2024

All versions of the package node-gettext are vulnerable to Prototype Pollution via the addTranslations() function in get

Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API ledlimit.cgi was vulnerable for path t

Due to lack of proper authorization checks when calling user, a function module in obsolete Tobin interface in SAP Produ

Due to missing authorization check in SAP for Oil & Gas (Transportation and Distribution), an attacker authenticated as

Due to missing authorization check, SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker logge

The The Affiliate Super Assistent plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up

The Frontend Dashboard plugin for WordPress is vulnerable to unauthorized code execution due to insufficient filtering o

The RFC enabled function module allows a low privileged user to add any workbook to any user's workplace favourites. Thi

The RFC enabled function module allows a low privileged user to add URLs to any user's workplace favourites. This vulner

SAP NetWeaver Application Server for ABAP and ABAP Platform allow users with high privileges to execute a program that r

Due to missing authorization checks, SAP Business Warehouse (BEx Analyzer) allows an authenticated attacker to access in

The RFC enabled function module allows a low privileged user to read any user's workplace favourites and user menu along

Due to weak encoding of user-controlled inputs, eProcurement on SAP S/4HANA allows malicious scripts to be executed in t

The RFC enabled function module allows a low privileged user to delete the workplace favourites of any user. This vulner

Due to missing authorization checks, SAP BEx Analyzer allows an authenticated attacker to access information over the ne

**UNSUPPORTED WHEN ASSIGNED** A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versi

An insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web authe

A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. Affected by this vulne

A vulnerability classified as problematic has been found in SourceCodester Best House Rental Management System 1.0. Affe

D-Link DI-8300 v16.07.26A1 is vulnerable to command injection via the msp_info_htm function.

D-Link DI-8300 v16.07.26A1 is vulnerable to command injection via the upgrade_filter_asp function.

An issue was discovered in Samsung Mobile Processor Exynos Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380

In Baxter Connex health portal released before 8/30/2024, an improper access control vulnerability has been found that c

In Connex health portal released before8/30/2024, SQL injection vulnerabilities were found that could have allowed an un

A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.

AutoCMS v5.4 was discovered to contain a SQL injection vulnerability via the sidebar parameter at /admin/robot.php.

AutoCMS v5.4 was discovered to contain a PHP code injection vulnerability via the txtsite_url parameter at /admin/site_a

ONLYOFFICE Docs before 8.1.0 allows XSS via a GeneratorFunction Object attack against a macro. This is related to use of

HPE has identified a denial of service vulnerability in HPE HP-UX System's Network File System (NFSv4) services.

An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. I

An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. I

An issue was discovered in Samsung Mobile Processor Exynos Mobile Processor, Wearable Processor Exynos 980, Exynos 850,

An issue was discovered in Samsung Mobile Processor Exynos Wearable Processor Exynos 980, Exynos 850, Exynos 1080, Exyno

An issue was discovered in Samsung Mobile Processor, Wearable Processor Exynos Exynos 980, Exynos 850, Exynos 1080, Exyn

An issue was discovered in Mobile Processor, Wearable Processor Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos

ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression (IIFE), and theref

A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie

A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period i

An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and

Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular exp

An issue in Ellevo v.6.2.0.38160 allows a remote attacker to escalate privileges via the /api/usuario/cadastrodesuplente

Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via t

Qualitor up to 8.24 is vulnerable to Remote Code Execution (RCE) via Arbitrary File Upload in checkAcesso.php.

D-Link DI-7003G v19.12.24A1, DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.

D-Link DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.

Craft is a content management system (CMS). Craft CMS 5 stored XSS can be triggered by the breadcrumb list and title fie

D-Link DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.

A vulnerability classified as problematic was found in code-projects Inventory Management 1.0. This vulnerability affect

A vulnerability classified as problematic has been found in SourceCodester Online Food Ordering System 2.0. This affects