2024

hoolock is a suite of lightweight utilities designed to maintain a small footprint when bundled. Starting in version 2.0

In Splunk Enterprise versions below 9.0.8, the Splunk RapidDiag utility discloses server responses from external applica

In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index

In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permission

IIBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user with CONNECT p

The Meris WordPress theme through 1.1.2 does not sanitise and escape some parameters before outputting them back in the

The EventON-RSVP WordPress plugin before 2.9.5 does not sanitise and escape some parameters before outputting it back in

The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not sanitise and escape some of its settings, which

The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not have a CSRF check in place when deleting inquir

The WP Review Slider WordPress plugin before 13.0 does not sanitise and escape some of its settings, which could allow h

The EventPrime WordPress plugin before 3.3.6 lacks authentication and authorization, allowing unauthenticated visitors t

The WP User Profile Avatar WordPress plugin before 1.0.1 does not properly check for authorisation, allowing authors to

The SEOPress WordPress plugin before 7.3 does not sanitise and escape some of its settings, which could allow high privi

IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.1, 10.5, and 11.1 could allow an authenticated user

IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1 and 11.5 could allow an authenticated u

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an insecure cryptographic algori

IBM Db2 10.1, 10.5, and 11.1 could allow a remote user to execute arbitrary code caused by installing like named jar fil

An attacker could execute unauthorized script on a legitimate site through UXSS using window.open() by opening a javascr

IObit Malware Fighter v11.0.0.1274 is vulnerable to a Denial of Service vulnerability by triggering the 0x8001E00C IOCTL

IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 under certain circumstances could allow an authen

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow an authenticated user

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 federated server is vulnerable to a denial of ser

A vulnerability was found in hongmaple octopus 1.0. It has been classified as critical. Affected is an unknown function

A vulnerability was found in Project Worlds Online Admission System 1.0 and classified as critical. This issue affects s

Autolab is a course management service that enables instructors to offer autograded programming assignments to their stu

CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command. This allo

A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This flaw allows a

Open redirect vulnerability in Access analysis CGI An-Analyzer released in 2023 December 31 and earlier allows a remote

darkhttpd through 1.15 allows local users to discover credentials (for --auth) by listing processes and their arguments.

A vulnerability was found in Any-Capture Any Sound Recorder 2.93. It has been declared as problematic. This vulnerabilit

A vulnerability was found in Nsasoft ShareAlarmPro 2.1.4 and classified as problematic. Affected by this issue is some u

A vulnerability has been found in Nsasoft Product Key Explorer 4.0.9 and classified as problematic. Affected by this vul

A vulnerability, which was classified as critical, was found in European Chemicals Agency IUCLID 7.10.3 on Windows. Affe

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affe

Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries.

The ColorMag theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the plugin_ac

The VK Block Patterns plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includ

The POPS! Rebel application 5.0 for Android, in POPS! Rebel Bluetooth Glucose Monitoring System, sends unencrypted gluco

The Notary Project is a set of specifications and tools intended to provide a cross-industry standard for securing softw

Consensys Discovery versions less than 0.4.5 uses the same AES/GCM nonce for the entire session. which should ideally be

DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used

A vulnerability, which was classified as critical, has been found in 个人开源 mldong 1.0. This issue affects the function Ex

A vulnerability classified as problematic was found in Xlightftpd Xlight FTP Server 1.1. This vulnerability affects unkn

Hard-coded credentials in mod-remote-storage versions under 1.7.2 and from 2.0.0 to 2.0.3 allows unauthorized users to g

AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and less than 1.9.0 incorrectly validates some invalid ECDSA signatu

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Ar

MolecularFaces before 0.3.0 is vulnerable to cross site scripting. A remote attacker can execute arbitrary JavaScript in

A vulnerability classified as problematic has been found in EFS Easy File Sharing FTP 3.6. This affects an unknown part

A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as critical.

A vulnerability was found in Smsot up to 2.12. It has been declared as critical. Affected by this vulnerability is an un