2024

The Bridge Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'formforall' shortcode in versions

In the process of testing the Relevanssi WordPress plugin before 4.23.1, a vulnerability was found that allows you to i

Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow

All versions of the package ggit are vulnerable to Arbitrary Argument Injection via the clone() API, which allows specif

SAP NetWeaver Enterprise Portal (KMC) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scrip

Fields which are in 'read only' state in Bank Statement Draft in Manage Bank Statements application, could be modified b

SAP Commerce Backoffice does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vul

The SAP HANA Node.js client package versions from 2.0.0 before 2.21.31 is impacted by Prototype Pollution vulnerability

in OpenHarmony v4.1.0 allow a local attacker with high privileges arbitrary code execution in pre-installed apps through

in OpenHarmony v4.1.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read.

Improper resource management in firmware of some Solidigm DC Products may allow an attacker to potentially enable denial

Improper resource shutdown in middle of certain operations on some Solidigm DC Products may allow an attacker to potenti

Saltcorn is an extensible, open source, no-code database application builder. A logged-in user with any role can delete

Lara-zeus Dynamic Dashboard simple way to manage widgets for your website landing page, and filament dashboard and Lara-

CreateWiki is an extension used at Miraheze for requesting & creating wikis. The name of requested wikis is not escaped

Race condition during resource shutdown in some Solidigm DC Products may allow an attacker to potentially enable denial

In some Solidigm DC Products, a defect in device overprovisioning may provide information disclosure to an attacker.

Improper resource initialization handling in firmware of some Solidigm DC Products may allow an attacker to potentially

Discourse is an open source platform for community discussion. An attacker can execute arbitrary JavaScript on users' br

A security flaw has been discovered in Solvait version 24.4.2 that allows an attacker to elevate their privileges. By ma

Discourse is an open source platform for community discussion. Users can see topics with a hidden tag if they know the l

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to constru

Cacti is an open source performance and fault management framework. The`consolenewsection` parameter is not properly san

Cacti is an open source performance and fault management framework. The `title` parameter is not properly sanitized when

Improper access removal handling in firmware of some Solidigm DC Products may allow an attacker with physical access to

Improper resource management in firmware of some Solidigm DC Products may allow an attacker to potentially control the p

Improper error handling in firmware of some SSD DC Products may allow an attacker to enable denial of service.

Meshtastic is an open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices. Mesht

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. `\PhpOffice\PhpSpreadsheet\Writer\Html`

Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service b

Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may creat

BlueCMS 1.6 suffers from Arbitrary File Deletion via the file_name parameter in an /admin/database.php?act=del request.

D-Link COVR-2600R FW101b05 is vulnerable to Buffer Overflow. In the function sub_24E28, the HTTP_REFERER is obtained thr

A reflected cross-site scripting (XSS) vulnerability in Elaine's Realtime CRM Automation v6.18.17 allows attackers to ex

itsourcecode Placement Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Full Name field in regi

IoT Haat Smart Plug IH-IN-16A-S IH-IN-16A-S v5.16.1 suffers from Insufficient Session Expiration. The lack of validation

Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting (XSS) via the organization name field in /admin/contacts/organiz

Cross Site Scripting vulnerability in LimeSurvey before 6.5.0+240319 allows a remote attacker to execute arbitrary code

Cross Site Scripting vulnerability in LimeSurvey before 6.5.12+240611 allows a remote attacker to execute arbitrary code

SQL injection vulnerability in SOPlanning <1.45, through /soplanning/www/groupe_list.php, in the by parameter, which cou

Cross-Site Scripting (XSS) vulnerability in SOPlanning <1.45, due to lack of proper validation of user input via /soplan

Cross-Site Scripting (XSS) vulnerability in SOPlanning <1.45, due to lack of proper validation of user input via /soplan

OnlineNewsSite v1.0 is vulnerable to Cross Site Scripting (XSS) which allows attackers to execute arbitrary code via the

TP-Link WR740N V6 has a stack overflow vulnerability via the ssid parameter in /userRpm/popupSiteSurveyRpm.htm url.

Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability t

The E2EE password entropy generated by Rocket.Chat Mobile prior to version 4.5.1 is insufficient, allowing attackers to

Information disclosure while sending implicit broadcast containing APP launch information.

Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario.

Memory corruption while invoking IOCTL calls for MSM module from the user space during audio playback and record.

Memory corruption while sending the persist buffer command packet from the user-space to the kernel space through the IO