2024

HCL Nomad server on Domino fails to properly handle users configured with limited Domino access resulting in a possible

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 up to 20230922. It has been rated as proble

A vulnerability was found in ShopXO up to 6.1.0. It has been declared as critical. Affected by this vulnerability is an

A vulnerability was found in ZKTeco BioTime up to 9.5.2. It has been classified as problematic. Affected is an unknown f

Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series

Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series

In the Linux kernel, the following vulnerability has been resolved: media: v4l: async: Properly re-initialise notifier

In the Linux kernel, the following vulnerability has been resolved: mmc: davinci: Don't strip remove function when driv

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: WARN on vNMI + NMI window iff NMIs are ou

In the Linux kernel, the following vulnerability has been resolved: bcache: fix variable length array abuse in btree_it

In the Linux kernel, the following vulnerability has been resolved: media: mc: Fix graph walk in media_pipeline_start

In the Linux kernel, the following vulnerability has been resolved: kdb: Fix buffer overflow during tab-complete Curre

In the Linux kernel, the following vulnerability has been resolved: drm/i915/hwmon: Get rid of devm When both hwmon an

In the Linux kernel, the following vulnerability has been resolved: crypto: starfive - Do not free stack buffer RSA te

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: do not call vma_add_reservation upon EN

In the Linux kernel, the following vulnerability has been resolved: md/raid5: fix deadlock that raid5d() wait for itsel

In the Linux kernel, the following vulnerability has been resolved: fbdev: savage: Handle err return when savagefb_chec

In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: fix vmalloc which may return null if ca

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix input format query of

In the Linux kernel, the following vulnerability has been resolved: xfs: fix log recovery buffer allocation for the leg

KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via

drupal-wiki.com Drupal Wiki before 8.31.1 allows XSS via comments, captions, and image titles of a Wiki page.

An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file

The IPv6 implementation in the Linux kernel before 6.3 has a net/ipv6/route.c max_size threshold that can be consumed ea

rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote auth

supOS 5.0 allows api/image/download?fileName=../ directory traversal for reading files.

An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x th

jc21 NGINX Proxy Manager before 2.11.3 allows backend/internal/certificate.js OS command injection by an authenticated u

A vulnerability classified as problematic was found in y_project RuoYi up to 4.7.9. Affected by this vulnerability is th

Robotmk before 2.0.1 allows a local user to escalate privileges (e.g., to SYSTEM) if automated Python environment setup

Cross Site Scripting (XSS) vulnerability in Automattic Newspack Ads allows Stored XSS.This issue affects Newspack Ads: f

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WofficeIO Woffice

Cross Site Scripting (XSS) vulnerability in WofficeIO Woffice Core allows Reflected XSS.This issue affects Woffice Core:

Cross Site Scripting (XSS) vulnerability in Automattic Newspack Campaigns allows Stored XSS.This issue affects Newspack

Gogs through 0.13.0 allows argument injection during the tagging of a new release.

Gogs through 0.13.0 allows argument injection during the previewing of changes.

Gogs through 0.13.0 allows deletion of internal files.

The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code

Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filenam

VMware Cloud Director Availability contains an HTML injection vulnerability. A malicious actor with network access to

Information exposure vulnerability in the MRW plugin, in its 5.4.3 version, affecting the "mrw_log" functionality. This

Kaiten 57.128.8 allows remote attackers to enumerate user accounts via a crafted POST request, because a login response

QR/demoapp/qr_image.php in Asial JpGraph Professional through 4.2.6-pro allows remote attackers to execute arbitrary cod

Command injection when ingesting a remote Kaggle dataset due to a lack of input sanitization in the ingest_kaggle() API

The Nested Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,

Under certain circumstances, when the controller is in factory reset mode waiting for initial setup, it will broadcast i

The Premium Addons for Elementor plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in a

The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'u

The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'u

Incorrect Default Permissions vulnerability in Smart Device Communication Gateway preinstalled on MELIPC Series MI5122-V