2024

Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.V

An issue was discovered in the Archibus app 4.0.3 for iOS. There is an XSS vulnerability in the create work request feat

When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, R

When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http

Denial of service in PAM password rotation during the check-in process in Devolutions Server 2023.3.14.0 allows an authe

Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier a

Improper access control in the notification feature in Devolutions Server 2023.3.14.0 and earlier allows a low privilege

An unauthenticated Denial-of-Service (DoS) vulnerability exists in the Spectrum service accessed via the PAPI protocol

There is an arbitrary file deletion vulnerability in the CLI used by ArubaOS. Successful exploitation of this vulnerabil

IBM Watson CP4D Data Stores 4.6.0 through 4.6.3 could allow a user with physical access and specific knowledge of the sy

LDAP users on IBM Spectrum Virtualize 8.5 which are configured to require multifactor authentication can still authentic

IBM Aspera Faspex 5.0.0 and 5.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Insufficient validation of parameters in

pictureproxy.php in the dirk1983 mm1.ltd source code f9f4bbc allows SSRF via the url parameter. NOTE: the references sec

A Server-Side Request Forgery (SSRF) in the getFileFromRepo function of WonderCMS v3.1.3 allows attackers to force the a

Online Flight Booking Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via th

A reflected cross-site scripting (XSS) vulnerability exists in SuperCali version 1.1.0, allowing remote attackers to exe

CMS Made Simple Version 2.2.19 is vulnerable to Cross Site Scripting (XSS). This vulnerability resides in the File Manag

CMS Made Simple version 2.2.19 is vulnerable to Server-Side Template Injection (SSTI). The vulnerability exists within t

Cross-Site Scripting (XSS) vulnerability stored in TP-Link Archer AX50 affecting firmware version 1.0.11 build 2022052.

A CWE-613 “Insufficient Session Expiration” vulnerability in the web application, due to the session cookie “sessionid”

A CWE-646 “Reliance on File Name or Extension of Externally-Supplied File” vulnerability in the “iec61850” functionality

A CWE-425 “Direct Request ('Forced Browsing')” vulnerability in the “measure” functionality of the web application allow

A CWE-1236 “Improper Neutralization of Formula Elements in a CSV File” vulnerability in the “file_configuration” functio

A CWE-425 “Direct Request ('Forced Browsing')” vulnerability in the “file_configuration” functionality of the web applic

A CWE-434 “Unrestricted Upload of File with Dangerous Type” vulnerability in the “file_configuration” functionality of t

A CWE-552 “Files or Directories Accessible to External Parties” vulnerability in the embedded Chromium browser allows a

A CWE-184 “Incomplete List of Disallowed Inputs” vulnerability in the embedded Chromium browser (concerning the handling

A CWE-250 “Execution with Unnecessary Privileges” vulnerability in the embedded Chromium browser (due to the binary bein

In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - fix infinite loop on requests no

swftools v0.9.2 was discovered to contain a segmentation violation via the function s_font at swftools/src/swfc.c.

swftools v0.9.2 was discovered to contain a segmentation violation via the function state_free at swftools/src/swfc-hist

swftools v0.9.2 was discovered to contain a segmentation violation via the function compileSWFActionCode at swftools/lib

swftools v0.9.2 was discovered to contain a segmentation violation via the function free_lines at swftools/lib/modules/s

Use after free vulnerability in pub_crypto_recv_msg prior to SMR Mar-2024 Release 1 due to race condition allows local a

Improper Handling of Insufficient Privileges in Samsung Account prior to version 14.8.00.3 allows local attackers to acc

Improper access control in Samsung Voice Recorder prior to versions 21.5.16.01 in Android 12 and Android 13, 21.4.51.02

Improper access control in Samsung Voice Recorder prior to versions 21.5.16.01 in Android 12 and Android 13, 21.4.51.02

Improper validation vulnerability in Samsung Internet prior to version 24.0.3.2 allows local attackers to execute arbitr

Improper handling of granting permission for Trusted Web Activities in Samsung Internet prior to version 24.0.0.41 allow

Improper access control vulnerability in CustomFrequencyManagerService prior to SMR Mar-2024 Release 1 allows local atta

Heap overflow in Little Kernel in bootloader prior to SMR Mar-2024 Release 1 allows local privileged attackers to execut

Stack overflow in Little Kernel in bootloader prior to SMR Mar-2024 Release 1 allows local privileged attackers to execu

Incorrect default permission in AppLock prior to SMR MAr-2024 Release 1 allows local attackers to configure AppLock sett

Missing proper interaction for opening deeplink in Samsung Internet prior to version v24.0.0.0 allows remote attackers t

Improper input validation in IpcTxSndSetLoopbackCtrl in libsec-ril prior to SMR Sep-2023 Release 1 allows local attacker

Missing release of resource after effective lifetime (CWE-772) in the Controller 7000 resulted in HBUS connected T-Seri

Improper neutralization of special elements in output (CWE-74) used by the email generation feature of the Command Cent

The Blue Triad EZAnalytics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'bt_webid' param

The JM Twitter Cards plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 14