2024

Directory traversal vulnerability in the cust module Impact: Successful exploitation of this vulnerability will affect a

Permission control vulnerability in the software update module. Impact: Successful exploitation of this vulnerability ma

Vulnerability of permission verification for APIs in the DownloadProviderMain module Impact: Successful exploitation of

Input verification vulnerability in the system service module Impact: Successful exploitation of this vulnerability will

Access control vulnerability in the SystemUI module Impact: Successful exploitation of this vulnerability may affect ser

Cleartext transmission of sensitive information vulnerability exists in multiple IDEC PLCs. If an attacker sends a speci

A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted

Websites could utilize Javascript links to spoof URL addresses in the Focus navigation bar This vulnerability affects Fo

A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the tim

Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECD

Pagefind, a fully static search library, initializes its dynamic JavaScript and WebAssembly files relative to the locati

SquaredUp DS for SCOM 6.2.1.11104 allows XSS.

PingCAP TiDB v8.1.0 was discovered to contain a buffer overflow via the component (*Column).GetDecimal. This allows atta

The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3. The `BareMetalHost` (

A cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows attackers to execute arbitrary web scripts or HTML vi

A Host header injection vulnerability in the password reset function of LimeSurvey v.6.6.1+240806 and before allows atta

A CSV injection vulnerability in Lime Survey v6.5.12 allows attackers to execute arbitrary code via uploading a crafted

Xibo is an open source digital signage platform with a web content management system (CMS). Prior to version 4.1.0, a cr

BPL Personal Weighing Scale PWS-01BT IND/09/18/599 devices send sensitive information in unencrypted BLE packets. (The p

Multiple prompts and panels from both Firefox and the Android OS could be used to obscure the notification announcing th

If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of anot

A cross-site scripting (XSS) vulnerability in the component admin_collect_news.php of SeaCMS v12.9 allows attackers to e

Dell Path to PowerProtect, versions 1.1, 1.2, contains an Exposure of Private Personal Information to an Unauthorized Ac

A reflected cross-site scripting (XSS) vulnerability in the CGI program "dynamic_script.cgi" of Zyxel ATP series firmwar

A buffer overflow vulnerability in the CGI program of Zyxel ATP series firmware versions from V4.32 through V5.38, USG F

A vulnerability was found in SourceCodester Contact Manager with Export to VCF 1.0. It has been rated as critical. This

The Electron desktop application of Rocket.Chat through 6.3.4 allows stored XSS via links in an uploaded file, related t

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NAC Telecommunicat

Overleaf is a web-based collaborative LaTeX editor. When installing Server Pro using the Overleaf Toolkit from before 20

Overleaf is a web-based collaborative LaTeX editor. Overleaf Community Edition and Server Pro prior to version 5.0.7 (or

HedgeDoc is an open source, real-time, collaborative, markdown notes application. When using HedgeDoc 1 with MySQL or Ma

Vim is an open source, command line text editor. Patch v9.1.0038 optimized how the cursor position is calculated and rem

In the Linux kernel, the following vulnerability has been resolved: fuse: Initialize beyond-EOF page contents before se

Jellyfin is an open source self hosted media server. The Jellyfin user profile image upload accepts SVG files, allowing

audiobookshelf is a self-hosted audiobook and podcast server. A non-admin user is not allowed to create libraries (or ac

Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.17.0 o

A vulnerability was found in nescalante urlregex up to 0.5.0 and classified as problematic. This issue affects some unkn

Improper neutralization of input in Checkmk before version 2.3.0p14 allows attackers to inject and run malicious scripts

Transient DOS while handling PS event when Program Service name length offset value is set to 255.

memory corruption when an invalid firehose patch command is invoked.

The Flaming Forms WordPress plugin through 1.0.1 does not sanitise and escape a parameter before outputting it back in t

The Flaming Forms WordPress plugin through 1.0.1 does not sanitise and escape some parameters, which could allow unauthe

The DN Popup WordPress plugin through 1.2.2 does not have CSRF check in place when updating its settings, which could al

The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leadin

Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers

CodeAstro MembershipM-PHP (aka Membership Management System in PHP) 1.0 allows add_members.php fullname stored XSS.

REDCap 14.7.0 allows HTML injection via the project title of a New Project action. This can lead to resultant logout CSR

in OpenHarmony v4.1.0 and prior versions allow a remote attacker cause information leak through out-of-bounds Read.

in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read.

in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read.