2024

The incorrect object was checked for NULL in the built-in profiler, potentially leading to invalid memory access and und

Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control the

A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user'

If a website set a large custom cursor, portions of the cursor could have overlapped with the permission dialog, potenti

A website could have obscured the fullscreen notification by using a dropdown select input element. This could have led

Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed on another we

IBM Common Licensing 9.0 could allow a local user to enumerate usernames due to an observable response discrepancy. IBM

In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 befo

The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4

HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 be

HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 be

Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.

The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3

Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3,

The Frentix GmbH OpenOlat LMS is affected by stored a Cross-Site Scripting (XSS) vulnerability. It is possible to upload

The Frentix GmbH OpenOlat LMS is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities. An attacker wit

Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported v

Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 befor

Open redirect vulnerability in adaptive media administration page in Liferay DXP 2023.Q3 before patch 6, and 7.4 GA thro

Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101,

Liferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update 6, and 7.4 before update 16 all

The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'll_reciprocal' parameter in

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the

The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last charac

A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firm

A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch

PrestaShop is an open-source e-commerce platform. Starting in version 8.1.0 and prior to version 8.1.4, PrestaShop is vu

Iris is a web collaborative platform that helps incident responders share technical details during investigations. A sto

The link to update all installed language packs did not include the necessary token to prevent a CSRF risk.

Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all

Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other grou

The URL parameters accepted by forum search were not limited to the allowed parameters.

Weak MySQL database root password in LaborOfficeFree affects version 19.10. This vulnerability allows an attacker to cal

Weak MySQL database root password in LaborOfficeFree affects version 19.10. This vulnerability allows an attacker to per

Encrypted database credentials in LaborOfficeFree affecting version 19.10. This vulnerability allows an attacker to read

A weak permission was found in the backup directory in LaborOfficeFree affecting version 19.10. This vulnerability allow

An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to mem

Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache

An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIO

An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c mishandles the situation where

Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a /

plugins/gtk+/glade-gtk-box.c in GNOME Glade before 3.38.1 and 3.39.x before 3.40.0 mishandles widget rebuilding for Glad

can: out of bounds in remove_rx_filter function

Vulnerability of improper access control in the email module.Successful exploitation of this vulnerability may affect se

Input verification vulnerability in the account module.Successful exploitation of this vulnerability may cause features

Out-of-bounds read vulnerability in the smart activity recognition module.Successful exploitation of this vulnerability

Vulnerability of defects introduced in the design process in the Control Panel module.Successful exploitation of this vu

Vulnerability of configuration defects in some APIs of the audio module.Successful exploitation of this vulnerability ma

IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores potentiall

IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores potentiall