2024

Deserialization of Untrusted Data vulnerability in baptiste.gourdin Talkback talkback-secure-linkback-protocol allows Ob

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ninja Team Multi S

SQL Injection vulnerability in OpenHIS v.1.0 allows an attacker to execute arbitrary code via the refund function in the

An arbitrary file upload vulnerability in the ProductAction.entphone interface of Zhejiang University Entersoft Customer

Incorrect access control in the function handleDataChannelChat(dataMessage) of Mirotalk before commit c21d58 allows atta

angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Explo

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to n

Plane is an open-source project management tool. Plane uses the ** wildcard support to retrieve the image from any hostn

DataEase is an open source data visualization analysis tool. In Dataease, the PostgreSQL data source in the data source

The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing ca

The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerabl

An issue was discovered in GitLab EE affecting all versions starting from 12.5 prior to 17.2.9, starting from 17.3, prio

All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitizati

The Pedalo Connector plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.5

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves **insecure communica

An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowe

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to **Server-Side Requ

Deserialization of Untrusted Data vulnerability in eyecix JobSearch wp-jobsearch allows Object Injection.This issue affe

The SEUR plugin, in its versions prior to 2.5.11, is vulnerable to time-based SQL injection through the use of the ‘id_o

Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication v

The health endpoint is public so everybody can see a list of all services. It is potentially valuable information for at

The WP-Advanced-Search WordPress plugin before 3.3.9.2 does not sanitize and escape the t parameter before using it in a

The UserPlus plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.0 due to ins

The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(s

ssoready is a single sign on provider implemented via docker. Affected versions are vulnerable to XML signature bypass a

An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition

An issue was discovered in Trusted Firmware-M through 2.1.0. User provided (and controlled) mailbox messages contain a p

FydeOS for PC 17.1 R114, FydeOS for VMware 17.0 R114, FydeOS for You 17.1 R114, and OpenFyde R114 were discovered to be

In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible th

In the Linux kernel, the following vulnerability has been resolved: smack: tcp: ipv4, fix incorrect labeling Currently

An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timeli

cgi.c in weborf .0.17, 0.18, 0.19, and 0.20 (before 1.0) lacks '\0' termination of the path for CGI scripts because strn

Incorrect credential validation in LemonLDAP::NG 2.18.x and 2.19.x before 2.19.2 allows attackers to bypass OAuth2 clien

HDF5 library through 1.14.3 has memory corruption in H5A__close resulting in the corruption of the instruction pointer a

Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. In livewire/li

Microsoft Configuration Manager Remote Code Execution Vulnerability

Windows Netlogon Elevation of Privilege Vulnerability

Fujian Kelixin Communication Command and Dispatch Platform <=7.6.6.4391 is vulnerable to SQL Injection via /client/get_g

A SQL injection vulnerability in login portal in AnteeoWMS before v4.7.34 allows unauthenticated attackers to execute ar

A flaw exists whereby a user can make a specific call to a FlashArray endpoint allowing privilege escalation.

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause exposure of cr

The LatePoint plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.0.12. Thi

The LatePoint plugin for WordPress is vulnerable to Arbitrary User Password Change via SQL Injection in versions up to,

A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does not

A vulnerability has been identified in SENTRON 7KM PAC3200 (All versions). Affected devices only provide a 4-digit PIN t

A DLL hijacking vulnerability in VegaBird Vooki 5.2.9 allows attackers to execute arbitrary code / maintain persistence

A DLL hijacking vulnerability in VegaBird Yaazhini 2.0.2 allows attackers to execute arbitrary code / maintain persisten

RuoYi v4.7.9 and before has a security flaw that allows escaping from comments within the code generation feature, enabl

Mecha CMS 3.0.0 is vulnerable to Directory Traversal. An attacker can construct cookies and URIs that bypass user identi

SQL injection vulnerability in SOPlanning <1.45, via /soplanning/www/user_groupes.php in the by parameter, which could a