2024

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Always drain health in shutdown callback

In the Linux kernel, the following vulnerability has been resolved: s390/fpu: Re-add exception handling in load_fpu_sta

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix CT entry update leaks of modify head

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix a deadlock in dma buf fence polling

In the Linux kernel, the following vulnerability has been resolved: net: wan: fsl_qmc_hdlc: Convert carrier_lock spinlo

** UNSUPPORTED WHEN ASSIGNED ** The Apache Helix Front (UI) component contained a hard-coded secret, allowing an attacke

In the Linux kernel, the following vulnerability has been resolved: net: usb: qmi_wwan: fix memory leak for not ip pack

Kanister is a data protection workflow management tool. The kanister has a deployment called default-kanister-operator,

Khoj is an application that creates personal AI agents. The Automation feature allows a user to insert arbitrary HTML in

Prior to 3385, the user-controlled role parameter enters the application in the Kubernetes::RoleVerificationsController.

Hertzbeat is an open source, real-time monitoring system. Hertzbeat has an authenticated (user role) RCE via unsafe dese

Hertzbeat is an open source, real-time monitoring system. Hertzbeat 1.6.0 and earlier declares a /api/monitor/{monitorId

Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earl

Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earli

An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server, allowing an attacker to update the

An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication wi

An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a GitHub App with only

IBM Global Configuration Management 7.0.2 and 7.0.3 could allow an authenticated user to archive a global baseline due t

memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier wh

An issue was discovered in Italtel Embrace 1.6.4. The web application inserts the access token of an authenticated user

Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/domain_managemen

An improper access control vulnerability in the Azure Managed Instance for Apache Cassandra allows an authenticated atta

Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user

Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/domain_managemen

A tampering vulnerability in the CylanceOPTICS Windows Installer Package of CylanceOPTICS for Windows version 3.2 and 3.

Discourse Placeholder Forms will let you build dynamic documentation. Unsanitized and stored user input was injected in

eScan Management Console 14.0.1400.2281 is vulnerable to Incorrect Access Control via acteScanAVReport.

SeaCMS 13.0 has a remote code execution vulnerability. The reason for this vulnerability is that although admin_editplay

The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors.

Improper Access Controls allows backend users to overwrite their username when disallowed.

The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions.

The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors.

Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not..

Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would al

LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge dev

MEGABOT is a fully customized Discord bot for learning and fun. The `/math` command and functionality of MEGABOT version

Apollo is a configuration management system. A vulnerability exists in the synchronization configuration feature that al

Umbraco CMS is an ASP.NET CMS. An authenticated user can access a few unintended endpoints. This issue is fixed in 14.1.

Umbraco is an ASP.NET CMS. Some endpoints in the Management API can return stack trace information, even when Umbraco is

An issue in apollocongif apollo v.2.2.0 allows a remote attacker to obtain sensitive information via a crafted request.

Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_editor.php

Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /module.php?module=karm

Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_config.php

Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_widgets.ph

Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_widgets.ph

Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/admin_page.php?link_id=1&mode=d

Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php

Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php

Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php

Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_log.php?cl