2024

SAP Bank Account Management (BAM) allows an authenticated user with restricted access to use functions which can result

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited,

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited,

SAP NWBC for HTML - versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702

The User Admin application of SAP NetWeaver AS for Java - version 7.50, insufficiently validates and improperly encodes 

A Cross-Site Request Forgery (CSRF) in Gestsup v3.2.46 allows attackers to arbitrarily edit user profile information via

A cross-site scripting (XSS) vulnerability in Gestsup v3.2.46 allows attackers to execute arbitrary web scripts or HTML

Ellucian Banner 9.17 allows Insecure Direct Object Reference (IDOR) via a modified bannerId to the /StudentSelfService/s

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image file

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image file

The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload

HCL Connections is vulnerable to a denial of service, caused by improper validation on certain requests. Using a special

A path traversal vulnerability was found in Undertow. This issue may allow a remote attacker to append a specially-craft

An issue has been discovered in GitLab EE affecting all versions starting from 16.8 before 16.8.2. When a user is assign

IBM Robotic Process Automation 21.0.2 contains a vulnerability that could allow user ids may be exposed across tenants.

Dell Unity, versions prior to 5.4, contains a Cross-site scripting vulnerability. An authenticated attacker could poten

Dell Unity, versions prior to 5.4, contains SQL Injection vulnerability. An authenticated attacker could potentially ex

Dell Unity, version(s) 5.3 and prior, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-

IBM CICS TX Standard and Advanced 11.1 could allow a user with physical access to the web browser to gain access to the

IBM CICS TX Standard and Advanced 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker t

IBM DataStage on Cloud Pak for Data 4.0.6 to 4.5.2 stores sensitive credential information that can be read by a privile

IBM CICS TX Standard and Advanced 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker t

A hidden interface in Motorola CX2L Router firmware v1.0.1 leaks information regarding the SystemWizardStatus component

The MapPress Maps for WordPress plugin before 2.88.16 is affected by an IDOR as it does not ensure that posts to be retr

The MapPress Maps for WordPress plugin before 2.88.15 does not sanitize and escape the map title when outputting it back

The Analytics Insights for Google Analytics 4 (AIWP) WordPress plugin before 6.3 is vulnerable to Open Redirect due to i

The EazyDocs WordPress plugin before 2.4.0 re-introduced CVE-2023-6029 (https://wpscan.com/vulnerability/7a0aaf85-8130-4

The GigPress WordPress plugin through 2.3.29 does not sanitise and escape some of its settings, which could allow high p

The Popup Box WordPress plugin before 20.9.0 does not sanitise and escape some of its settings, which could allow high p

The Splashscreen WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could

The lasTunes WordPress plugin through 3.6.1 does not have CSRF check in some places, and is missing sanitisation as well

The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high pr

The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high pr

A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS) attack and possib

A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than

Inadequate access control in Moodle LMS. This vulnerability could allow a local user with a student role to create arbit

Cross-Site Request Forgery (CSRF) vulnerability in WpSimpleTools Basic Log Viewer.This issue affects Basic Log Viewer: f

Cross-Site Request Forgery (CSRF) vulnerability in Ryan Duff, Peter Westwood WP Contact Form.This issue affects WP Conta

Cross-Site Request Forgery (CSRF) vulnerability in Contest Gallery Photos and Files Contest Gallery – Contact Form, Uplo

Cross-Site Request Forgery (CSRF) vulnerability in ARI Soft Contact Form 7 Connector.This issue affects Contact Form 7 C

Cross-Site Request Forgery (CSRF) vulnerability in Yannick Lefebvre Link Library.This issue affects Link Library: from n

Deserialization of Untrusted Data vulnerability in Kalli Dan. KD Coming Soon.This issue affects KD Coming Soon: from n/a

References to the "app loader" functionality could contain redirects to unexpected locations. Attackers could forge app

Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to

Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource thre

Processing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite could be reduced due to h

User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a use

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Geek Code Lab All

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nicdark Restaurant

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NinjaTeam WP Chat