2024

A vulnerability regarding improper limitation of a pathname to a restricted directory ('Path Traversal') is found in the

The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the

The Easy Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi

The Easy Image Collage plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check

CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an

luci-app-sms-tool v1.9-6 was discovered to contain a command injection vulnerability via the score parameter.

A NULL Pointer Dereference vulnerability in DumpTS v0.1.0-nightly allows attackers to cause a denial of service via the

D-Link DIR-1950 up to v1.11B03 does not validate SSL certificates when requesting the latest firmware version and downlo

The CoSoSys Endpoint Protector through 5.9.3 and Unify agent through 7.0.6 is susceptible to an arbitrary code execution

VMware Cloud Director Object Storage Extension contains an Insertion of Sensitive Information vulnerability. A malicio

VMware Cloud Director contains an Improper Privilege Management vulnerability. An authenticated tenant administrator

VMware Workspace One UEM update addresses an information exposure vulnerability.  A malicious actor with network access

Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of service via the __zzip_pars

Heap Buffer Overflow vulnerability in DumpTS v0.1.0-nightly allows attackers to cause a denial of service via the functi

DESIGNA ABACUS v.18 and before allows an attacker to bypass the payment process via a crafted QR code.

In version 1.2.7 of lunary-ai/lunary, any authenticated user, regardless of their role, can change the name of an organi

An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'file' param

A Cross-Site Request Forgery (CSRF) vulnerability in version 0.5.0 of imartinez/privategpt allows an attacker to delete

A Cross-site Scripting (XSS) vulnerability exists in the chat functionality of parisneo/lollms-webui in the latest versi

In lunary-ai/lunary versions <=v1.2.11, an attacker can bypass email validation by using a dot character ('.') in the em

In lunary-ai/lunary version 1.2.4, an improper access control vulnerability allows members with team management permissi

berriai/litellm version 1.34.34 is vulnerable to improper access control in its team management functionality. This vuln

Vulnerability in Spotfire Spotfire Enterprise Runtime for R - Server Edition, Spotfire Spotfire Statistics Services, Spo

In a Silicon Labs  multi-protocol gateway, a corrupt pointer to buffered data on a multi-protocol radio co-processor (

IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could disclose sensitive information to a local user to do

IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows a privileg

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.2.0.2 is vulnerable to cross-site scripting. This vulnera

IBM Sterling B2B Integrator Standard Edition 6.1 and 6.2 does not restrict or incorrectly restricts frame objects or UI

IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 uses weaker than expected cryptographic algorithms that cou

Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivil

IBM Security Verify Access 10.0.0.0 through 10.0.7.1, under certain configurations, could allow an unauthenticated attac

Buffer overflow in the extract_openvpn_cr function in openvpn-cr.c in openvpn-auth-ldap (aka the Three Rings Auth-LDAP p

IBM Security Verify Access 10.0.0 through 10.0.7.1 could allow a local user to obtain sensitive information from trace l

idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ipRecord_deal.php?mu

idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/info_deal.php?mudi=d

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Talya Informatics

A vulnerability, which was classified as critical, was found in itsourcecode Tailoring Management System 1.0. This affec

The Portfolio Gallery – Image Gallery Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the p

An issue was discovered in SoftMaker Office 2024 / NX before revision 1214 and SoftMaker FreeOffice 2014 before revision

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPre

The Create by Mediavine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Schema Meta s

Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can lead a malicious

The Contact Form 7 WordPress plugin before 5.9.5 has an open redirect that allows an attacker to utilize a false URL and

The WP Chat App WordPress plugin before 3.6.5 does not sanitise and escape some of its settings, which could allow high

The Interactive Content WordPress plugin before 1.15.8 does not validate uploads which could allow a Contributors and a

The kadence-blocks-pro WordPress plugin before 2.3.8 does not prevent users with at least the contributor role using som

The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL parameter of

The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter i

The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter i

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Si