2024

HCL Nomad server on Domino fails to properly handle users configured with limited Domino access resulting in a possible

A vulnerability was found in ShopXO up to 6.1.0. It has been declared as critical. Affected by this vulnerability is an

In the Linux kernel, the following vulnerability has been resolved: media: v4l: async: Properly re-initialise notifier

In the Linux kernel, the following vulnerability has been resolved: mmc: davinci: Don't strip remove function when driv

In the Linux kernel, the following vulnerability has been resolved: md/raid5: fix deadlock that raid5d() wait for itsel

In the Linux kernel, the following vulnerability has been resolved: fbdev: savage: Handle err return when savagefb_chec

In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: fix vmalloc which may return null if ca

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix input format query of

drupal-wiki.com Drupal Wiki before 8.31.1 allows XSS via comments, captions, and image titles of a Wiki page.

An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file

Cross Site Scripting (XSS) vulnerability in Automattic Newspack Ads allows Stored XSS.This issue affects Newspack Ads: f

Cross Site Scripting (XSS) vulnerability in Automattic Newspack Campaigns allows Stored XSS.This issue affects Newspack

Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filenam

VMware Cloud Director Availability contains an HTML injection vulnerability. A malicious actor with network access to

Kaiten 57.128.8 allows remote attackers to enumerate user accounts via a crafted POST request, because a login response

A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in the licensing featur

Missing Authentication for Critical Function vulnerability in the mobile monitoring feature of Mitsubishi Electric GENES

The One Click Order Re-Order plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ca

The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pos

The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Marq

The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widg

Multiple TP-LINK products allow a network-adjacent attacker with an administrative privilege to execute arbitrary OS com

A cross-site request forgery vulnerability exists in WP Tweet Walls versions prior to 1.0.4. If this vulnerability is ex

The bson_string_append function in MongoDB C Driver may be vulnerable to a buffer overflow where the function might atte

ZITADEL is an open-source identity infrastructure tool. ZITADEL provides users the ability to list all user sessions of

Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta4 o

Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch, version 3.3.0.beta3 on t

Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 o

An issue was discovered in Artifex Ghostscript before 10.03.1. There is path traversal (via a crafted PostScript documen

An issue was discovered in Artifex Ghostscript before 10.03.1. Path traversal and command execution can occur (via a cra

Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with

Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont p

The vulnerability allows an attacker to access sensitive files on the server by confusing the agent with incorrect file

Fides is an open-source privacy engineering platform, and `SERVER_SIDE_FIDES_API_URL` is a server-side configuration env

A malicious BLE device can send a specific order of packet sequence to cause a DoS attack on the victim BLE device

A cross-site scripting (XSS) vulnerability in SimpCMS v0.1 allows attackers to execute arbitrary web scripts or HTML via

Stored XSS in Checkmk before versions 2.3.0p8, 2.2.0p29, 2.1.0p45, and 2.0.0 (EOL) allows users to execute arbitrary scr

BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, A

A vulnerability classified as critical has been found in SourceCodester Online Tours & Travels Management 1.0. This affe

Insecure Permissions vulnerability in Micro-Star International Co., Ltd MSI Center v.2.0.36.0 allows a local attacker to

Mattermost versions 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2, 9.5.x <= 9.5.5 fail to prevent specifying a RemoteId when cre

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Coun

The WP Lightbox 2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all ver

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPre

The WPQA Builder WordPress plugin before 6.1.1 does not sanitise and escape some of its Slider settings, which could all

The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make use

The Himer WordPress theme before 2.1.1 does not sanitise and escape some of its Post settings, which could allow high pr

The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make log

The allows any authenticated user to join a private group due to a missing authorization check on a function