2024

Improper Input Validation in Hitron Systems DVR LGUVR-4H 1.02~4.02 allows an attacker to cause network attack in case of

Improper Input Validation in Hitron Systems DVR HVR-16781 1.03~4.02 allows an attacker to cause network attack in case o

Improper Input Validation in Hitron Systems DVR HVR-8781 1.03~4.02 allows an attacker to cause network attack in case of

Improper Input Validation in Hitron Systems DVR HVR-4781 1.03~4.02 allows an attacker to cause network attack in case of

A type confusion issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 15.8.7 and iPadOS 15.

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 16.7.5 and iP

The issue was addressed with improved memory handling. This issue is fixed in Safari 17.3, iOS 16.7.5 and iPadOS 16.7.5,

The issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and

The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.3. Processing web content

The issue was addressed with improved memory handling. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.

The issue was addressed with additional permissions checks. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.

The issue was addressed with additional permissions checks. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.

The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.2. Processing a file may l

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application. All users of Nautobot

The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (El

In Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3, Splunk Enterprise does not correctly sanitize path inpu

Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a command injection vulnerability in the fu

The Import any XML or CSV File to WordPress plugin before 3.7.3 accepts all zip files and automatically extracts the zip

Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sit

Project files may contain malicious contents which the software will use to create files on the filesystem. This allows

The Omron FINS protocol has an authenticated feature to prevent access to memory regions. Authentication is susceptible

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in Uniview ISC 2500-S

DedeCMS 5.7.112 has a File Upload vulnerability via uploads/dede/module_upload.php.

CloudLinux CageFS 7.1.1-1 or below passes the authentication token as a command line argument. In some configurations th

In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that

chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted.

Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP

Technicolor TC8715D devices have predictable default WPA2 security passwords. An attacker who scans for SSID and BSSID v

Dremio before 24.3.1 allows path traversal. An authenticated user who has no privileges on certain folders (and the file

MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.run_script() passes shell met

An issue was discovered in Mbed TLS 3.5.1. There is persistent handshake denial if a client sends a TLS 1.3 ClientHello

An issue was discovered in Mbed TLS through 3.5.1. In mbedtls_ssl_session_reset, the maximum negotiable TLS version is m

The JSON loader in Embedchain before 0.1.57 allows a ReDoS (regular expression denial of service) via a long string to j

A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's deletion of SK

Ubee DDW365 XCNDDW365 devices have predictable default WPA2 PSKs that could lead to unauthorized remote access. A remote

Code Injection in paddlepaddle/paddle

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission parameters in all

Cross-Site Request Forgery (CSRF) in NCR Terminal Handler v.1.5.1 leads to a one-click account takeover. This is achieve

YonBIP v3_23.05 was discovered to contain an arbitrary file read vulnerability via the nc.bs.framework.comn.serv.CommonS

A vulnerability, which was classified as critical, was found in Hecheng Leadshop up to 1.4.20. Affected is an unknown fu

Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and co

Inefficient algorithmic complexity in DecodeFromBytes function in com.upokecenter.cbor Java implementation of Concise Bi

Artemis Java Test Sandbox versions less than 1.7.6 are vulnerable to a sandbox escape when an attacker crafts a special

Artemis Java Test Sandbox versions before 1.8.0 are vulnerable to a sandbox escape when an attacker includes class files

Artemis Java Test Sandbox versions before 1.11.2 are vulnerable to a sandbox escape when an attacker loads untrusted lib

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Ar

Anomali Match before 4.6.2 allows OS Command Injection. An authenticated admin user can inject and execute operating sys

Vite is a frontend tooling framework for javascript. The Vite dev server option `server.fs.deny` can be bypassed on case

A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker to bypass integrit

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vuln