2024

FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/admin/add_group_save

FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/user/group_update

FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/user/group_save.

FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/score/del.

This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12

A vulnerability has been found in Yunyou CMS up to 2.2.6 and classified as critical. This vulnerability affects unknown

Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Un

Stupid Simple CMS <=1.2.4 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin-edit.ph

A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote a

Cross-Site Request Forgery (CSRF) vulnerability in Vinoj Cardoza 3D Tag Cloud allows Stored XSS.This issue affects 3D Ta

An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user

In Progress MOVEit Transfer versions released before 2022.0.10 (14.0.10), 2022.1.11 (14.1.11), 2023.0.8 (15.0.8), 2023.

The Track The Click WordPress plugin before 0.3.12 does not properly sanitize query parameters to the stats REST endpoin

Buffer overflow vulnerability in Explorer++ affecting version 1.3.5.531. A local attacker could execute arbitrary code v

ExamSys 9150244 allows SQL Injection via the /Support/action/Pages.php s_score2 parameter.

This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to transmission of authentication credentials

This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to transmission of authentication credentials

The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin, version 1.5.3, is vulnerable to Post-Authenticat

DataHub is an open-source metadata platform. In affected versions a low privileged user could remove a user, edit group

Shopware is an open headless commerce platform. The implemented Flow Builder functionality in the Shopware application d

Avo is a framework to create admin panels for Ruby on Rails apps. A stored cross-site scripting (XSS) vulnerability was

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE

Vulnerability in Oracle Audit Vault and Database Firewall (component: Firewall). Supported versions that are affected a

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Mana

A vulnerability classified as critical has been found in ZhiCms up to 4.0. This affects an unknown part of the file app/

Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially expl

Type confusion in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corr

Out of bounds write in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Servic

Improper Link Resolution Before File Access ('Link Following') vulnerability in HYPR Workforce Access on MacOS allows Us

Improper Input Validation vulnerability in HYPR Workforce Access on Windows allows Path Traversal.This issue affects Wor

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. T

Prior to v176, when opening a new project Meta Spark Studio would execute scripts defined inside of a package.json file

Budget and Expense Tracker System v1.0 is vulnerable to SQL Injection via /expense_budget/admin/?page=reports/budget&dat

Complete Supplier Management System v1.0 is vulnerable to SQL Injection via /Supply_Management_System/admin/edit_distrib

Complete Supplier Management System v1.0 is vulnerable to SQL Injection via /Supply_Management_System/admin/edit_retaile

Complete Supplier Management System v1.0 is vulnerable to SQL Injection via /Supply_Management_System/admin/edit_categor

This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.14 of Sourcetree for Mac and

This High severity DoS (Denial of Service) vulnerability was introduced in version 5.6.0 of Confluence Data Center and S

A vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619_B20230130. Affected is the functi

A vulnerability was found in Totolink LR1200GB 9.1.0u.6619_B20230130. It has been rated as critical. This issue affects

A vulnerability was found in Totolink LR1200GB 9.1.0u.6619_B20230130. It has been declared as critical. This vulnerabili

The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the "id" parameter before submitting th

The Royal Elementor Addons and Templates WordPress plugin before 1.3.81 does not ensure that users accessing posts via a

The Newsletters WordPress plugin before 4.9.3 does not properly escape user-controlled parameters when they are appended

The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly validate parameters when updating us

The My Account Page Editor WordPress plugin before 1.3.2 does not validate the profile picture to be uploaded, allowing

EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option from a