2024

A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work

A library injection vulnerability exists in Microsoft PowerPoint 16.83 for macOS. A specially crafted library can levera

Insecure Permissions vulnerability in SecureSTATION v.2.5.5.3116-S50-SMA-B20160811A and before allows a physically proxi

An access violation vulnerability exists in the DirectComposition functionality win32kbase.sys driver version 10.0.22000

An access violation vulnerability exists in the DirectComposition functionality win32kbase.sys driver version 10.0.22000

An issue in CodeAstro Complaint Management System v.1.0 allows a remote attacker to escalate privileges via the mess-vie

An IDOR vulnerability in the manage-notes.php module in PHPGurukul Online Notes Sharing Management System v1.0 allows un

An IDOR vulnerability in the edit-notes.php module of PHPGurukul Online Notes Sharing Management System v1.0 allows unau

Out of bounds write in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to execute arbitrary code i

Use after free in Compositing in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to potentially exploit

Out of bounds memory access in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to execute arbitrar

Type Confusion in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to potentially exploit heap corr

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected

Astro is a web framework for content-driven websites. In affected versions a bug in Astro’s CSRF-protection middleware a

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, r

A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacke

Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions envoy does not properly handle

Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions `sendOverloadError` is going to

Envoy is a cloud-native high-performance edge/middle/service proxy. When additional address are not ip addresses, then t

Misskey is an open source, federated social media platform.In affected versions missing validation in `NoteCreateService

Misskey is an open source, federated social media platform. In affected versions missing validation in `ApInboxService.u

Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService

Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService

Misskey is an open source, federated social media platform. Some APIs using `HttpRequestService` do not properly check t

IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD, IBM MQ Appliance 9.3 LTS, 9.3 CD, 9.4 LTS, and IBM MQ for HPE

Misskey is an open source, federated social media platform. In affected versions FileServerService (media proxy) in gith

OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection (SSTI) via the Theme Editor Function.

A deserialization of untrusted data vulnerability exists in NI DAQExpress that may result in remote code execution. Succ

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell

Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLM

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS w

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell

Improper Control of Generation of Code ('Code Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows Code Inj

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell

Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLM

Missing Authorization vulnerability in VibeThemes WPLMS wplms_plugin allows Accessing Functionality Not Properly Constra

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS w

DataEase is an open source business analytics tool. Authenticated users can read and deserialize arbitrary files through

DataEase is an open source business analytics tool. Authenticated users can remotely execute code through the backend JD

Incorrect Privilege Assignment vulnerability in wpweb WooCommerce PDF Vouchers woocommerce-pdf-vouchers allows Privilege

Missing Authorization vulnerability in Dotstore Advance Menu Manager advance-menu-manager.This issue affects Advance Men

Keyfactor Command before 12.5.0 has Incorrect Access Control: access tokens are over permissioned, aka 64099. The fixed

Keyfactor Remote File Orchestrator (aka remote-file-orchestrator) 2.8 before 2.8.1 allows Information Disclosure: sensit

There is a possible UAF due to a logic error in the code. This could lead to local escalation of privilege with no addit

In isSlotMarkedSuccessful of BootControl.cpp, there is a possible out of bounds read due to a missing bounds check. This

In dhd_prot_flowrings_pool_release of dhd_msgbuf.c, there is a possible outcof bounds write due to a missing bounds chec

Rhymix before 2.1.24 is vulnerable to Server-Side Request Forgery (SSRF) in the background import data function because

GetSimple CMS CE 3.3.19 is vulnerable to Server-Side Request Forgery (SSRF) in the backend plugin module.

Winmail Server 4.4 is vulnerable to f_user=%22%3E%3Csvg%20onload Cross Site Scripting (XSS).