2024

The web service for ONS-S8 - Spectra Aggregation Switch includes functions which do not properly validate user input, al

Syrotech SY-GOPON-8OLT-L3 v1.6.0_240629 was discovered to contain an authenticated command injection vulnerability.

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express. This vulnerability affects the use of the

Buffer Overflow vulnerabilities exist in DrayTek Vigor310 devices through 4.3.2.6 (in the Vigor management UI) because o

DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to change settings or cause a denial of service via .cg

An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the http

DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_d

DrayTek Vigor3910 devices through 4.3.2.6 have a stack-based overflow when processing query string parameters because Ge

DrayTek Vigor3910 devices through 4.3.2.6 allow unauthenticated DOM-based reflected XSS.

Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on

DrayTek Vigor310 devices through 4.3.2.6 use unencrypted HTTP for authentication requests.

The CGI endpoints v2x00.cgi and cgiwcg.cgi of DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to buffer overflo

Stored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayTek Vigor31

A stack-based Buffer Overflow vulnerability in DrayTek Vigor310 devices through 4.3.2.6 allows a remote attacker to exec

DrayTek Vigor3910 devices through 4.3.2.6 are affected by an OS command injection vulnerability that allows an attacker

DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to reflected XSS by authenticated users, caused by missing vali

DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to stored Cross Site Scripting (XSS) by authenticated users due

Backstage is an open framework for building developer portals. Configuration supplied through APP_CONFIG_* environment v

TEM Opera Plus FM Family Transmitter allows access to an unprotected endpoint that allows MPFS File System binary image

The TEM Opera Plus FM Family Transmitter application interface allows users to perform certain actions via HTTP requests

In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header.

The Eufy Homebase 2 before firmware version 3.3.4.1h creates a dedicated wireless network for its ecosystem, which serve

NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRs

Improper Check for Unusual or Exceptional Conditions vulnerability in Webroot SecureAnywhere - Web Shield on Windows, AR

Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Webroot SecureAnywhere - Web Shield on Wi

Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Webroot SecureAnywhere - Web Shield on Wi

Bandisoft BandiView 7.05 is vulnerable to Buffer Overflow via sub_0x410d1d. The vulnerability occurs due to insufficient

Bandisoft BandiView 7.05 is Incorrect Access Control via sub_0x232bd8 resulting in denial of service (DOS).

NVIDIA CUDA Toolkit for Windows and Linux contains a vulnerability in the nvdisam command line tool, where a user can ca

NVIDIA CUDA Toolkit for Windows and Linux contains a vulnerability in the nvdisam command line tool, where a user can ca

NVIDIA CUDA toolkit for Windows and Linux contains a vulnerability in the nvdisasm command line tool where an attacker m

Bandisoft BandiView 7.05 is vulnerable to Incorrect Access Control in sub_0x3d80fc via a crafted POC file.

An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Pro

A directory traversal vulnerability exists in the log files download functionality of Veertu Anka Build 1.42.0. A specia

A directory traversal vulnerability exists in the archive functionality of Veertu Anka Build 1.42.0. A specially crafted

A privilege escalation vulnerability exists in the node update functionality of Veertu Anka Build 1.42.0. A specially cr

An integer overflow vulnerability exists in the Compound Document Binary File format parser of the GNOME Project G Struc

An attacker can publish a zone containing specific Resource Record Sets. Repeatedly processing and caching results for

A vulnerability was found in Codezips Online Shopping Portal 1.0. It has been classified as critical. Affected is an unk

Zohocorp ManageEngine Analytics Plus versions before 5410 and Zoho Analytics On-Premise versions before 5410 are vulnera

The AVGUI.exe of AVG/Avast Antivirus before versions before 24.1 can allow a local attacker to escalate privileges via a

Sulu is a PHP content management system. Sulu is vulnerable against XSS whereas a low privileged user with access to the

Sulu is a PHP content management system. This vulnerability allows an attacker to inject arbitrary HTML/JavaScript code

async-graphql is a GraphQL server library implemented in Rust. async-graphql before 7.0.10 does not limit the number of

Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader c

Authd PAM module before version 0.3.5 can allow broker-managed users to impersonate any other user managed by the same b

Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code.

A security vulnerability in HPE IceWall Agent products could be exploited remotely to cause a Cross-Site Request Forgery

Deep Freeze 9.00.020.5760 is vulnerable to an out-of-bounds read vulnerability by triggering the 0x70014 IOCTL code of t

The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to Directory