav is a file-based Web-platform built in PHP. Grav is subject to a server side template injection (SSTI) vulnerability

This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22505 was introduced in version 8.0.0 of

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Repository). The suppo

Vulnerability in the Oracle Hyperion Workspace product of Oracle Hyperion (component: UI and Visualization). The suppo

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported vers

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Device Driver Interface). The supported vers

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported vers

An executable used in Rockwell Automation ThinManager ThinServer can be configured to enable an API feature in the HTTP

goproxy v1.1 was discovered to contain an issue which can lead to a Denial of service (DoS) via unspecified vectors.

D-LINK DIR-815 v1.01 was discovered to contain a buffer overflow via the component /web/captcha.cgi.

1Panel is an open source Linux server operation and maintenance management panel. An OS command injection vulnerability

TP-LINK Archer C50v2 Archer C50(US)_V2_160801, TP-LINK Archer C20v1 Archer_C20_V1_150707, and TP-LINK Archer C2v1 Archer

Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to an insecure direct object reference vulnerability that cou

AMI SPx contains a vulnerability in the BMC where a user may inject code which could be executed via a Dynamic Redfish E

Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a directory traversal vulnerability that could allow an un

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wppal Easy Captcha plugin <= 1.0 versions.

EVERTZ devices 3080IPX exe-guest-v1.2-r26125, 7801FC 1.3 Build 27, and 7890IXG V494 are vulnerable to Arbitrary File Upl

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authoriz

In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions p

The Rockwell Automation Kinetix 5700 DC Bus Power Supply Series A is vulnerable to CIP fuzzing.  The new ENIP connectio

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CodePeople Booking Calendar Contact Form plugin <= 1.2.40

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CRUDLab Jazz Popups plugin <= 1.8.7 versions.

The vulnerability could be locally exploited to allow escalation of privilege.

An issue was discovered in ostree before 2022.7 allows attackers to cause a denial of service or other unspecified impac

Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecif

Improper Authentication vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin allows Authenticati