2024

This vulnerability exists in Reedos aiM-Star version 2.0.1 due to improper access controls on its certain API endpoints.

When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify tha

An improper authorization vulnerability [CWE-285] in FortiSOAR version 7.4.0 through 7.4.3, 7.3.0 through 7.3.2, 7.2.0 t

The WooCommerce Photo Reviews Premium plugin for WordPress is vulnerable to authentication bypass in all versions up to,

The video carousel slider with lightbox plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in al

The Advanced WordPress Backgrounds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘imageTag’

The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to ar

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress

The Logo Slider WordPress plugin before 3.6.9 does not sanitise and escape some of its settings, which could allow high

The Gallery Plugin for WordPress WordPress plugin before 1.8.15 does not sanitise and escape some of its image settings

The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized access of

The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized modificati

Inclusion of Functionality from Untrusted Control Sphere(CWE-829) in the Command Centre Server and Workstations may allo

Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user

Affected versions of Octopus Server had a weak content security policy.

The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in all versions 2.2.87 to

Incorrect Calculation of Buffer Size (CWE-131) in the Controller 6000 and Controller 7000 OSDP message handling, allows

Buffer Copy without Checking Size of Input (CWE-120) in the Controller 6000 and Controller 7000 diagnostic web interface

Improper Neutralization of Input During Web Page Generation (CWE-79) in the Controller 6000 and Controller 7000 diagnost

In scheme of Uri.java, there is a possible way to craft a malformed Uri object due to improper input validation. This co

In getRegistration of RemoteProvisioningService.java, there is a possible way to permanently disable the AndroidKeyStore

In getConfig of SoftVideoDecoderOMXComponent.cpp, there is a possible out of bounds write due to a heap buffer overflow.

In addPreferencesForType of AccountTypePreferenceLoader.java, there is a possible way to disable apps for other users du

In handleCreateConferenceComplete of ConnectionServiceWrapper.java, there is a possible way to reveal images across user

In bindAndGetCallIdentification of CallScreeningServiceHelper.java, there is a possible way to maintain a while-in-use p

In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalati

In onCreate of SettingsHomepageActivity.java, there is a possible way to access the Settings app while the device is pro

In wifi_item_edit_content of styles.xml , there is a possible FRP bypass due to Missing check for FRP state. This could

In PVRSRVBridgeRGXKickTA3D2 of server_rgxta3d_bridge.c, there is a possible arbitrary code execution due to improper inp

In DevmemIntPFNotify of devicemem_server.c, there is a possible use-after-free due to a race condition. This could lead

Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. Scripts passing user-controlled values to ht

An uncontrolled search path in the agent of Ivanti EPM before 2022 SU6, or the 2024 September update allows a local auth

Weak authentication in Patch Management of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote auth

Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote

Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote

SQL injection in the management console of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unau

An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remo

An authentication bypass weakness in the message broker service of Ivanti Workspace Control before version 2025.2 (10.19

DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local aut

Insufficient server-side controls in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0

Cleartext transmission of sensitive information in the management console of Ivanti Workspace Control before version 202

An incorrectly implemented authentication scheme that is subjected to a spoofing attack in the management console of Iva

DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local aut

A vulnerability was found in Mercury MNVR816 up to 2.0.1.0.5. It has been classified as problematic. This affects an unk

An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user.

An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database reco

SpiderControl SCADA Web Server has a vulnerability that could allow an attacker to upload specially crafted malicious f

Renwoxing Enterprise Intelligent Management System before v3.0 was discovered to contain a SQL injection vulnerability v

Directus is a real-time API and App dashboard for managing SQL database content. An unauthenticated user can access cred

The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.