2024

An issue in the component /jeecg-boot/jmreport/dict/list of JimuReport v1.7.8 allows attacker to escalate privileges via

Microsoft is aware of a vulnerability in Servicing Stack that has rolled back the fixes for some vulnerabilities affecti

Azure Stack Hub Elevation of Privilege Vulnerability

Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or mal

eladmin v2.7 and before is vulnerable to Server-Side Request Forgery (SSRF) which allows an attacker to execute arbitrar

Loftware Spectrum through 4.6 has unprotected JMX Registry.

Command Injection vulnerability in goform/SetIPTVCfg interface of Tenda AC15 V15.03.05.20 allows remote attackers to run

Loftware Spectrum before 4.6 HF14 uses a Hard-coded Password.

Loftware Spectrum before 4.6 HF13 Deserializes Untrusted Data.

Loftware Spectrum before 4.6 HF14 has Missing Authentication for a Critical Function.

Heap-based Buffer Overflow vulnerability in Samsung Open Source Escargot JavaScript engine allows Overflow Buffers.This

A vulnerability has been identified in Industrial Edge Management Pro (All versions < V1.9.5), Industrial Edge Managemen

A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions

A vulnerability has been identified in Opcenter Quality (All versions < V2406), Opcenter RDnL (All versions < V2410), SI

An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users c

**UNSUPPORTED WHEN ASSIGNED** A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versi

D-Link DI-8300 v16.07.26A1 is vulnerable to command injection via the msp_info_htm function.

D-Link DI-8300 v16.07.26A1 is vulnerable to command injection via the upgrade_filter_asp function.

In Connex health portal released before8/30/2024, SQL injection vulnerabilities were found that could have allowed an un

A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.

HPE has identified a denial of service vulnerability in HPE HP-UX System's Network File System (NFSv4) services.

Qualitor up to 8.24 is vulnerable to Remote Code Execution (RCE) via Arbitrary File Upload in checkAcesso.php.

SeaCMS v13.1 was discovered to a Server-Side Request Forgery (SSRF) via the url parameter at /admin_reslib.php.

Joplin is a free, open source note taking and to-do application. Joplin fails to take into account that "<" followed by

Missing Authentication for Critical Function vulnerability in Profelis Informatics and Consulting PassBox allows Authent

A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document con

Orca HCM from LEARNING DIGITAL has an Missing Authentication vulnerability, allowing unauthenticated remote attacker to

The Opti Marketing WordPress plugin through 2.0.9 does not properly sanitise and escape a parameter before using it in a

The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code exec

A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to re

An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account on

RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the password parameter at /resource/runlogin

RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the articleid parameter at /default/article.

RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the username parameter at /resource/runlogin

SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacke

H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file r

D-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via msp_info.htm.

D-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via sub47A60C function in the upgrade_filter.asp file

The WPCOM Member plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.5.2.

The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to privilege escalation/accoun

FlyCASS CASS and KCM systems did not correctly filter SQL queries, which made them vulnerable to attack by outside atta

An issue was discovered in Mbed TLS 3.x before 3.6.1. With TLS 1.3, when a server enables optional authentication of the

An issue was discovered in Mbed TLS 3.6 before 3.6.1. A stack buffer overflow in mbedtls_ecdsa_der_to_raw() and mbedtls_

Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection.This issue affects: * LoadMa

Sourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/lo

MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 23.12.4.2, a threat ac

SQL Injection vulnerability in ESAFENET CDG 5.6 and before allows an attacker to execute arbitrary code via the id param

SQL injection vulnerability, by which an attacker could send a specially designed query through CATEGORY parameter in /j

SQL injection vulnerability, by which an attacker could send a specially designed query through id parameter in /jobport