2024

The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthen

A flaw was found in the OpenShift build process, where the docker-build container is configured with a hostPath volume m

The QOCA aim from Quanta Computer has an Authorization Bypass Through User-Controlled Key vulnerability. By controlling

The login mechanism via device authentication of CGFIDO from Changing Information Technology has an Authentication Bypas

The passwordless login mechanism in CGFIDO from Changing Information Technology has an Authentication Bypass vulnerabili

An issue exists in SoftIron HyperCloud where authenticated, but non-admin users can create data pools, which could pote

Ashlar-Vellum Graphite VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerabili

Ashlar-Vellum Graphite VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerabili

Ashlar-Vellum Cobalt XE File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remot

Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows

Ashlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remot

Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows

Ashlar-Vellum Cobalt AR File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability

Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows

Panda Security Dome Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers t

A vulnerability was found in Tsinghua Unigroup Electronic Archives Management System 3.2.210802(62532). It has been clas

Foxit PDF Reader Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to e

Foxit PDF Reader AcroForm Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attack

Foxit PDF Reader AcroForm Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attac

iXsystems TrueNAS CORE fetch_plugin_packagesites tar Cleartext Transmission of Sensitive Information Vulnerability. This

iXsystems TrueNAS CORE tarfile.extractall Directory Traversal Remote Code Execution Vulnerability. This vulnerability al

Tasklists provides plugin tasklists for GLPI. Versions prior to 2.0.4 have a blind SQL injection vulnerability. Version

Firecrawl is a web scraper that allows users to extract the content of a webpage for a large language model. Versions pr

Simofa is a tool to help automate static website building and deployment. Prior to version 0.2.7, due to a design mistak

Veritas / Arctera Data Insight before 7.1.1 allows Application Administrators to conduct SQL injection attacks.

Better Auth is an authentication library for TypeScript. An open redirect vulnerability has been identified in the verif

Password Pusher is an open source application to communicate sensitive information over the web. A vulnerability has bee

LGSL (Live Game Server List) provides online status lists for online video games. Versions up to and including 6.2.1 con

free-one-api allows users to access large language model reverse engineering libraries through the standard OpenAI API f

Khoj is a self-hostable artificial intelligence app. Prior to version 1.29.10, an Insecure Direct Object Reference (IDOR

Delta Electronics DRASimuCAD STP File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability all

Delta Electronics DRASimuCAD ICS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerabilit

Delta Electronics DRASimuCAD STP File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability all

Webmin CGI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute

AnyDesk Link Following Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensi

TeamPass before 3.1.3.1 does not properly prevent a user from acting with the privileges of a different user_id.

TeamPass before 3.1.3.1 does not properly check whether a mail_me (aka action_mail) operation is on behalf of an adminis

TeamPass before 3.1.3.1, when retrieving information about access rights for a folder, does not properly check whether a

IBM WebSphere Automation 1.7.5 could allow a remote privileged user, who has authorized access to the swagger UI, to exe

A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Contro

Infinix devices contain a pre-loaded "com.rlk.weathers" application, that exposes an unsecured content provider. An atta

Tecnick TCExam – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Tecnick TCExam – Multiple CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Boa web server – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Mashov – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Smadar SPS – CWE-327: Use of a Broken or Risky Cryptographic Algorithm

Tiki Wiki CMS – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Tiki Wiki CMS – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Tiki Wiki CMS – CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)