2023

Multiple signed integers overflow in function au_read_header in src/au.c and in functions mat4_open and mat4_read_header

An off-by-one error in function wav_read_header in src/wav.c in Libsndfile 1.1.0, results in a write out of bound, which

An issue was discovered in Tildeslash Monit before 5.31.0, allows remote attackers to gain escilated privlidges due to i

An Out of Bounds flaw was discovered in htmodoc 1.9.12 in function parse_tree() in toc.cxx, this possibly leads to memor

A flaw was discovered in htmodoc 1.9.12 in function parse_paragraph in ps-pdf.cxx ,this flaw possibly allows possible co

Heap-based buffer over-read in function png_convert_4 in file pngex.cc in AdvanceMAME through 2.1.

Auth. (subscriber+) SQL Injection (SQLi) vulnerability in MainWP MainWP Maintenance Extension plugin <= 4.1.1 versions.

Ap Page Builder, in versions lower than 1.7.8.2, could allow a remote attacker to send a specially crafted SQL query to

The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability chec

The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability chec

The Export and Import Users and Customers plugin for WordPress is vulnerable to unauthorized modification of data due to

xHTTP 72f812d has a double free in close_connection in xhttp.c via a malformed HTTP request method.

A heap overflow vulnerability found in EdgeRouters and Aircubes allows a malicious actor to interrupt UPnP service to sa

Expression Language Injection vulnerability in Hitachi Replication Manager on Windows, Linux, Solaris allows Code Inject

On Crestron 3-Series Control Systems before 1.8001.0187, crafting and sending a specific BACnet packet can cause a crash

The XPRTLD web application in Veritas InfoScale Operations Manager (VIOM) before 8.0.0.410 allows an authenticated attac

iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field.

A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions

A command injection vulnerability in the Free Time WiFi hotspot feature of the Zyxel USG FLEX series firmware versions 4

A command injection vulnerability in the hotspot management feature of the Zyxel ATP series firmware versions 4.60 throu

A command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 through 5.3

A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmw

Hamba avro is a go lang encoder/decoder implementation of the avro codec specification. In affected versions a well-craf

TOTOLINK CP300+ V5.2cu.7594 contains a Denial of Service vulnerability in function RebootSystem of the file lib/cste_mod

The configuration parser fails to sanitize user-controlled input in the Zyxel ATP series firmware versions 5.10 through

Furukawa Electric LatAm 423-41W/AC before v1.1.4 and LD421-21W before v1.3.3 were discovered to contain an HTML injectio

Mattermost iOS app fails to properly validate the server certificate while initializing the TLS connection allowing a ne

The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could al

Authentication Bypass by Primary Weakness vulnerability in Oliva Expertise Oliva Expertise EKS allows Collect Data as Pr

The AN_GradeBook WordPress plugin through 5.0.1 does not properly sanitise and escape a parameter before using it in a S

The Caldera Forms Google Sheets Connector WordPress plugin before 1.3 does not have CSRF check when updating its Access

The WooCommerce Google Sheet Connector WordPress plugin before 1.3.6 does not have CSRF check when updating its Access C

An SQL injection vulnerability exists in TapHome core HandleMessageUpdateDevicePropertiesRequest function before version

A hidden API exists in TapHome's core platform before version 2023.2 that allows an authenticated, low privileged user t

IBM Performance Tools for i 7.2, 7.3, 7.4, and 7.5 contains a local privilege escalation vulnerability. A malicious act

The IBM i 7.2, 7.3, 7.4, and 7.5 product Facsimile Support for i contains a local privilege escalation vulnerability. A

A vulnerability classified as critical was found in SourceCodester Life Insurance Management System 1.0. This vulnerabil

The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to chan

Unrestricted Upload of File with Dangerous Type in GitHub repository admidio/admidio prior to 4.2.10.

Plane version 0.7.1-dev allows an attacker to change the avatar of his profile, which allows uploading files with HTML e

Plane version 0.7.1 allows an unauthenticated attacker to view all stored server files of all users.

PNP4Nagios through 81ebfc5 lacks CSRF protection in the AJAX controller. This affects 0.6.26.

rswag before 2.10.1 allows remote attackers to read arbitrary JSON and YAML files via directory traversal, because rswag

Weave GitOps Terraform Controller (aka Weave TF-controller) is a controller for Flux to reconcile Terraform resources in

zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing _callable strings_ (ie

Knowage is an open source suite for business analytics. The application often use user supplied data to create HQL queri

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption ro

An out-of-bounds write vulnerability in Bitdefender Engines on Windows causes the engine to crash. This issue affects Bi

The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.

Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in t