2024

The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, valida

authentik is an open-source Identity Provider. Access restrictions assigned to an application were not checked when usin

authentik is an open-source Identity Provider that emphasizes flexibility and versatility. Authentik API-Access-Token me

IBM MQ 9.3 LTS and 9.3 CD could allow an authenticated user to escalate their privileges under certain configurations du

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. There is a stored

Server Side Request Forgery (SSRF) vulnerability in AdmirorFrames Joomla! extension in afGdStream.php script allows to a

Full Path Disclosure vulnerability in AdmirorFrames Joomla! extension in afHelper.php script allows an unauthorised atta

A vulnerability regarding authentication bypass by spoofing is found in the RTSP functionality. This allows man-in-the-m

Download of code without integrity check vulnerability in AirPrint functionality in Synology Router Manager (SRM) before

A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is

A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is

It was identified that under certain specific preconditions, an API key that was originally created with a specific priv

An issue was discovered in the Agent in Delinea Privilege Manager (formerly Thycotic Privilege Manager) before 12.0.1096

In the Linux kernel before 4.8, usb_parse_endpoint in drivers/usb/core/config.c does not validate the wMaxPacketSize fie

The XPC service within the audit functionality of Jamf Compliance Editor before version 1.3.1 on macOS can lead to local

In phpseclib before 1.0.22, 2.x before 2.0.46, and 3.x before 3.0.33, some characters in Subject Alternative Name fields

A Stack Buffer Overflow vulnerability in zziplibv 0.13.77 allows attackers to cause a denial of service via the __zzip_f

Netwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnera

Netwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnera

lua-shmem v1.0-1 was discovered to contain a buffer overflow via the shmem_write function.

A NULL Pointer Dereference discovered in DumpTS v0.1.0-nightly allows attackers to cause a denial of service via the fun

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The TOTP authenti

An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the `open_file` endpoint

A path traversal vulnerability exists in the XTTS server of the parisneo/lollms package version v9.6. This vulnerability

A path traversal vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240410, allowing any user to delete other

A path traversal vulnerability exists in the XTTS server included in the lollms package, version v9.6. This vulnerabilit

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt.

In h2oai/h2o-3 version 3.46.0, the `run_tool` command in the `rapids` component allows the `main` function of any class

stangirard/quivr version 0.0.236 contains a Server-Side Request Forgery (SSRF) vulnerability. The application does not p

A path traversal vulnerability in the `/set_personality_config` endpoint of parisneo/lollms version 9.4.0 allows an atta

An unprotected WebSocket connection in the latest version of stitionai/devika (commit ecee79f) allows a malicious websit

This Advisory describes an issue that impacts Arista Wireless Access Points. Any entity with the ability to authenticate

An unauthenticated IEEE 802.15.4 'co-ordinator realignment' packet can be used to force Zigbee nodes to change their net

IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1, under certain configurations, could allow a user on the ne

IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain root access due to impro

IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain root access due to impro

A directory traversal vulnerability exists in the stitionai/devika repository, specifically within the /api/download-pro

A directory traversal vulnerability exists in the /api/download-project-pdf endpoint of the stitionai/devika repository,

A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerabili

An authenticated attacker can exploit an untrusted search path vulnerability in Microsoft Dataverse to execute code over

IBM OpenBMC FW1050.00 through FW1050.10 BMCWeb HTTPS server component could disclose sensitive URI content to an unautho

Parsing a corrupt or malicious image with invalid color indices can cause a panic.

TELSAT marKoni FM Transmitters are vulnerable to a command injection vulnerability through the manipulation of settings

idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/userSys_deal.php?mud

idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/keyWord_deal.php?mud

A vulnerability has been found in itsourcecode Online Food Ordering System up to 1.0 and classified as critical. This vu

A vulnerability, which was classified as critical, has been found in itsourcecode Pool of Bethesda Online Reservation Sy

A specially crafted url can be created which leads to a directory traversal in the salt file server. A malicious user ca

The Auto Featured Image plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation

Improper authorization in global search in GitLab EE affecting all versions from 16.11 prior to 16.11.5 and 17.0 prior t