2024

Mattermost versions 9.8.x <= 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2 and 9.5.x <= 9.5.5, when shared channels are enabled,

Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to properly sanitize the recipients of a webhook event which allows an

Mattermost versions 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2 and 9.5.x <= 9.5.5 fail to prevent users from specifying a Rem

Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to sanitize the RemoteClusterFrame payloads before audit logging them

Mattermost versions 9.5.x <= 9.5.5 and 9.8.0, when using shared channels with multiple remote servers connected, fail to

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Coun

The WP Lightbox 2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all ver

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPre

The Avalara for Salesforce CPQ app before 7.0 for Salesforce allows attackers to read an API key. NOTE: the current vers

When deploying Cloud Foundry together with the haproxy-boshrelease and using a non default configuration, it might be po

The WPQA Builder WordPress plugin before 6.1.1 does not have CSRF checks in some places, which could allow attackers to

The WPQA Builder WordPress plugin before 6.1.1 does not sanitise and escape some of its Slider settings, which could all

The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make use

The Himer WordPress theme before 2.1.1 does not sanitise and escape some of its Post settings, which could allow high pr

The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make log

The allows any authenticated user to join a private group due to a missing authorization check on a function

The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make use

The Snippet Shortcodes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu

The TCP protocol in RFC 9293 has a timing side channel that makes it easier for remote attackers to infer the content of

Improper Validation of Array Index vulnerability in Samsung Open Source Walrus Webassembly runtime engine allows a segme

mySCADA myPRO uses a hard-coded password which could allow an attacker to remotely execute code on the affected device

A vulnerability was found in itsourcecode Farm Management System 1.0. It has been declared as critical. Affected by this

The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" hea

SkillTree is a micro-learning gamification platform. Prior to version 2.12.6, the endpoint `/admin/projects/{projectnam

aimeos/ai-controller-frontend is the Aimeos frontend controller. Prior to versions 2024.04.2, 2023.10.9, 2022.10.8, 202

aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.1 and prior to versions 2

aimeos/ai-admin-jsonadm is the Aimeos e-commerce JSON API for administrative tasks. In versions prior to 2020.10.13, 202

A vulnerability classified as critical was found in linlinjava litemall up to 1.8.0. Affected by this vulnerability is a

Pomerium is an identity and context-aware access proxy. Prior to version 0.26.1, the Pomerium user info page (at `/.pome

Fides is an open-source privacy engineering platform. `fides.js`, a client-side script used to interact with the consent

Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitiz

httpTokenCacheKey uses path.Base to extract the expected HTTP-01 token value to lookup in the DirCache implementation. O

Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driv

Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driv

Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driv

Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driv

Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. T

The bson_strfreev function in the MongoDB C driver library may be susceptible to an integer overflow where the function

OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sud

In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoin

An issue discovered in MSP360 Backup Agent v7.8.5.15 and v7.9.4.84 allows attackers to obtain network share credentials

Vulnerability in Delinea Centrify PAS v. 21.3 and possibly others. The application is prone to the path traversal vulner

Vulnerability in Delinea Centrify PAS v. 21.3 and possibly others. The application is prone to the path traversal vulner

A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a `

In versions of Akana in versions prior to and including 2022.1.3 validation is broken when using the SAML Single Sign-On

aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.01 and prior to versions

Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.5, Regular Expression De

Improper privilege management in Jungo WinDriver 6.0.0 through 16.1.0 allows local attackers to escalate privileges and

Improper privilege management in Jungo WinDriver before 12.5.1 allows local attackers to escalate privileges and execute

Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.7.0 allows local attackers to cause a Windows blue sc