2023

Xpand IT Write-back manager v2.3.1 uses a hardcoded salt in license class configuration which leads to the generation of

A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application allows users to

A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application returns inconsis

Weak access control in Wing FTP Server (Admin Web Client) allows for privilege escalation.This issue affects Wing FTP Se

Insecure storage of sensitive information in Wing FTP Server (User Web Client) allows information elicitation.This issue

Insecure default permissions in Wing FTP Server (Admin Web Client) allows for privilege escalation.This issue affects Wi

All versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input is used to build he

S4CORE (Manage Purchase Contracts App) - versions 102, 103, 104, 105, 106, 107, does not perform necessary authorization

SAP NetWeaver AS ABAP (applications based on Unified Rendering) - versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 75

SAP BusinessObjects Suite Installer - version 420, 430, allows an attacker within the network to create a directory unde

SAP PowerDesigner Client - version 16.7, allows an unauthenticated attacker to inject VBScript code in a document and ha

The Crayon Syntax Highlighter plugin for WordPress is vulnerable to Server Side Request Forgery via the 'crayon' shortco

The JQuery Accordion Menu Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dcwp-jquery-acco

The Google Maps Plugin by Intergeo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'intergeo' shor

The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mappress' shortco

Due to missing authentication check in webdynpro application, an unauthorized user in SAP NetWeaver (Guided Procedures)

Due to the lack of validation, SAP BusinessObjects Business Intelligence Platform (Version Management System) - version

A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the

A reflected cross-site scripting (XSS) vulnerability in DevCode OpenSTAManager versions 2.4.24 to 2.4.47 may allow a rem

In bindSelection of DatabaseUtils.java, there is a possible way to access files from other applications due to SQL injec

In multiple locations, there is a possible way to import contacts belonging to other users due to a confused deputy. Thi

In MtpPropertyValue of MtpProperty.h, there is a possible out of bounds read due to uninitialized data. This could lead

In onCreate of DeviceAdminAdd.java, there is a possible way to forcibly add a device admin due to a missing permission c

In loadMediaResumptionControls of MediaResumeListener.kt, there is a possible way to play and listen to media files play

In onHostEmulationData of HostEmulationManager.java, there is a possible way for a general purpose NFC reader to read th

In convertSubgraphFromHAL of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. Th

The Herd Effects WordPress plugin before 5.2.4 does not have CSRF when deleting its items, which could allow attackers t

The Lock User Account WordPress plugin through 1.0.3 does not have CSRF check when bulk locking and unlocking accounts,

The URL Shortify WordPress plugin before 1.7.6 does not properly escape the value of the referer header, thus allowing a

The Min Max Control WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting it back in th

The WP Adminify WordPress plugin before 3.1.6 does not sanitise and escape some of its settings, which could allow high

The Herd Effects WordPress plugin before 5.2.3 does not sanitise and escape some of its settings, which could allow high

ux-autocomplete is a JavaScript Autocomplete functionality for Symfony. Under certain circumstances, an attacker could s

The FTP Access WordPress plugin through 1.0 does not have authorisation and CSRF checks when updating its settings and i

The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, do

The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, do

​Softneta MedDream PACS stores usernames and passwords in plaintext. The plaintext storage could be abused by attackers

Dover Fueling Solutions MAGLINK LX Web Console Configuration versions 2.5.1, 2.5.2, 2.5.3, 2.6.1, 2.11, 3.0, 3.2, and 3.

The gAppointments WordPress plugin before 1.10.0 does not sanitise and escape a parameter before outputting it back in t

Interact 7.9.79.5 allows stored Cross-site Scripting (XSS) attacks in several locations, allowing an attacker to store a

libvips is a demand-driven, horizontally threaded image processing library. A specially crafted SVG input can cause libv

An open redirect vulnerability in the sanitize_url() parameter of CouchCMS v2.3 allows attackers to redirect a victim us

Multiple cross-site scripting (XSS) vulnerabilities in Dairy Farm Shop Management System Using PHP and MySQL v1.1 allow

Cross Site Scripting vulnerability in ZLMediaKiet v.4.0 and v.5.0 allows an attacker to execute arbitrary code via a cra

GPAC through 2.2.1 has a use-after-free vulnerability in the function gf_bifs_flush_command_list in bifs/memory_decoder.

An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.1.5, all versions starting fr

HKcms v2.3.0.230709 is vulnerable to Cross Site Scripting (XSS) allowing administrator cookies to be stolen.

An issue in Ethereum Blockchain v0.1.1+commit.6ff4cd6 cause the balance to be zeroed out when the value of betsize+casin

Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 20.005.30334 (and earlier) are affect

Adobe Acrobat Reader versions 2019.010.20098 and earlier are affected by an out-of-bounds read vulnerability that could